"""Кандидаты для расширения реестра omni: security/CVE/leaks/CN/RU/tg. Источник истины для tools/probe_fresh.py. Живые строки после прогона переезжают в omni/sources_fresh.py (генерируется `--emit`). Формат dict совпадает с Source(**d); адаптеры — только из feeds.ADAPTERS. """ import datetime def d(name, category, kind, url, adapter="rss", tags=(), limit=15, detail=False, extra=None, **kw): row = {"name": name, "category": category, "kind": kind, "url": url, "adapter": adapter, "tags": tuple(tags), "limit": limit, "detail": detail, "extra": extra or {}} row.update(kw) return row _NOW = datetime.datetime.utcnow() _NVD_SINCE = (_NOW - datetime.timedelta(days=7)).strftime("%Y-%m-%dT00:00:00.000") _NVD_UNTIL = _NOW.strftime("%Y-%m-%dT%H:%M:%S.000") CANDIDATES = [ # ---------------- 1. security news / research ---------------- d("hackread", "security", "rss", "https://hackread.com/feed/", "rss", ("news",)), d("securityaffairs", "security", "rss", "https://securityaffairs.com/feed", "rss", ("news",)), d("helpnetsecurity", "security", "rss", "https://www.helpnetsecurity.com/feed/", "rss", ("news",)), d("infosecurity_magazine", "security", "rss", "https://www.infosecurity-magazine.com/rss/news/", "rss", ("news",)), d("cybersecuritydive", "security", "rss", "https://www.cybersecuritydive.com/feeds/news/", "rss", ("news",)), d("theregister_security", "security", "rss", "https://www.theregister.com/security/headlines.atom", "rss", ("news",)), d("arstechnica_security", "security", "rss", "https://arstechnica.com/security/feed/", "rss", ("news",)), d("csoonline", "security", "rss", "https://www.csoonline.com/feed/", "rss", ("news",)), d("industrialcyber", "security", "rss", "https://industrialcyber.co/feed/", "rss", ("ics", "news")), d("malwaretech_blog", "security", "rss", "https://www.malwaretech.com/feed", "rss", ("research",)), d("hackmag", "security", "rss", "https://hackmag.com/rss", "rss", ("ru", "research")), # ------------- research / vendor labs ------------- d("recordedfuture_blog", "security", "rss", "https://www.recordedfuture.com/feed", "rss", ("cti",)), d("cisco_security_blog", "security", "rss", "https://blogs.cisco.com/security/feed", "rss", ("cti", "research")), d("checkpoint_research", "security", "rss", "https://research.checkpoint.com/feed/", "rss", ("research",)), d("redcanary_blog", "security", "rss", "https://redcanary.com/blog/feed/", "rss", ("dfir",)), # elastic_security_labs — в реестре уже есть https://www.elastic.co/security-labs/rss/feed.xml d("greynoise_blog", "security", "rss", "https://www.greynoise.io/blog/rss.xml", "rss", ("research",)), d("sekoia_blog", "security", "rss", "https://blog.sekoia.io/feed/", "rss", ("research",)), d("bitdefender_labs", "security", "rss", "https://www.bitdefender.com/blog/api/rss/labs/", "rss", ("research",)), d("paloalto_blog", "security", "rss", "https://www.paloaltonetworks.com/blog/feed/", "rss", ("research",)), d("sentinelone_blog", "security", "rss", "https://www.sentinelone.com/blog/feed/", "rss", ("research",)), d("microsoft_security_blog", "security", "rss", "https://www.microsoft.com/en-us/security/blog/feed/", "rss", ("research",)), d("virustotal_blog", "security", "rss", "https://blog.virustotal.com/feeds/posts/default", "rss", ("malware",)), d("jfrog_blog", "security", "rss", "https://jfrog.com/blog/feed/", "rss", ("supply-chain",)), d("gitguardian_blog", "security", "rss", "https://blog.gitguardian.com/rss/", "rss", ("secrets",)), d("sonatype_blog", "security", "rss", "https://www.sonatype.com/blog/rss.xml", "rss", ("supply-chain",)), d("acunetix_blog", "security", "rss", "https://www.acunetix.com/blog/feed/", "rss", ("appsec",)), d("socradar_blog", "security", "rss", "https://socradar.io/feed/", "rss", ("cti",)), d("arcticwolf_blog", "security", "rss", "https://arcticwolf.com/feed/", "rss", ("cti",)), d("citizenlab", "security", "rss", "https://citizenlab.ca/feed/", "rss", ("apt", "research")), d("dfir_report", "security", "rss", "https://thedfirreport.com/feed/", "rss", ("dfir", "ransomware")), d("ncsc_uk", "security", "rss", "https://www.ncsc.gov.uk/api/1/services/v1/all-rss-feed.xml", "rss", ("gov", "cve")), d("0xdf", "security", "rss", "https://0xdf.gitlab.io/feed.xml", "rss", ("writeup", "htb")), d("infosec_writeups", "community", "rss", "https://infosecwriteups.com/feed", "rss", ("writeup",)), # ---------------- 2. CVE / vulnerabilities ---------------- # nvd_recent: окно last-modified считается в момент вызова (см. emit -> dynamic), # статическая дата протухает уже через неделю. d("nvd_recent", "security", "json", "https://services.nvd.nist.gov/rest/json/cves/2.0", "nvd", ("cve", "nvd"), dynamic="NVD_LAST_WEEK"), d("nvd_exploited_kw", "security", "json", "https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=25&keywordSearch=exploited%20in%20the%20wild", "nvd", ("cve", "exploited")), d("github_advisories_api", "security", "json", "https://api.github.com/advisories?per_page=30&sort=published&direction=desc", "ghsa", ("cve", "ghsa")), d("ubuntu_usn", "security", "rss", "https://ubuntu.com/security/notices/rss.xml", "rss", ("cve", "linux")), d("arch_linux_asa", "security", "rss", "https://security.archlinux.org/advisory/feed.atom", "rss", ("cve", "linux")), d("mozilla_advisories", "security", "html", "https://www.mozilla.org/en-US/security/advisories/", "html_listing", ("cve", "browser"), extra={"include_prefixes": ["/en-US/security/advisories/mfsa"]}), d("chrome_releases_security", "security", "rss", "https://chromereleases.googleblog.com/feeds/posts/default", "rss", ("cve", "browser")), d("vuldb_recent", "security", "rss", "https://vuldb.com/?rss.recent", "rss", ("cve",)), d("sploitus_rss", "security", "rss", "https://sploitus.com/rss", "rss", ("exploit",)), d("seclists_fulldisclosure", "security", "rss", "https://seclists.org/rss/fulldisclosure.rss", "rss", ("mailing", "exploit")), d("seclists_nmap", "security", "rss", "https://seclists.org/rss/nmap-dev.rss", "rss", ("mailing",)), # ---------------- 3. leaks / ransomware / underground ---------------- d("darkwebinformer", "abuse", "rss", "https://darkwebinformer.com/feed", "rss", ("leak", "news")), d("databreaches_net", "abuse", "rss", "https://databreaches.net/feed/", "rss", ("breach", "news")), d("redpacketsecurity", "abuse", "rss", "https://www.redpacketsecurity.com/feed/", "rss", ("cve", "leak")), d("hackread_breaches", "abuse", "rss", "https://hackread.com/category/data-breaches/feed/", "rss", ("breach",)), d("darknetlive", "abuse", "rss", "https://darknetlive.com/feed/", "rss", ("darknet",)), d("ransomware_live_recent", "abuse", "json", "https://api.ransomware.live/recentvictims", "generic_json", ("ransomware",)), d("ransomlook_recent", "abuse", "json", "https://www.ransomlook.io/api/recent", "generic_json", ("ransomware",)), # ---------------- 4. китайские ---------------- d("sihaoyou_feed", "security", "rss", "https://www.4hou.com/feed", "rss", ("cn", "research")), d("seebug_paper", "security", "rss", "https://paper.seebug.org/rss/", "rss", ("cn", "research")), d("secrss", "security", "html", "https://www.secrss.com/", "html_listing", ("cn", "news"), extra={"include_prefixes": ["/articles/"], "exclude_exact": ["/articles"]}), d("anquanke_news", "security", "html", "https://www.anquanke.com/news", "html_listing", ("cn", "news"), extra={"include_prefixes": ["/post/id/"]}), d("t00ls", "forum", "html", "https://www.t00ls.com/", "html_listing", ("cn", "forum"), detail=True, extra={"include_prefixes": ["/articles-", "/Vuls-"]}), d("freebuf_feed", "security", "rss", "https://www.freebuf.com/feed", "rss", ("cn", "news")), # ---------------- 5. русскоязычные ---------------- d("xakep_ru", "security", "rss", "https://xakep.ru/feed/", "rss", ("ru", "news")), d("habr_news", "security", "rss", "https://habr.com/ru/rss/news/", "rss", ("ru", "news")), d("habr_infosecurity", "security", "rss", "https://habr.com/ru/rss/hub/infosecurity/", "rss", ("ru", "research")), d("habr_ai", "community", "rss", "https://habr.com/ru/rss/hub/artificial_intelligence/", "rss", ("ru", "ai")), d("kaspersky_ru_blog", "security", "rss", "https://www.kaspersky.ru/blog/feed/", "rss", ("ru", "research")), d("securitylab_rss", "security", "rss", "https://www.securitylab.ru/rss/all.xml", "rss", ("ru", "news")), d("anti_malware_ru", "security", "rss", "https://www.anti-malware.ru/rss.xml", "rss", ("ru", "news")), d("cnews_security", "security", "rss", "https://www.cnews.ru/inc/rss/news.xml", "rss", ("ru", "news")), d("bdu_fstec", "security", "rss", "https://bdu.fstec.ru/rss/vulxml", "rss", ("ru", "cve")), d("codeby_forum", "forum", "html", "https://codeby.net/forums/", "xenforo_latest", ("ru", "forum")), # ---------------- 6. telegram (t.me/s) ---------------- d("tg_thehackernews", "security", "html", "https://t.me/s/thehackernews", "tg_web", ("tg", "news")), d("tg_bleepingcomputer", "security", "html", "https://t.me/s/bleepingcomputer", "tg_web", ("tg", "news")), d("tg_vxunderground", "security", "html", "https://t.me/s/vxunderground", "tg_web", ("tg", "malware")), d("tg_true_secator", "security", "html", "https://t.me/s/true_secator", "tg_web", ("tg", "ru")), d("tg_infosec_ru", "security", "html", "https://t.me/s/infosec_ru", "tg_web", ("tg", "ru")), d("tg_hackernews_ru", "security", "html", "https://t.me/s/hackernews_ru", "tg_web", ("tg", "ru")), d("tg_bugbounty", "security", "html", "https://t.me/s/bugbounty", "tg_web", ("tg", "bugbounty")), d("tg_kalilinux", "security", "html", "https://t.me/s/kalilinux", "tg_web", ("tg", "tools")), d("tg_vulns", "abuse", "html", "https://t.me/s/vulns", "tg_web", ("tg", "leak", "ru")), d("tg_ai_newz", "community", "html", "https://t.me/s/ai_newz", "tg_web", ("tg", "ai", "ru")), d("tg_ai_machinelearning", "community", "html", "https://t.me/s/ai_machinelearning_big_data", "tg_web", ("tg", "ai", "ru")), d("tg_denissexy", "community", "html", "https://t.me/s/denissexy", "tg_web", ("tg", "ai", "ru")), # ---------------- reddit (forum) ---------------- d("reddit_blueteamsec", "forum", "json", "https://www.reddit.com/r/blueteamsec/.json?limit=25", "reddit_listing", ("reddit", "blue-team")), d("reddit_exploitdev", "forum", "json", "https://www.reddit.com/r/ExploitDev/.json?limit=25", "reddit_listing", ("reddit", "exploit")), d("reddit_purpleteamsec", "forum", "json", "https://www.reddit.com/r/purpleteamsec/.json?limit=25", "reddit_listing", ("reddit", "purple-team")), ]