Feeds & API

Every listing on this site is also available as RSS 2.0 (feed.xml) and JSON Feed 1.1 (feed.json). Items use the same newest-first ordering in both formats.

All briefs

• RSS: https://feed.craftedsignal.io/feed.xml
• JSON Feed: https://feed.craftedsignal.io/feed.json

RSS is a recent-items channel that retains up to 2,000 items. JSON Feed pages contain up to 100 items and are the completeness contract: follow the top-level next_url until it is absent.

Filtered feeds

Replace <term> and <slug> with the value you want.

Severity terms are critical, high, medium, low, and rumour. Each endpoint is an exact match, so /severities/high/feed.xml contains High only. Type terms are threat, coverage, advisory, and rumour.

JSON Feed 1.1 shape

The standard fields follow JSON Feed 1.1. CraftedSignal metadata uses _cs_* extensions.

{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "CraftedSignal Threat Feed - CraftedSignal Threat Feed",
  "home_page_url": "https://feed.craftedsignal.io/",
  "feed_url": "https://feed.craftedsignal.io/feed.json",
  "next_url": "https://feed.craftedsignal.io/page/2/feed.json",
  "items": [
    {
      "id": "https://feed.craftedsignal.io/briefs/2026-04-some-cve/",
      "url": "https://feed.craftedsignal.io/briefs/2026-04-some-cve/",
      "title": "...",
      "summary": "...",
      "content_html": "<p>...</p>",
      "date_published": "2026-04-28T12:34:56Z",
      "date_modified": "2026-04-28T12:34:56Z",
      "_cs_type": "threat",
      "_cs_severities": ["critical"],
      "_cs_products": ["FortiGate"],
      "_cs_vendors": ["Fortinet"],
      "_cs_actors": [],
      "_cs_tags": ["cve"],
      "_cs_exploited": false,
      "_cs_has_poc": false,
      "_cs_poc_references": [],
      "_cs_cpes": [],
      "_cs_cves": [{ "id": "CVE-2026-XXXX", "cvss": 9.8 }]
    }
  ]
}

next_url appears only when another page exists. Treat unknown _cs_* fields as forward-compatible extensions.

STIX 2.1

The static CDN publishes validated STIX 2.1 bundles for TIP and SOAR ingestion. No authentication is required.

• Rolling compatibility alias: https://feed.craftedsignal.io/stix.json
• Monthly compatibility aliases: https://feed.craftedsignal.io/stix/YYYY-MM.json
• Authoritative bundle index: https://feed.craftedsignal.io/stix/index.json

A bundle uses the standard top-level type, id, and objects fields. Its reports reference the included indicator, attack-pattern, threat-actor, software, vulnerability, and identity objects with stable STIX IDs. Revisions retain their stable report ID, advance the report's modified timestamp, and expose the public revision number.

Every report includes these CraftedSignal properties:

• x_craftedsignal_brief_id, x_craftedsignal_event_id, and x_craftedsignal_revision
• x_craftedsignal_canonical_url for the canonical public brief
• x_craftedsignal_activity_at, x_craftedsignal_severity, and x_craftedsignal_type
• x_craftedsignal_exploitation_evidence
• x_craftedsignal_cvss_max and x_craftedsignal_epss_max, each a number or null
• x_craftedsignal_kev_status, one of "true", "false", or "unknown"

Each report also has a craftedsignal external reference whose external_id is the public brief ID and whose URL matches x_craftedsignal_canonical_url.

The index is version 2.0 and identifies both rolling and monthly scopes. Each entry records path, a sha256:<64 lowercase hex> checksum, size_bytes, report_count, first_published, last_published, generated, and STIX spec_version. Monthly entries also include month. Index entries point to immutable content-addressed paths under /stix/releases/; the digest in each filename matches its checksum. Publication uploads and confirms every immutable bundle before switching the index. The stable rolling and monthly URLs are compatibility aliases refreshed after that switch and are not index targets.

Tips

• Slack speaks RSS natively: /feed subscribe https://feed.craftedsignal.io/severities/critical/feed.xml.
• Microsoft Teams can consume any of the RSS URLs above through an RSS workflow or connector.
• Email aggregators can turn an RSS URL into per-item or daily-digest mail.
• Custom integrations should page through feed.json and ignore extension keys they do not recognize.

For per-subscriber filter combinations and channel routing, use the subscribe form.

Back to feed