Skip to main content

rss-reader

The rss-reader tool is designed to seamlessly fetch, filter, and convert RSS and Atom feeds into various formats including JSON, JSONL, CSV, and XML within Canva workflows. It plays a critical role in aggregating latest information from multiple sources in a structured format, which can be particularly beneficial during security investigations.

Ideal Use Cases & Fit​

This tool is most effective when utilized for aggregating news and updates from security-focused blogs, vulnerability announcements, and threat intelligence sources. Ideal inputs include newline-separated URLs pointing to RSS feeds. It addresses the challenge of consolidating multiple data sources into a singular format for analysis. However, it is not suitable for real-time monitoring or scenarios requiring complex, non-RSS data integrations.

Value in Workflows​

Integrating rss-reader into security workflows enhances data collection, enabling teams to gather relevant threat intelligence and news articles during the reconnaissance or analysis phases. By converting mixed RSS outputs into structured formats, users can facilitate downstream data processing, reporting, or storage in security information and event management (SIEM) systems.

Input Data​

The rss-reader expects input data in the form of newline-separated RSS feed URLs. This is critical for defining the sources of information the tool will aggregate. An example input might look like:

https://example.com/feed.xml

https://another-site.com/rss

Configuration​

  • date-from: Specifies a timestamp (epoch milliseconds) to filter items from a certain date.
  • date-to: Specifies a timestamp (epoch milliseconds) to filter items up to a certain date.
  • search: Allows for fuzzy searching of keywords in the title and description of articles.
  • source: Filters results by source name or URL (substring match).
  • sort-by: Dictates the sorting order of results; options include sorting by 'date' (default, newest first) or 'source'.
  • limit: Controls the maximum number of results returned per source, defaulting to 50.
  • last-24h: If set to true, fetches articles published in the last 24 hours (overrides date-from and date-to).
  • format: Specifies the output format for the aggregated data. Options: json (default, indented), jsonl (single-line), csv, or xml.

Output Structure​

The tool outputs a structured response containing processing statistics and feed items. The default JSON format includes:

{
  "stats": {
    "total_feeds": 2,
    "successful_feeds": 1,
    "failed_feeds": 1,
    "successful_urls": [
      {
        "url": "https://example.com/feed.xml",
        "items_found": 50,
        "items_after_filter": 25
      }
    ],
    "failed_urls": [
      {
        "url": "https://invalid-url.com/feed",
        "error": "Network error: Cannot connect to host..."
      }
    ],
    "total_items_found": 50,
    "filtered_items": 25
  },
  "items": [
    {
      "sourcename": "Example Blog",
      "source": "https://example.com",
      "title": "Article Title",
      "description": "Article description...",
      "link": "https://example.com/article",
      "pubDate": "Mon, 06 Oct 2025 12:00:00 GMT",
      "pubDate_epoch": 1759708800000
    }
  ]
}

Statistics Explained​

  • total_feeds: Total number of input feed URLs
  • successful_feeds: Number of feeds successfully fetched and parsed
  • failed_feeds: Number of feeds that failed to process
  • successful_urls: List of successfully processed feeds with raw item counts and filtered counts
  • failed_urls: List of failed feeds with specific error messages
  • total_items_found: Total raw items found across all feeds (before filtering)
  • filtered_items: Total items after applying date/search/source filters

Error Handling & Validation​

The tool provides comprehensive error handling and validation:

  • URL Validation: Validates URL format before fetching. Reports errors for:

    • Missing scheme or network location (e.g., example.com/feed instead of https://example.com/feed)
    • Invalid schemes (must be http or https)

  • Network Errors: Captures and reports:

    • Connection failures and timeouts
    • HTTP error status codes
    • DNS resolution failures

  • Parsing Errors: Reports XML parsing issues for malformed feeds

All errors are included in the output's failed_urls array with descriptive error messages, ensuring full visibility into processing failures. Updated: 2026-02-17