Expand intel coverage and refresh monitoring

08-threat-intel/source-map.yaml

@@ -144,7 +144,7 @@ systems:
   - system_id: ghost
     display_name: Ghost
     category: cms
-    tier: rolling-24m
+    tier: history-full
     advisory_modes: [core]
     official_sources:
       - name: Ghost GitHub Advisories
@@ -250,7 +250,17 @@ systems:
         max_items: 50
         status: retired
         retired_reason: MediaWiki security page is no longer reachable reliably from the collector path; NVD replacement remains active.
-        replacement_sources: [NVD MediaWiki]
+        replacement_sources: [MediaWiki Announce RSS, NVD MediaWiki]
+      - name: MediaWiki Announce RSS
+        kind: rss-feed
+        url: https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/feed/
+        confidence: official
+        advisory_mode: core
+        keywords: [mediawiki, security, cve, release]
+        max_items: 80
+        request_policy:
+          user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
+          accept: application/rss+xml,application/xml;q=0.9,text/xml;q=0.8,*/*;q=0.7
       - name: NVD MediaWiki
         kind: nvd-search
         keyword: MediaWiki
@@ -279,11 +289,17 @@ systems:
         url: https://moodle.org/security/
         confidence: official
         advisory_mode: core
-        keywords: [moodle, security]
-        max_items: 50
+        keywords: [moodle, security, msa-, cve-]
+        max_items: 80
         status: retired
-        retired_reason: Moodle security page returned repeated 403 responses from the collector path; NVD replacement remains active.
+        retired_reason: Security page is reachable with a browser-style UA, but the current markup only exposes generic "Discuss this topic" anchors to the collector; NVD Moodle remains the active replacement source until a richer parser is added.
         replacement_sources: [NVD Moodle]
+        request_policy:
+          user_agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36
+          accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
+        parser_hints:
+          include_url_patterns:
+            - 'mod/forum/discuss\.php\?d='
       - name: NVD Moodle
         kind: nvd-search
         keyword: Moodle
@@ -324,6 +340,13 @@ systems:
         advisory_mode: core
         keywords: [discourse, security, cve]
         max_items: 60
+      - name: Discourse Security RSS
+        kind: rss-feed
+        url: https://meta.discourse.org/tag/security.rss
+        confidence: official
+        advisory_mode: core
+        keywords: [security, cve, advisory, vulnerability]
+        max_items: 60
       - name: GitHub Discourse Advisories
         kind: ghsa-global
         ecosystem: rubygems
@@ -331,11 +354,15 @@ systems:
         advisory_mode: core
         status: retired
         retired_reason: Unauthenticated GHSA API requests are rate-limited in daily monitoring; Discourse release feed remains the active official source.
-        replacement_sources: [Discourse Release Notes RSS]
-    ecosystem_sources: []
+        replacement_sources: [Discourse Release Notes RSS, Discourse Security RSS]
+    ecosystem_sources:
+      - name: OSV Discourse
+        kind: osv-batch
+        confidence: ecosystem-authority
+        advisory_mode: core
     research_sources: []
     package_names:
-      - ecosystem: rubygems
+      - ecosystem: RubyGems
         name: discourse
     cpe_keys: []
     ghsa_keywords: [discourse]
@@ -1035,7 +1062,13 @@ systems:
         kind: osv-batch
         confidence: official
         advisory_mode: core
-    ecosystem_sources: []
+    ecosystem_sources:
+      - name: NVD Express.js
+        kind: nvd-search
+        keyword: Express.js
+        confidence: ecosystem-authority
+        advisory_mode: core
+        results_per_page: 40
     research_sources: []
     package_names:
       - ecosystem: npm
@@ -1067,7 +1100,13 @@ systems:
         kind: osv-batch
         confidence: official
         advisory_mode: core
-    ecosystem_sources: []
+    ecosystem_sources:
+      - name: NVD NestJS
+        kind: nvd-search
+        keyword: NestJS
+        confidence: ecosystem-authority
+        advisory_mode: core
+        results_per_page: 40
     research_sources: []
     package_names:
       - ecosystem: npm
@@ -1147,7 +1186,7 @@ systems:
   - system_id: hapi
     display_name: Hapi
     category: frameworks
-    tier: rolling-24m
+    tier: history-full
     advisory_modes: [core]
     official_sources:
       - name: GHSA Hapi
@@ -1225,7 +1264,13 @@ systems:
         kind: osv-batch
         confidence: official
         advisory_mode: core
-    ecosystem_sources: []
+    ecosystem_sources:
+      - name: NVD Undici
+        kind: nvd-search
+        keyword: undici
+        confidence: ecosystem-authority
+        advisory_mode: core
+        results_per_page: 40
     research_sources: []
     package_names:
       - ecosystem: npm
@@ -1257,7 +1302,13 @@ systems:
         kind: osv-batch
         confidence: official
         advisory_mode: core
-    ecosystem_sources: []
+    ecosystem_sources:
+      - name: NVD webpack
+        kind: nvd-search
+        keyword: webpack
+        confidence: ecosystem-authority
+        advisory_mode: core
+        results_per_page: 40
     research_sources: []
     package_names:
       - ecosystem: npm
@@ -1289,7 +1340,13 @@ systems:
         kind: osv-batch
         confidence: official
         advisory_mode: core
-    ecosystem_sources: []
+    ecosystem_sources:
+      - name: NVD esbuild
+        kind: nvd-search
+        keyword: esbuild
+        confidence: ecosystem-authority
+        advisory_mode: core
+        results_per_page: 40
     research_sources: []
     package_names:
       - ecosystem: npm
@@ -1623,7 +1680,13 @@ systems:
         kind: osv-batch
         confidence: official
         advisory_mode: core
-    ecosystem_sources: []
+    ecosystem_sources:
+      - name: NVD Ruby on Rails
+        kind: nvd-search
+        keyword: Ruby on Rails
+        confidence: ecosystem-authority
+        advisory_mode: core
+        results_per_page: 40
     research_sources: []
     package_names:
       - ecosystem: RubyGems
@@ -2148,6 +2211,14 @@ systems:
         confidence: official
         advisory_mode: core
         results_per_page: 40
+      - name: Mattermost Security Updates JSON
+        kind: json-feed
+        url: https://securityupdates.mattermost.com/security_updates.json
+        confidence: official
+        advisory_mode: core
+        max_items: 600
+        request_policy:
+          accept: application/json
     ecosystem_sources: []
     research_sources: []
     package_names: []