OSINT CyberBot
LIVEA zero-server threat-intel pipeline that turns 13 raw feeds into one ranked 0–100 risk score.
OSINT CyberBot is a serverless threat-intelligence pipeline that runs entirely on GitHub Actions. It ingests authoritative security feeds, extracts structured data from messy reports with an LLM, enriches each CVE with authoritative severity signals, and exposes the result through a hardened read-only API.
The problem
Threat intelligence arrives as unstructured prose across dozens of feeds. Deciding what actually matters means cross-referencing severity, known-exploited status, and exploitation probability by hand — slow, and easy to get wrong under volume.
The approach
The pipeline ingests 13 authoritative RSS feeds and parses each report with LLaMA 3.1, forcing the output through Pydantic-validated JSON so a hallucinated field is rejected rather than trusted. Each CVE is then enriched with NVD CVSS, CISA KEV, and FIRST EPSS and collapsed into a single weighted 0–100 risk-priority score.
Three-layer deduplication keeps the same advisory from being counted repeatedly across feeds, and the whole thing runs on GitHub Actions with no server to maintain. Access is a read-only FastAPI service behind rate limiting and injection guardrails.