OSINT_SOURCES.md

OSINT Sources Configuration

ERIS now supports multiple free intelligence sources that don't require a Gemini API key!

Available Sources

Free Sources (No API Key Required)

1. CISA Advisories (RSS)

   • Official cybersecurity advisories from CISA
   • Updates: Real-time
   • Confidence: Verified

2. NVD CVE Database (API)

   • National Vulnerability Database
   • Free, no API key needed
   • Updates: Real-time
   • Confidence: Verified

3. GitHub Security Advisories (API)

   • Public security advisories from GitHub
   • Free, no API key needed
   • Updates: Real-time
   • Confidence: High

4. The Hacker News (RSS)

   • Popular cybersecurity news site
   • Updates: Multiple times daily
   • Confidence: High

5. BleepingComputer (RSS)

   • Cybersecurity news and analysis
   • Updates: Multiple times daily
   • Confidence: High

6. Krebs on Security (RSS)

   • In-depth security journalism
   • Updates: Daily
   • Confidence: High

Optional Sources (Require Free API Key)

7. AlienVault OTX (API)
   • Open Threat Exchange
   • Free tier available
   • Set OTX_API_KEY in .env.local
   • Get API key: https://otx.alienvault.com/api

How to Use

1. Go to Settings → OSINT Sources tab
2. Enable/Disable sources as needed
3. Save Configuration
4. The Dashboard and Intel Feed will automatically use enabled sources

How It Works

• Without Gemini API Key: ERIS uses only OSINT sources
• With Gemini API Key: ERIS tries Gemini first, falls back to OSINT if Gemini fails
• Mixed Mode: You can use both Gemini and OSINT sources together

Adding Custom Sources

To add your own RSS feeds or APIs, edit services/osintService.ts and add to DEFAULT_SOURCES array.

Notes

• RSS feeds use a public CORS proxy (allorigins.win) for browser compatibility
• For production, set up your own backend proxy for RSS feeds
• API sources (NVD, GitHub) work directly without proxies
• All sources are filtered to show only last 24 hours of intelligence