Threat Intelligence

Overview

Threat Intelligence aggregates the latest security advisories from CISA and GitHub into a single Threat Feed so you can stay on top of emerging vulnerabilities without leaving Fencer. Entries are fetched automatically, sorted by publication date, and cached so the page loads quickly even when external sources are slow.

Prerequisites

• A role that can view vulnerabilities (every built-in role can).
• No additional integrations or configuration are required — the Threat Feed works out of the box.

How it works

Fencer pulls advisories from two public sources: the CISA Cybersecurity Advisories RSS feed and the GitHub Security Advisories JSON API (reviewed advisories). Each source is queried for up to 100 entries, which are merged and sorted newest-first. Results are cached for one hour (or five minutes if a fetch fails) so subsequent page loads are instant.

Severity is determined automatically. GitHub advisories include a severity rating directly. For CISA advisories, Fencer extracts a CVSS score or severity keyword from the title and description and maps it to one of four levels: Critical, High, Medium, or Low. If no severity can be determined, the entry is displayed without a severity badge.

Usage / Configuration

Viewing the Threat Feed

1. Navigate to Operations > Threat Intelligence, or go to /a/<your-org>/threats/.
2. The Threat Feed displays a scrollable list of recent advisories. Each row shows the threat title, a short description preview, the source (CISA or GitHub), severity badge, and how long ago it was published.
3. Click any row — or use the Arrow keys / j/k — to select a threat and open its Threat Details panel on the right.

Searching and filtering

1. Click the search icon at the top of the threat list.
2. Type a keyword in Search threats…. The list filters as you type, matching against both the title and description.
3. Press Escape to close the search bar and return to the full list.

Reading advisory details

1. Select a threat to open the detail drawer.
2. The drawer shows the full title, complete description (rendered as Markdown for GitHub advisories), source badge, severity indicator, and publication date.
3. Click Read advisory to open the original advisory on the source website (CISA or GitHub) in a new tab.

Note

The Threat Feed is read-only. It surfaces external advisories for awareness and does not create vulnerabilities or detections in Fencer automatically.

Examples

Triaging a critical advisory:

1. Open Operations > Threat Intelligence and scan the severity badges for Critical entries.
2. Click a critical threat to read its full description.
3. Click Read advisory to review the original source for affected versions and remediation steps.
4. If the advisory affects software in your environment, navigate to Vulnerability Management to check whether Fencer has already detected related vulnerabilities from your scans.

Quickly reviewing new advisories with keyboard navigation:

1. Open the Threat Feed. The first (newest) entry is selected automatically.
2. Press j or Down Arrow to move through entries.
3. Press k or Up Arrow to go back.
4. Read the detail panel on the right without clicking.

Data sources

Source	Type	URL	Update frequency
CISA Cybersecurity Advisories	RSS/XML feed	cisa.gov/cybersecurity-advisories/all.xml	Cached for 1 hour
GitHub Security Advisories	JSON API	api.github.com/advisories	Cached for 1 hour

Severity mapping

For advisories that include a CVSS score, severity is derived as follows:

CVSS score	Severity
9.0 or above	Critical
7.0 – 8.9	High
4.0 – 6.9	Medium
0.1 – 3.9	Low

If no CVSS score is present, Fencer looks for severity keywords (e.g., “Severity: High”) in the advisory text. GitHub advisories use the severity GitHub assigns.

Troubleshooting

• Empty feed — If both external sources are unreachable, the feed shows “No threat entries found.” The cache TTL drops to five minutes so Fencer retries quickly. Try again shortly.
• Missing severity badges — Some CISA advisories do not include a CVSS score or severity keyword. These entries appear without a badge, which is expected.
• Stale data — Entries are cached for one hour. If you expect a very recent advisory to appear, wait for the cache to expire.

Related pages

• Vulnerability Management