About ThreatFilter

What it is

ThreatFilter aggregates public cyber threat intelligence — vulnerability advisories, exploitation reports, and security news — from 52 configured sources. Pick the vendors in your stack and the regions you care about; the feed filters to just what's relevant.

How it works

Ingestion runs every 30 minutes, retrieves enabled RSS, Atom and JSON sources, and deduplicates stored items. Upstream failures, bounded retrieval and historical backfill can leave coverage partial. A recent attempt, a successful retrieval and completed coverage are different observations; the coverage view shows them separately from IOC dataset age. No login is required to read or filter the public advisory feed.

Classification is currently heuristic. The dedicated ML classifier (vendor / severity / exploitation / region tagging) is not yet running, so those tags are derived in your browser by matching each item's title and summary against a 349-vendor alias catalog with conservative, word-boundary keyword rules. A tag can be wrong; a sector mention does not establish that the sector was targeted. Always open the linked source to confirm. Vendor tile counts reflect loaded records, with a visible retrieval limit, rather than all-time history.

Data sources

Public government and vendor feeds, vulnerability databases and independent security reporting. These have different evidentiary roles: a vendor advisory, a database entry and a news report are not interchangeable. The source directory lists the current configuration, formats, publisher links and a dated status snapshot, with a separate live coverage view.

The registry lists 58 sources in all; 52 are currently enabled and included in the 30-minute ingestion schedule, and 50 are RSS/Atom entries available through the OPML export.

ThreatFilter does not provide a complete historical CISA KEV or NVD mirror. Use the original catalogues for exhaustive coverage. Qualified CVE pages retain links to supporting sources; they are a selected research index.

Email status

Email subscriptions, verification and delivery are disabled. There is no activation date. The email status page remains available, but no email setup is needed to use ThreatFilter. Use the RSS feed or bookmark a filtered view.

Filters, shareable links & RSS

Filter state is captured in the URL (?v=&sev=&ex=&geo=&q=) so any filtered view can be bookmarked or shared. The same state is mirrored to localStorage so a return visit restores your last filter automatically. Any vendor selection also produces a matching RSS feed at /feed.xml?v=… (alias /rss.xml) — a personalized, no-signup feed you can drop into any reader.

Time windows use when ThreatFilter first received an item, which can differ from its publication date. “Since last visit” operates on loaded records using local browser state; it is not a server history of your visits and does not establish complete coverage.

Privacy

No tracking pixels or visitor analytics are enabled. Saved filters and since-last-visit state stay in your browser. Returning visitors are not measured. The separate, authenticated IOC workbench retains private lookup history and provider caches, disclosed inside the workbench; it is not public website analytics. Do not submit sensitive indicators unless that handling is appropriate.

Operated by

ThreatFilter is an independent project, built and kept current with heavy automation rather than a newsroom. The aggregation, tagging and tool datasets described above are generated from public feeds and open datasets, and the source registry and public APIkeep the inputs auditable rather than asking you to take the output on trust. Public browsing needs no account, and the heuristic-classification caveats above apply — always confirm against the linked primary source.