SANS Internet Storm Center

https://isc.sans.edu/diaryarchive.html

Daily diaries by handler community; strong technical signal. (v2.55: rss_url verified, use `python3 tools/fetch_source.py feed https://isc.sans.edu/rssfeed.xml [N]`) | 2026-06-20 full audit (v2.62): live=Y, drill=Y. FETCH → feed https://isc.sans.edu/rssfeed.xml 5 (then webfetch the diary URL https://isc.sans.edu/diary/rss/<id> for body), or webfetch diaryarchive.html. AVOID: Nothing major; both feed and per-diary WebFetch work. Stormcast podcast items have empty bodies; filter to actual diary entries.. | 2026-07-05 admiralty audit: B, ISC handler community, original daily technical diaries, strong signal. Live and fresh; active retained. Filter out empty Stormcast podcast items. | 2026-11-01 (2026-11-01T0256Z-intel): health check read the diaryarchive landing page (no security vocabulary); the feed `fetch_source.py feed https://isc.sans.edu/rssfeed.xml` reads directly and carries dated diaries, so fetch_method is now rss and health_cmd runs the feed. | 2026-11-01 (2026-11-01T1312Z-audit): source_health judged the feed irrelevant because this week's diary titles and summaries (OneNote extraction, Wireshark and YARA-X releases) carry only one term of the probe's security vocabulary; the ISC is a dedicated security source, so content_scope is set to general-news to stop terse feed titles reading as off-topic, and freshness is still judged on the feed dates.