BlueTeam.News is a self-hosted threat-intelligence desk. It collects public reporting, groups related stories, and scores signals with KEV, CVSS, EPSS, source, and freshness evidence.
- Wall: an automatic display for an operations TV.
- Wire: a filterable analyst feed with retained source passages, revision comparisons, local decision records, and exports.
- Briefing: an AI-generated assessment using your Anthropic or OpenAI API key, with saved inputs and a Print Edition for paper or PDF. OpenAI supports Codex models through the Responses API.
Wall and Wire work without API keys. Briefing generation and key verification use billable provider requests.
Install Node 22.19+ in the Node 22 line, Node 24, or Node 26 and use its bundled npm.
git clone https://github.com/ryanshrier/blueteam.git blueteam
cd blueteam
npm install
npm startOpen http://127.0.0.1:3000. Collection starts automatically; Wire fills as sources respond. Settings → System health shows readiness and source failures.
Install dependencies on the machine and Node major that will run the service. SQLite has a native dependency, so reinstall after changing Node majors; do not copy node_modules between installations. See troubleshooting for native-binding errors. In Windows PowerShell, use npm.cmd if execution policy blocks the npm.ps1 shim.
In Settings, choose Anthropic or OpenAI (Codex), enter that provider's API key, and save. Both keys can be stored so you can switch providers. For OpenAI, select a model available to your API account; the default is gpt-5.3-codex. Verify makes a small billable request to test the key; OpenAI verification also checks the selected model.
You can also copy .env.example to .env and set one provider:
# OpenAI Codex
AI_PROVIDER=openai
OPENAI_API_KEY=
OPENAI_MODEL=gpt-5.3-codex# Anthropic
AI_PROVIDER=anthropic
ANTHROPIC_API_KEY=Enter your key after =. Environment keys override saved keys for the same provider. OpenAI generation calls the Responses API directly; it requires an OpenAI API key and does not use a Codex CLI or ChatGPT subscription login. See Configuration for provider selection, model settings, and precedence.
Open Briefing → Edition tools → Generate briefing. Generation waits for enough fresh source evidence. Wire searches, filters, and hidden items do not change its input selection.
Automatic generation is off by default. Enable it separately in Settings and choose a time, timezone, and retry policy. Manual and scheduled runs use the selected provider and the same validation and storage pipeline. Retries can add cost; application limits are not a provider spending cap.
Wall (/wall) rotates through signals, KEV changes, and the latest eligible saved Briefing. Press G, then L to enter and Esc to leave. Settings controls size, margins, playback, fullscreen, and supported screen-awake behavior. Feed freshness and Briefing publication time are shown separately.
Wire (/wire) exposes score components and filters for tier, urgency, KEV, and unread state. Inspect evidence shows retained passages and changes between observations. A watch profile explains literal matches to your technologies, sectors, and regions; local exposure remains unknown. Decision records and hidden/read preferences stay in the current browser. CSV and JSON exports include saved decision records.
Briefing (/briefing) opens saved editions in Overview or Full report. Edition tools provides history, source inputs, drafts, copying, printing, and generation. New editions retain the evidence, configuration, provider/model attempts, and validation used to generate them. Historical editions may lack these receipts. Draft repair and reviewed copies preserve the original edition.
Review generated claims against their cited reporting. Publication checks cover structure, citation identities and dates, incomplete provider output, and specified CVE, CVSS, version, and KEV claim forms. They do not verify every narrative claim or confirm your organization's exposure.
The Print Edition renders the same saved assessment locally without another model request.
| Briefing | Print Edition |
|---|---|
 |
 |
Read the fictional sample, Markdown, input receipt, or PDF. Screenshots show collected reporting and the reviewed September 6, 2026 edition 2 at capture time; they are not a current assessment.
See Evidence and relevance for retention rules, review states, and limitations. Shared situation tracking and handoff acknowledgment remain proposed work.
The server binds to 127.0.0.1 by default. Remote interactive access requires a strong API_SECRET and an authenticating TLS reverse proxy that injects the bearer token upstream. See Operations and deployment.
Local state lives in data/watchfloor.db, saved assessments in briefs/, and operator settings in the gitignored data/settings.local.json. Saved API keys are masked in responses but stored in plaintext. Protect the host account and backups.
There is no product telemetry. Outbound requests go to configured feeds and enrichment sources, the selected AI provider during verification or generation, and an optional configured webhook. Generation sends selected source evidence and configured organization context. The network boundary lists the supplied data.
| Guide | Contents |
|---|---|
| Operations and deployment | Runtime support, scheduling, cost, backups, upgrades, troubleshooting, and remote access |
| Configuration | Settings, provider keys/models, environment variables, feeds, and webhooks |
| Evidence and relevance | Source retention, watch profiles, decision records, and assessment review |
| Architecture | Collection, scoring, generation, storage, and module boundaries |
| API overview | REST, SSE, feeds, authentication, and embedding |
| Development | Tests, browser checks, release checks, and repository layout |
| Security policy | Deployment model and private vulnerability reporting |
The project website is blueteam.news. Published versions and upgrade notes are on GitHub Releases; pending changes are in the changelog.
npm test
npm run check:release
npm run check:secrets
npm run check:cti-scope
npm run check:assetsThe development guide lists focused browser, evidence, export, and generation checks. Tests use synthetic inputs; routine verification does not require paid generation.
BlueTeam.News is maintainer-led and provided without a support or update commitment. See SUPPORT.md and CONTRIBUTING.md. Report vulnerabilities privately through SECURITY.md.
Code is available under the MIT License. Bundled fonts use the SIL Open Font License; see THIRD_PARTY_NOTICES.md.