Listen to this Post
Introduction:
The cybersecurity landscape moves at an unprecedented pace, with new vulnerabilities, breaches, and ransomware campaigns emerging daily. Security professionals often find themselves manually scanning multiple threat intelligence platforms, RSS feeds, and security blogs just to stay informed—a time-consuming process that can delay critical incident response. THR3AT N3W5 addresses this challenge by leveraging artificial intelligence to aggregate, filter, and prioritize cybersecurity news from over 10 sources every 15 minutes. What sets this tool apart is its integration with CISA’s Known Exploited Vulnerabilities (KEV) catalog, automatically flagging any mentioned CVE that is actively being exploited in the wild. This article explores the technical architecture, implementation details, and security implications of building such a system.
Learning Objectives:
- Understand how to build a real-time news aggregator using Node.js, Express, and SQLite
- Learn to integrate AI-powered content classification and filtering using Groq’s inference API
- Implement CISA KEV catalog cross-referencing for automated critical vulnerability detection
- Deploy a full-stack application using Render (backend) and Netlify (frontend) free tiers
- Configure push notification systems using OneSignal for critical security alerts
You Should Know:
1. Technical Architecture Overview
THR3AT N3W5 employs a modern full-stack JavaScript architecture designed for real-time data processing and minimal latency. The backend runs on Node.js with Express.js as the web framework, handling API requests, scheduling feed fetching, and orchestrating AI processing pipelines. SQLite serves as the lightweight relational database, storing article metadata, tags, severity scores, and CVE references. The choice of SQLite is strategic—it requires no external database server, simplifies deployment, and performs adequately for the expected data volume.
The AI layer is powered by Groq’s cloud inference platform, which utilizes custom Language Processing Units (LPUs) to deliver inference speeds 10-20x faster than traditional GPU-based solutions. Groq runs exclusively open-source models including Meta’s Llama and Alibaba’s Qwen, making it both cost-effective and transparent. The system sends each article to Groq’s API for categorization, severity assessment, threat actor identification, and extraction of Indicators of Compromise (IOCs) such as CVEs, file hashes, and malicious domains.
Push notifications are handled by OneSignal’s server SDK, which enables real-time alerts to subscribers when critical threats are detected. The frontend is deployed on Netlify’s static hosting, while the backend runs on Render’s free tier—though this introduces cold start delays of 30-60 seconds after periods of inactivity.
2. Setting Up the Development Environment
To build a similar system, start by initializing a Node.js project and installing core dependencies:
Initialize project mkdir threat-1ews-aggregator cd threat-1ews-aggregator npm init -y Install backend dependencies npm install express sqlite3 node-fetch groq-sdk onesignal-1ode npm install -D nodemon
Create the SQLite database schema for storing articles and their metadata:
-- schema.sql
CREATE TABLE articles (
id INTEGER PRIMARY KEY AUTOINCREMENT,
title TEXT NOT NULL,
url TEXT UNIQUE NOT NULL,
source TEXT NOT NULL,
published_at DATETIME DEFAULT CURRENT_TIMESTAMP,
content TEXT,
summary TEXT,
severity TEXT CHECK(severity IN ('Critical','High','Medium','Low')),
category TEXT,
threat_actors TEXT,
cves TEXT,
hashes TEXT,
domains TEXT,
processed BOOLEAN DEFAULT 0
);
CREATE TABLE feeds (
id INTEGER PRIMARY KEY AUTOINCREMENT,
name TEXT NOT NULL,
url TEXT UNIQUE NOT NULL,
enabled BOOLEAN DEFAULT 1,
last_fetched DATETIME
);
3. Implementing the Feed Aggregation Engine
The aggregation engine fetches RSS/Atom feeds from multiple cybersecurity sources every 15 minutes using a scheduled job. Here’s a simplified implementation:
// aggregator.js
const fetch = require('node-fetch');
const Parser = require('rss-parser');
const parser = new Parser();
const FEED_SOURCES = [
'https://feeds.feedburner.com/TheHackerNews',
'https://www.bleepingcomputer.com/feed/',
'https://krebsonsecurity.com/feed/',
// Add 7+ additional sources
];
async function fetchAllFeeds() {
const articles = [];
for (const feedUrl of FEED_SOURCES) {
try {
const feed = await parser.parseURL(feedUrl);
for (const item of feed.items.slice(0, 10)) {
articles.push({
title: item.title,
url: item.link,
source: new URL(feedUrl).hostname,
published_at: item.pubDate || new Date().toISOString(),
content: item.content || item.description || ''
});
}
} catch (error) {
console.error(<code>Failed to fetch ${feedUrl}:</code>, error.message);
}
}
return articles;
}
// Schedule every 15 minutes using node-cron
const cron = require('node-cron');
cron.schedule('/15 ', async () => {
const articles = await fetchAllFeeds();
// Store in SQLite and trigger AI processing
});
4. AI-Powered Content Classification with Groq
Each article is sent to Groq’s API for intelligent processing. The system prompts the model to extract structured data:
// ai-processor.js
const Groq = require('groq-sdk');
const groq = new Groq({ apiKey: process.env.GROQ_API_KEY });
async function classifyArticle(article) {
const prompt = `
Analyze this cybersecurity article and extract:
1. Category (Breach/Ransomware/Cyberwarfare/Vulnerability/Other)
2. Severity (Critical/High/Medium/Low)
3. Threat actors mentioned
4. CVEs (format: CVE-YYYY-XXXX)
5. File hashes (MD5, SHA1, SHA256)
6. Malicious domains/IPs
${article.title}\n${article.content.substring(0, 2000)}
Return JSON only.
`;
const response = await groq.chat.completions.create({
messages: [{ role: 'user', content: prompt }],
model: 'llama3-70b-8192',
temperature: 0.1,
response_format: { type: 'json_object' }
});
return JSON.parse(response.choices[bash].message.content);
}
The Groq API endpoint uses OpenAI-compatible syntax at `https://api.groq.com/openai/v1`. The free tier provides 14,400 requests per day with a rate limit of 7,000 requests per minute—sufficient for processing hundreds of articles daily.
5. CISA KEV Catalog Integration for Critical Alerting
The most innovative feature is the automatic cross-referencing of extracted CVEs against CISA’s Known Exploited Vulnerabilities catalog. CISA maintains this as a “living list” of CVEs with confirmed active exploitation. The catalog is updated regularly, with 172 vulnerabilities added in 2026 alone.
Implementation approach:
// cisa-kev-checker.js
const fetch = require('node-fetch');
async function checkCISAKEV(cves) {
// Fetch the official KEV catalog (JSON format)
const response = await fetch(
'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json'
);
const data = await response.json();
const kevMap = {};
data.vulnerabilities.forEach(vuln => {
kevMap[vuln.cveID] = {
dateAdded: vuln.dateAdded,
dueDate: vuln.dueDate,
knownRansomwareCampaignUse: vuln.knownRansomwareCampaignUse,
product: vuln.product,
shortDescription: vuln.shortDescription
};
});
const criticalCVEs = cves.filter(cve => kevMap[bash]);
return criticalCVEs.map(cve => ({
cve,
details: kevMap[bash]
}));
}
// Usage in the processing pipeline
async function processArticle(article) {
const classification = await classifyArticle(article);
const criticalCVEs = await checkCISAKEV(classification.cves);
if (criticalCVEs.length > 0) {
// Flag as Critical automatically - government-confirmed
article.severity = 'Critical';
article.cves = classification.cves;
// Trigger push notification via OneSignal
await sendCriticalAlert(article, criticalCVEs);
}
}
When a CVE appears in the KEV catalog, the system flags it as Critical automatically—not based on AI estimation but on official government confirmation. This provides an authoritative severity assessment that security teams can trust for prioritization.
6. Push Notification System with OneSignal
For critical alerts, the system sends push notifications using OneSignal’s Node.js SDK:
// notifier.js
const OneSignal = require('onesignal-1ode');
const client = new OneSignal.Client(
process.env.ONESIGNAL_APP_ID,
process.env.ONESIGNAL_API_KEY
);
async function sendCriticalAlert(article, criticalCVEs) {
const cveList = criticalCVEs.map(c => c.cve).join(', ');
const notification = new OneSignal.Notification({
contents: {
en: `🚨 CRITICAL: ${article.title.substring(0, 80)}`
},
headings: {
en: `CISA KEV: ${cveList}`
},
included_segments: ['Subscribed Users'],
data: {
url: article.url,
cves: criticalCVEs
},
chrome_web_icon: 'https://threatnews.netlify.app/icon.png'
});
try {
const response = await client.createNotification(notification);
console.log('Notification sent:', response.body);
} catch (error) {
console.error('Notification failed:', error);
}
}
The OneSignal API requires an App ID and REST API Key, available from the OneSignal dashboard under Settings > Keys & IDs. The SDK supports targeting specific user segments, devices, or external IDs.
7. Deployment Strategy: Render + Netlify Free Tier
The application is deployed using a cost-effective split architecture: frontend on Netlify and backend on Render.
Backend Deployment (Render):
- Push the Node.js/Express backend to a GitHub repository
- Create a new Web Service on Render, connecting the repository
3. Set environment variables: `GROQ_API_KEY`, `ONESIGNAL_APP_ID`, `ONESIGNAL_API_KEY`
4. Configure the start command: `npm start`
- Render’s free tier provides 750 hours per month with auto-sleep after 15 minutes of inactivity
Frontend Deployment (Netlify):
1. Build the static frontend (HTML, CSS, JavaScript)
2. Connect the repository to Netlify
3. Configure build settings (if using a framework)
- Deploy with continuous deployment from the main branch
- Netlify’s free tier includes 100GB bandwidth per month
The cold start delay (30-60 seconds on first load) is a trade-off for the free hosting tier. For production use, upgrading to paid tiers eliminates this latency.
What Undercode Say:
- Key Takeaway 1: The integration of CISA’s KEV catalog transforms a simple news aggregator into a credible threat intelligence tool. By relying on government-confirmed active exploitation data rather than AI severity scoring, security teams receive authoritative prioritization guidance that can directly inform patch management and incident response workflows.
-
Key Takeaway 2: The “AI Ask” feature represents the next evolution of threat intelligence consumption. Rather than forcing analysts to manually search through aggregated data, the system provides conversational access to curated intelligence—enabling rapid queries like “what’s going on with zero-days lately” with cited sources. This lowers the barrier to threat intelligence utilization across teams of varying expertise levels.
The “vibe coding” approach—building the entire system solo using modern JavaScript technologies—demonstrates how accessible cybersecurity tool development has become. The combination of Node.js/Express for backend, SQLite for data persistence, Groq for AI inference, OneSignal for notifications, and Render/Netlify for deployment creates a complete, production-ready threat intelligence platform with minimal operational overhead. The free-tier constraints (cold starts, rate limits) are reasonable trade-offs for proof-of-concept and personal use, while the architecture scales cleanly to paid tiers for enterprise deployment.
Prediction:
- +1 Automated threat intelligence aggregation tools like THR3AT N3W5 will become standard components of security operations centers (SOCs) within 24-36 months, reducing manual threat research time by 70-80% and enabling faster response to emerging vulnerabilities.
-
+1 The integration of government vulnerability databases (CISA KEV, NVD) with AI-powered news aggregation will create a new category of “verified threat intelligence” that combines human curation with machine-scale processing, improving the signal-to-1oise ratio in cybersecurity awareness.
-
-1 Reliance on AI for content filtering introduces risks of false negatives—critical threats might be misclassified or overlooked if the AI model fails to recognize novel attack patterns or threat actor TTPs not represented in training data.
-
-1 The centralization of threat intelligence aggregation creates a single point of failure: if the aggregator service is compromised or experiences downtime, security teams lose access to their primary intelligence feed, potentially delaying response to active threats.
-
+1 The “AI Ask” conversational interface will evolve into a standard feature for threat intelligence platforms, enabling junior analysts to query complex threat landscapes without deep expertise in query languages or database structures, democratizing access to cybersecurity intelligence.
-
-1 As more organizations adopt similar aggregation tools, threat actors may begin manipulating public RSS feeds and security blogs with disinformation or false CVE reports, creating an adversarial AI challenge where defenders must validate intelligence sources against authoritative government databases—exactly the problem CISA KEV integration solves.
▶️ Related Video (82% Match):
https://www.youtube.com/watch?v=70pVEubxlE4
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/e6H_HCCf – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
