> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clarion.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# RSS Feed

> Subscribe Clarion to an RSS or Atom feed — security blogs, CERT/CSIRT bulletins, advisory feeds — and open an issue for each newly-published item.

The **RSS Feed** monitor subscribes Clarion to a published **RSS or Atom feed** — security advisory feeds, vendor security blogs, CERT/CSIRT bulletins, or release/changelog feeds. Clarion crawls the feed and opens an issue for each newly-published item, then triages it with AI agents.

<Note>
  **Estimated time:** 5 minutes. You will need a **Clarion workspace** and a public `https://` feed URL.
</Note>

***

## Step 1 — Create the monitor

1. In Clarion, go to **Settings > Integrations**
2. Find **Threat Intel** and click **Add Monitor**
3. Pick the **RSS Feed** monitor type
4. Enter the **Feed URL** — a public `https://` RSS or Atom feed
5. Pick a **default severity** — RSS items carry no severity of their own, so every alert from this feed uses this value
6. Click **Create**

<Note>
  The feed must be reachable over public `https://`. For safety, Clarion refuses internal, private, or cloud-metadata addresses and re-checks every redirect hop.
</Note>

***

## How crawling works

* Clarion crawls the feed **every 6 hours** automatically. You can also click **Crawl now** on the monitor's Configure page to fetch immediately.
* Supports **RSS 0.9 / 1.0 / 2.0** and **Atom**.
* The **first crawl** seeds the monitor with the feed's current contents and does **not** open issues for the existing backlog. After that, each newly-published item becomes one issue.
* Items are de-duplicated by their feed GUID, so re-seeing the same entry across crawls never creates a second alert.

***

## Alerting on backlog items

To open issues for entries that already existed when you connected the feed:

1. Open the monitor's Configure page and click **Load latest**
2. Tick the items you want
3. Click **Create alerts for selected**

<Info>
  A single crawl opens at most 50 new issues, so a churning feed can't flood your workspace — the newest items are kept. Feed content is treated as untrusted: secret-shaped tokens are redacted before anything is stored or displayed.
</Info>

***

## What happens next

Once configured, Clarion will automatically:

* Crawl your feed every 6 hours (and whenever you click **Crawl now**)
* Open an issue for each newly-published item, at the feed's default severity
* Triage incoming issues with AI agents and surface actionable insights

<Tip>
  Clarion ships a built-in **Threat Intelligence** agent that triages feed items and correlates them to your environment. Assign it to this monitor to automate the first pass.
</Tip>