Skip to main content
The RSS Feed monitor subscribes Clarion to a published RSS or Atom feed — security advisory feeds, vendor security blogs, CERT/CSIRT bulletins, or release/changelog feeds. Clarion crawls the feed and raises an alert for each newly-published item, then triages it with AI agents.
Estimated time: 5 minutes. You will need a Clarion workspace and a public https:// feed URL.

​
Step 1 — Create the monitor

  1. In Clarion, go to Settings > Integrations
  2. Find Threat Intel and click Add Monitor
  3. Pick the RSS Feed monitor type
  4. Enter the Feed URL — a public https:// RSS or Atom feed
  5. Pick a default severity — RSS items carry no severity of their own, so every alert from this feed uses this value
  6. Click Create
The feed must be reachable over public https://. For safety, Clarion refuses internal, private, or cloud-metadata addresses and re-checks every redirect hop.

​
How crawling works

  • Clarion crawls the feed every 6 hours automatically. You can also click Crawl now on the monitor’s Configure page to fetch immediately.
  • Supports RSS 0.9 / 1.0 / 2.0 and Atom.
  • The first crawl seeds the monitor with the feed’s current contents and does not raise alerts for the existing backlog. After that, each newly-published item becomes one alert.
  • Items are de-duplicated by their feed GUID, so re-seeing the same entry across crawls never creates a second alert.

​
Alerting on backlog items

To raise alerts for entries that already existed when you connected the feed:
  1. Open the monitor’s Configure page and click Load latest
  2. Tick the items you want
  3. Click Create alerts for selected
A single crawl raises at most 50 new alerts, so a churning feed can’t flood your workspace — the newest items are kept. Feed content is treated as untrusted: secret-shaped tokens are redacted before anything is stored or displayed.

​
What happens next

Once configured, Clarion will automatically:
  • Crawl your feed every 6 hours (and whenever you click Crawl now)
  • Create an alert for each newly-published item, at the feed’s default severity
  • Triage incoming alerts with AI agents and surface actionable insights
Clarion ships a built-in Threat Intelligence agent that triages feed items and correlates them to your environment. Assign it to this monitor to automate the first pass.