> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clarion.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Threat Intel

> Bring vulnerability advisories, supply chain threats, and security feeds into Clarion for AI-powered triage and response.

The **Threat Intel** integration brings external security intelligence into Clarion for AI-powered triage. It is a built-in, auto-connected integration — there is no third-party account to link. Pick the monitor that matches how your intelligence is delivered; you can add both.

## Choose a monitor

<CardGroup cols={2}>
  <Card title="Threat Intel webhook" icon="shield-halved" href="/integrations/threat-intel/webhook">
    Receive structured vulnerability advisories and supply chain threat payloads from a scanner or threat-intel service via a signed inbound webhook. Real time.
  </Card>

  <Card title="RSS Feed" icon="rss" href="/integrations/threat-intel/rss-feed">
    Subscribe to a published RSS or Atom feed — vendor security blogs, CERT/CSIRT bulletins, advisory feeds. Clarion crawls it and opens an issue for each new item.
  </Card>
</CardGroup>

## Which one do I need?

|               | [Threat Intel webhook](/integrations/threat-intel/webhook) | [RSS Feed](/integrations/threat-intel/rss-feed)          |
| ------------- | ---------------------------------------------------------- | -------------------------------------------------------- |
| **Direction** | Your sender pushes to Clarion                              | Clarion pulls from a URL                                 |
| **Input**     | Signed JSON (`vulnerability` / `threat`)                   | RSS 0.9/1.0/2.0 or Atom feed                             |
| **Latency**   | Real time                                                  | Crawled every 6 hours (or on demand)                     |
| **Best for**  | Scanners, vuln / supply-chain services                     | Security blogs, CERT bulletins, advisory & release feeds |

<Note>
  Threat Intel is auto-connected, so it already appears on the Integrations page — you only need to add the monitor you want. Both monitor types are managed from the same **Threat Intel** integration.
</Note>

<Tip>
  Clarion ships a built-in **Threat Intelligence** agent that triages advisories and feed items, correlating them to your environment. Assign it to either monitor (or both) to automate the first pass.
</Tip>