dirtyhobbit/beholderti repository overview

⁠Beholder

Beholder is a threat intelligence dashboard that aggregates public cybersecurity RSS feeds, classifies signals into practical security categories, and presents high-priority events through a production-ready web UI and API.

⁠What It Includes

• React + TypeScript frontend
• Express backend for RSS fetching, parsing, and caching
• Aggregated /crawl endpoint across allowlisted sources
• /api/feed proxy endpoint for individual feeds
• Health and metrics endpoints for operational checks
• Single-container deployment for straightforward hosting

⁠Included Sources

• Krebs on Security
• The Hacker News
• SecurityWeek
• Dark Reading
• BleepingComputer
• SANS ISC
• Schneier on Security
• Securelist
• Unit 42
• CISA Advisories

⁠Features

• Multi-source RSS aggregation
• Critical event detection
• Topic tagging and filtering
• Source health visibility
• 30-minute refresh workflow
• Rate-limited feed access
• Brief in-memory caching for feed responses

⁠Quick Start

docker pull dirtyhobbit/beholderti:latest
docker run --rm -p 80:8080 dirtyhobbit/beholderti:latest

Then open:

• http://localhost
• http://localhost/health
• http://localhost/crawl

⁠Tags

• latest: most recent pushed image
• 2026-05-18.1: versioned release image

⁠Source

• GitLab: https://gitlab.com/fromseanhelme/beholder⁠