Threat Feed topics and boundaries
Use the documented evidentiary consequence to distinguish direct relevance from general security news.
Selection follows the evidence impact
A relevant source must describe what changes about collection, preserved records, tool trust, or interpretation. A broadly important security incident can still fall outside this publication.
Evidence availability
Reported destruction or impairment of material that can be relevant to an examination.
Follow the related evidence question. 2 approved record(s) in this selection.
Log visibility
Reported clearing, suppression, or forwarding interference, with separate local and central coverage.
Follow the related evidence question. 2 approved record(s) in this selection.
Cloud and endpoint traces
Source-supported relationships between credential context, cloud records and local collection.
Follow the related evidence question. 1 approved record(s) in this selection.
Virtualization visibility
Separate guest, host and central record paths rather than assuming a single complete log.
Follow the related evidence question. 1 approved record(s) in this selection.
What stays outside the feed
Generic exploitation, undifferentiated CVEs, broad malware headlines, and stock forensic-compliance notices do not qualify on their own. Provenance and forensic-tool issues require a direct, documented evidentiary relationship. Potential signals without sufficient review stay private.