# Cybersecurity News

URL: https://www.deepinfo.com/platform/cti/cybersecurity-news/

## Each Article Links to the CVEs and Actors It Names.

Cybersecurity News is a curated feed of security articles. Each article carries structured links to the CVEs, threat actors and issue types it discusses.

That turns a stream of headlines into something your team can query: all the articles about one CVE, or all the reports on one actor, newest first.

[Request demo](https://www.deepinfo.com/request-demo/) · [CTI API reference](https://docs.deepinfo.com/reference/cti/) · [Platform guide: Cybersecurity news](https://docs.deepinfo.com/guide/cti/cybersecurity-news/)

### A Headline Is Not a Finding.

Security news is plentiful. What it lacks is structure your team can work with.

Volume

#### Too Much to Read

Articles arrive daily from many outlets. Nobody on a working SOC team reads all of them, and nobody should have to.

Structure

#### Text, Not Data

An article names a CVE in its third paragraph. Finding the other articles about that CVE usually means searching free text.

Context

#### Detached From Your Exposure

Knowing a flaw is being exploited matters most once you know whether it is on your assets.

### The Platform Adds Structure to Each Article.

The Deepinfo Platform adds the links. The article itself stays with its publisher, one click away.

- **CVEs**: The CVE IDs the article discusses, in `cve_id`
- **Threat actors**: The actors the article names, in `threat_actor`
- **Issue types**: The issue types the article relates to, in `related_issue_types`
- **Tags**: Topic tags for browsing, such as ransomware or stealer logs, in `tags`
- **Source**: The publisher, the publication date and a link to the original: `source`, `publish_date`, `source_url`

Articles come from third-party publishers. Field names as returned by the [Security News Detail](https://docs.deepinfo.com/reference/cti/security-news-detail/) endpoint.

### Pull the Coverage of a CVE in One Query.

News search takes the filter body the other platform searches use. Filter on `cve_id` to collect the coverage of one vulnerability, or on `threat_actor` to follow a group.

The CVE ID is also the key to the vulnerability record in Deep Search & Insights, with CVSS, EPSS and CISA KEV status, and to any finding for that CVE on the assets External Attack Surface Management scans.

[Security News Search reference](https://docs.deepinfo.com/reference/cti/security-news-search/)

News about a CVE:

```bash
curl -X POST \
  "https://api.deepinfo.com/v1/cti/news/search?page_size=25" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filters": {
      "must": [
        { "name": "cve_id", "type": "contains_any", "value": ["CVE-2021-44228"] }
      ]
    },
    "sort": [{ "field": "publish_date", "order": "desc" }]
  }'
```

One article:

```bash
curl "https://api.deepinfo.com/v1/cti/news/NEWS_ID" \
  -H "apikey: YOUR_API_KEY"
```

### How Teams Read Structured News.

#### Morning Brief

Filter the last day’s articles to the CVEs and actors your team already tracks, and skip the rest.

#### [Patch Triage](https://www.deepinfo.com/platform/dsi/vulnerability-intelligence/)

When an article reports exploitation of a CVE, check its CISA KEV status and EPSS probability, then your exposure, before the change meeting.

#### [Actor Context](https://www.deepinfo.com/platform/cti/threat-actor-intelligence/)

Read the reporting on an actor next to its profile: the countries and industries it targets, the CVEs and tools it uses.

#### [Intelligence Operations](https://www.deepinfo.com/solutions/use-cases/threat-intelligence-operations/)

Pull structured articles into your intelligence workflow through the API, with the links already extracted.

### Where a Headline Leads Next.

- [Threat Actor Intelligence](https://www.deepinfo.com/platform/cti/threat-actor-intelligence/) (CTI): Profiles of the actors the articles name.
- [Vulnerability Intelligence](https://www.deepinfo.com/platform/dsi/vulnerability-intelligence/) (DSI): CVSS, EPSS and CISA KEV for every CVE in the news.
- [Risk Detection](https://www.deepinfo.com/platform/easm/comprehensive-risk-detection/) (EASM): Whether the CVE in the headline is on your assets.

### Query This Data Through the API

Credentials and dark web findings stay in the Deepinfo Platform. The domain and vulnerability data around them is open through the API.

- [Vulnerability Search API](https://www.deepinfo.com/data-api/apis/vulnerability-search/)
- [Vulnerability Detail API](https://www.deepinfo.com/data-api/apis/vulnerability-detail/)
- [Domain Detail API](https://www.deepinfo.com/data-api/apis/domain-detail/)
- [WHOIS History API](https://www.deepinfo.com/data-api/apis/whois-history/)

### Questions About Cybersecurity News

**Where do the articles come from?**

From third-party security publishers. Each article keeps its source and a link to the original, and the platform adds the structured links to CVEs, threat actors and issue types.

**Can we follow the news for our sector, markets or stack?**

Yes. Articles also carry the countries, industries and organizations they name as targets, and the vendors and products behind their CVEs, so a filter can keep the feed to the ones that concern you.

**Can we filter by more than CVE and actor?**

Yes. The news search also filters on title, source, publication date and tags, with the must, should and must-not logic of the other platform searches.

**Is the news in the platform or only in the API?**

Both. The platform has a news list with search and filters, and the API exposes the same articles through search and detail endpoints.

**Can we read the news on a phone?**

Yes. [Deepinfo Mobile](https://www.deepinfo.com/mobile-app/) has a News tab in its bottom bar, one tap away from your assets.

### Read the News Next to Your Exposure.

Book a walk-through and see how articles, CVEs and threat actors connect to the findings on your own domains.

[Request demo](https://www.deepinfo.com/request-demo/)