BLUETEAM.NEWS
Menu

// open source · self-hosted · MIT

v1.0.3

Turn threat reporting into a daily defensive picture.

Built for cyber defense teams, BlueTeam.News collects, enriches, and prioritizes the reporting you choose for the Wall and Wire. Add your Anthropic API key for an AI-generated Briefing, then open any saved Briefing as a locally rendered Print Edition.

Built for the floor. Grounded in evidence.

Run locally View sample Print Edition
A synthetic assessment in the paper-first BlueTeam.News Print Edition
Wall + Wire
No API key
Briefing generation
Anthropic API key
App telemetry
None

// from source to shift

Watch. Investigate. Brief.

The same evidence moves from monitoring to analysis to briefing.

  1. WATCH · THE WALL

    Keep the operations floor current.

    A glanceable display rotates through KEV changes, prioritized signals, and the latest saved Briefing.

    /wall
  2. INVESTIGATE · THE WIRE

    Work the evidence behind the score.

    Filter by tier, urgency, KEV status, or unread state, then inspect score evidence and exports.

    /wire
  3. BRIEF · THE BRIEFING

    Turn the evidence into a shift-ready assessment.

    Use your Anthropic API key to generate a sourced, reviewable Briefing, then open the same saved assessment as a Print Edition.

    /briefing
The Wall showing a synthetic CISA KEV-style catalog update across a broadsheet display
The Wall · view full size
The Wire showing public-source demonstration reporting, filters, and score evidence
The Wire · view full size

BRIEF ONCE · READ IT TWO WAYS

One Briefing. Two formats.

Generate one sourced assessment, then read it in the application or open its Print Edition for paper and PDF.

The in-application Briefing reader showing a synthetic sourced assessment

Briefing

Review the assessment, citations, judgments, and actions in the application.

The same synthetic saved assessment in the paper-first Print Edition

Print Edition

Read the same saved assessment, rendered locally for paper or PDF.

The Wall, Briefing, and Print Edition use synthetic fixtures. The Wire shows public-source demonstration reporting. No private or customer operational data is shown.

// quick start

One repository. Four commands.

git clone https://github.com/ryanshrier/blueteam.git blueteam
cd blueteam
npm install
npm start

Requires Node 22.19+ within the Node 22 line, or Node 24 or 26.

Open http://127.0.0.1:3000. As sources respond, the Wire begins filling and the Wall is ready.

Wall and Wire
Collection, enrichment, scoring, and both monitoring views run without an API key.
Briefing generation
Requires your Anthropic API key, configured in Settings or as ANTHROPIC_API_KEY. Verification and generation contact Anthropic and may consume billable tokens. Automatic generation is a separate opt-in and is off by default.

// priority with provenance

Why this signal, why now.

BlueTeam.News groups reporting, records publisher breadth, enriches vulnerabilities with KEV, CVSS, and EPSS, then scores recency, corroboration, exploitation, severity, and organization relevance.

  1. Fetch
  2. Group
  3. Enrich
  4. Score
  5. Retain evidence
Illustrative score · synthetic fixture with default weights
88T1 · Tactical
Exploitation
KEV verified
Severity
CVSS 9.8
Publisher breadth
4 distinct sources
Recency
3 hours
Relevance
Alert-rule match

Publisher breadth does not prove independence, and a heuristic match is not a catalog fact. Both distinctions stay visible.

THREE ANALYTIC HORIZONS

T1Tactical
Current shift to 7 days
Response, detection, and remediation.
T2Operational
Coming weeks to 12 months
Developing activity and posture changes.
T3Strategic
Beyond 12 months
Structural changes to threats and risk.

Tier names, analytic horizons, and questions are configurable in config.json. A generated Briefing separately gives each key judgment an operator decision window.

// local trust boundary

Know what stays local—and what leaves the host.

BlueTeam.News sends no product telemetry or analytics, and it requires no BlueTeam.News account, license check, or runtime CDN. The default bind is 127.0.0.1.

SQLite data, Markdown Briefings, and a gitignored Settings file stay local. They are not encrypted by the application; protect the host and backups.

On the host
operational data · Briefings · Settings
Configured sources
feeds · article pages · KEV · NVD · EPSS
Anthropic API
key verification and Briefing generation
Configured webhook
selected alert or Briefing fields, if enabled
Boundary status
configured and inspectable

Key verification sends a minimal Anthropic request and may consume billable tokens. Briefing generation sends selected source evidence and configured organization context. Outbound collection requests identify BlueTeam.News through a configurable User-Agent.

Analyst review remains required. Automated checks block incomplete and trust-critical Briefing output; completed Briefings remain labeled AI-generated.

Runtime
Node 22.19+ · 24 · 26
Default bind
127.0.0.1
Storage
SQLite + Markdown

// ready when the shift starts

Run BlueTeam.News locally.

Clone the repository, start the server, and store the evidence on a host you control.

Quick start View the source