BLUETEAM.NEWS
Menu

Self-hosted threat intelligence

The daily edition for defenders.

BlueTeam.News collects public threat reporting, ranks it by KEV, CVSS, EPSS, source, and freshness, and writes an AI-generated edition that keeps every source it used. It runs on your own server.

See a sample briefing Run locally

Wire and Wall work without an API key. Add your own Anthropic or OpenAI key for AI-generated briefings.

The fictional sample edition, with its masthead, bottom line, executive summary, and first owned action
Fictional sample edition

Bottom line first, then owned actions with target dates.

Open source
MIT-licensed
Self-hosted
Run on your own infrastructure
Product telemetry
None

How each edition is made

From the wire to the front page.

For the analyst or security lead who has to explain what matters and why.

  1. 01

    The wire: find what matters.

    Collection runs on its own. Related reports are grouped and ranked by KEV, CVSS, EPSS, source, and freshness. Filter by urgency, KEV, unread, watch-profile matches, or changed sources, and see why each report scored the way it did.

  2. 02

    The desk: check the source.

    Read retained source passages and compare what changed between observations. Record your assessment, owner, and next review date on your server, with edit history and export.

  3. 03

    The edition: publish with its sources.

    Create an AI-generated briefing with proposed actions and citations. It is checked before it publishes. If the checks find a serious problem, the draft is held and the current edition stays on Latest and the Wall. Fix it and publish without another model call. Scheduled generation is optional and off by default.

Wire with collected public threat reports and source context
Wire

Prioritize reporting and inspect the evidence.

View Wire screenshot

Compare saved source excerpts.

Compare saved observations of an advisory, with added and removed passages highlighted for review.

How matching and briefing inputs work

Watch-profile matches highlight reporting to investigate; they do not confirm exposure in your environment. Wire filters do not select generation inputs. Briefings use the latest collection selection and save the supplied evidence for review. Read the evidence and generation guide.

Source evidence from collected public reporting, with retained passages and observation times
Source comparisons

Highlighted source excerpt. Open the full comparison to inspect both observations.

View source-comparison screenshot

The edition

Every edition keeps its sources.

Scan the headlines in Overview, read the complete assessment in Full report, and carry the same edition into print.

The fictional sample in Briefing Overview, with its featured story, edition summary, and supporting headlines

Overview and Full report

Scan the featured story and supporting headlines in Overview. Open Full report for the complete assessment, response actions, qualifications, and citations.

View full-report screenshot
The fictional sample assessment in the locally rendered Print Edition

Print Edition

Print preview detail. Take the same saved assessment to paper or PDF, rendered locally without another AI request.

View Print Edition screenshot

Sources on the record. Corrections in the open. Each new edition saves the evidence, settings, and provider attempts used to write it, and its Edition record keeps corrections and publication decisions. Briefings are AI-generated: checks cover specific citation, CVE, CVSS, version, and KEV claim forms, not every claim or your organization's exposure. Check claims against their cited reporting before acting.

Read a sample briefing or download the Print Edition PDF. The sample uses a fictional scenario to show the assessment and its source trail.

About these screenshots

The hero, Overview, Full report, and Print Edition show the fictional sample, captured October 22, 2026. Wire and source evidence show collected public reporting captured September 6, 2026. The Wall shows the saved September 6 edition 2, captured that day. Some previews focus on a detail; open a screenshot to see the complete capture. These captures illustrate the interface, not a current security assessment.

Wall

Keep the room informed.

One person runs the desk; the whole room reads the Wall. It rotates through current signals, KEV changes, and the latest published edition, in your light or dark theme.

It also goes where you already work: alert and Briefing webhooks, RSS and JSON feeds, and CSV or JSON exports.

The Wall presenting the September 6 live Briefing, with a lead assessment and supporting priorities
Wall

Keep current reporting and saved briefings in view.

View Wall screenshot

Quick start

Run BlueTeam.News locally.

Requirements: Node.js + npm. Node.js 24 is recommended. Anthropic or OpenAI API key for Briefing generation.

git clone --branch v1.4.4 --single-branch https://github.com/ryanshrier/blueteam.git blueteam
cd blueteam
npm install
npm start

Copy all four commands, or scroll horizontally to read each line.

Open http://127.0.0.1:3000. Collection starts automatically, and Wire fills as sources respond. Explore reports and source comparisons without an API key.

Add AI-generated briefings

In Settings, choose Anthropic or OpenAI, enter your API key, and select a model available to your account. Save your settings and use Verify to check access. Verification and generation use billable provider requests. Then open Briefing → Generate briefing. Automatic generation stays off until you enable it. Advanced users can also try the experimental Custom provider through a trusted local module, or the experimental CLI provider through a separately installed executable and a reviewed JSON profile. Both use environment-supplied credentials. Read the configuration guide.

Data and security

Run it yourself. See what leaves your host.

BlueTeam.News sends no product telemetry or analytics and requires no BlueTeam.News account. Review what stays on your host and which configured services receive requests.

Storage and access details

The server listens on 127.0.0.1 by default. Stored data and saved API keys are not encrypted by the application; protect the host and backups. Remote access requires authentication and TLS. There is no license check or runtime CDN. Read the deployment guidance.

Stored on your host
collected data · briefings · settings
Configured sources
news feeds · source articles · vulnerability data
Configured AI provider
Built-in key verification or optional Custom health checks; selected source evidence and configured organization context for generation
Configured webhook
selected alert or Briefing fields, if enabled

Your provider may charge for verification and generation. Experimental Custom modules define their own health checks, destinations, and billing.

Your daily edition

Publish your first edition.

Run BlueTeam.News locally. The Wire fills on its own; add your Anthropic or OpenAI key when you're ready for Briefings.

Run locally View the source