# Runtime Rebel > Automated cybersecurity threat intelligence: AI-generated analysis of security news and > vulnerabilities from 16 vetted sources (15 RSS feeds plus the CISA KEV catalog), > refreshed every 8 hours. Machine consumption is welcome — a free JSON API, RSS > feeds, and raw-Markdown mirrors of every article are listed below. Coverage is drafted by a language model from the primary sources each article cites and is not human-reviewed before publication; severity ratings are calibrated deterministically against exploitation evidence. Read the editorial policy before treating either as ground truth. The corpus currently holds 3551 published articles. ## Machine-readable data - [Threat-intel API](https://runtimerebel.com/api/threat-intel.json): global threat level, 30-day severity distribution, top CVEs, active threat actors — JSON, CORS-enabled, no key required, CC BY 4.0 - [API documentation](https://runtimerebel.com/api-docs): fields, caching, honesty notes, and every feed listed in one place - [API catalog](https://runtimerebel.com/.well-known/api-catalog): RFC 9727 discovery document listing every API here with its description, docs and freshness stamp - [OpenAPI description](https://runtimerebel.com/api/openapi.json): OpenAPI 3.1 schema for the threat-intel endpoint — response shape, field types, enums - [RSS feed](https://runtimerebel.com/rss.xml): every new article; per-tag feeds exist at /blog/tag//rss.xml - [Critical-severity feed](https://runtimerebel.com/rss/critical.xml): per-severity feeds at /rss/.xml - [New KEV entries feed](https://runtimerebel.com/cve/new.xml): what CISA added to the Known Exploited Vulnerabilities catalog in the last 30 days - [Sitemap index](https://runtimerebel.com/sitemap-index.xml): all URLs, split by content type ## Markdown mirrors Every published article and guide is mirrored as raw Markdown for LLM consumption: append `.md` to its URL (`https://runtimerebel.com/blog/` → `https://runtimerebel.com/blog/.md`). Mirrors carry the title, description, dates, severity, tags, CVE IDs, the primary-source URL, and the full body — everything the HTML page asserts, without the page chrome. The same Markdown is also served by content negotiation: send `Accept: text/markdown` to an article or guide URL and the response is the mirror, byte for byte. A URL with no mirror (listings, dashboards, static pages) returns its HTML as usual, so the header is always safe to send. The explicit `.md` address is the more reliable of the two — a CDN cache in front of this site may not vary on `Accept` — so prefer it when you can. ## Dashboards - [Threat dashboard](https://runtimerebel.com/threats): current threat level, severity trend, category activity - [CVE tracker](https://runtimerebel.com/cve): KEV-derived CVE dashboard; every KEV CVE has a detail page at /cve/cve-- - [KEV changelog](https://runtimerebel.com/cve/new): CISA KEV additions in the last 30 days, joined to our coverage - [Data breaches](https://runtimerebel.com/breaches): breach coverage, paginated - [Vulnerabilities](https://runtimerebel.com/vulnerabilities): vulnerability coverage, paginated - [Threat actors](https://runtimerebel.com/actors): actor profiles derived from tagged coverage - [Australia](https://runtimerebel.com/australia): Australian-relevant threat coverage - [Weekly digest](https://runtimerebel.com/digest): per-week recaps of completed weeks ## Original research - [KEV catalogue analysis](https://runtimerebel.com/research/kev): first-party analysis of all CISA KEV entries — remediation-window distribution, ransomware-labelling trend by year, vendor concentration, open federal deadlines, and this site's own KEV coverage rate. Unlike the article corpus, these are figures computed from the catalogue rather than summarised from another publisher, and are reusable under CC BY 4.0. ## Guides - [Free Threat Intelligence Sources Worth Automating](https://runtimerebel.com/guides/free-threat-intelligence-sources): The free feeds that earn a place in a small team's pipeline — KEV, NVD, EPSS, vendor advisories and curated RSS — and how to combine them without drowning. - [How to Read a CVSS Score (and When Not to Trust It)](https://runtimerebel.com/guides/how-to-read-a-cvss-score): What CVSS base scores actually measure, how the 0–10 ranges map to severity labels, and why a 9.8 that nobody exploits can matter less than a 7.2 in the KEV. - [How We Rate Severity (and Why 'Critical' Is Rare Here)](https://runtimerebel.com/guides/how-we-rate-severity): The exact rules behind RuntimeRebel's five severity levels: what each one requires, why exploitation evidence gates the top ratings, and what the labels can't tell you. - [Ransomware Response: The First 24 Hours](https://runtimerebel.com/guides/ransomware-response-first-24-hours): A defensive checklist for the first day of a ransomware incident: what to isolate, what to preserve, who to call, and the mistakes that make recovery harder. - [The CISA KEV Catalog, Explained](https://runtimerebel.com/guides/cisa-kev-catalog-explained): What the Known Exploited Vulnerabilities catalog is, what its due dates really oblige, and how to use KEV as the sharpest free patching signal available. ## Reference - [Glossary](https://runtimerebel.com/glossary): 285 security terms, each with a permalink at /glossary/ - [Security tools](https://runtimerebel.com/tools): curated security tools database ## Policies - [Editorial & AI transparency](https://runtimerebel.com/editorial): how articles are generated, sourced, and calibrated — read this before citing severity ratings - [About](https://runtimerebel.com/about): what the site is and the sources it aggregates - [Contact](https://runtimerebel.com/contact): how to reach the site - API data is CC BY 4.0 (attribution to runtimerebel.com); article text may be quoted with attribution and a link to the canonical URL