RSS Feed New Item Alerts

The scenario

You follow a handful of low-volume RSS feeds - security advisories from CISA, a vendor's changelog, a researcher's blog. Your RSS reader is fine for reading but slow for alerting; you want a Slack ping the moment a new advisory is published, not on the next 6-hour poll cycle of your reader.

The same pattern fits podcast new-episode alerts, news-source watching, and tracking any "what's new" feed that publishes via Atom/RSS but doesn't offer webhooks.

The problem

RSS reader apps are designed for human reading sessions, not for low-latency alerting. Building your own RSS-to-webhook bridge is a tiny project that grows into a "I have eleven feeds and three of them moved to a different URL" problem.

How Verid solves it

The rss-new-item template uses a regex extractor to pull the first <title> inside the first <item> (or <entry> for Atom). When that title changes, a new entry has been published. The predicate fires, the webhook delivers, and your handler can act on the new item.

For more structure - title, link, pubDate - extend the regex with multiple capture groups or swap to an XML-aware extraction in your downstream consumer.

Build the monitor

Extraction config

{
  "method": "regex",
  "fields": {
    "latest_title": "<item>\\s*<title>(?:<!\\[CDATA\\[)?([^<\\]]+)",
    "latest_link":  "<item>[\\s\\S]*?<link>([^<]+)</link>"
  }
}

The regex captures the first <title> and <link> element inside the first <item> block.

For Atom feeds use the equivalents - <entry> instead of <item>, and <link href="..."> instead of <link>...</link>:

{
  "method": "regex",
  "fields": {
    "latest_title": "<entry>\\s*<title>(?:<!\\[CDATA\\[)?([^<\\]]+)",
    "latest_link":  "<entry>[\\s\\S]*?<link[^>]*href=\"([^\"]+)\""
  }
}

Predicate

{ "type": "field_changes", "field": "latest_title" }

A new top entry means a new publication.

Create the monitor

Using the template:

curl -X POST https://api.verid.dev/v1/monitors/from-template/rss-new-item \
  -H "Authorization: Bearer vrd_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "CISA - Known Exploited Vulnerabilities",
    "url": "https://www.cisa.gov/news.xml",
    "deliveries": [
      { "type": "slack", "webhookUrl": "https://hooks.slack.com/services/..." }
    ]
  }'

SDK:

import { VeridClient } from '@verid.dev/sdk';

const client = new VeridClient({ apiKey: 'vrd_your_api_key' });

await client.monitors.createFromTemplate('rss-new-item', {
  name: 'CISA - Known Exploited Vulnerabilities',
  url: 'https://www.cisa.gov/news.xml',
  deliveries: [
    { type: 'slack', webhookUrl: 'https://hooks.slack.com/services/...' },
  ],
});

What the webhook delivers

{
  "id": "del_01H...",
  "fired_at": "2026-05-08T17:45:00Z",
  "diff": {
    "fields_changed": ["latest_title", "latest_link"],
    "before": {
      "latest_title": "CVE-2026-12345 - Buffer overflow in libxyz",
      "latest_link":  "https://www.cisa.gov/news/cve-2026-12345"
    },
    "after": {
      "latest_title": "CVE-2026-12346 - Auth bypass in service-abc",
      "latest_link":  "https://www.cisa.gov/news/cve-2026-12346"
    }
  }
}

Caveats & tips

• Regex against XML is imperfect by design. It works fine for stable, well-formed feeds. If a feed is messy or has unusual whitespace, you may need to tune the patterns. For complex parsing, do regex extraction in Verid (cheap, fast) and richer parsing in your webhook handler.
• CDATA wrapping varies. Some feeds wrap titles in <![CDATA[...]]> and some don't. The pattern above is permissive - the (?:<!\[CDATA\[)? makes the wrapper optional.
• Burst publishing. When a feed publishes three entries at once, you'll get one webhook for the new top entry. To catch all three, your handler should re-fetch the feed and process from the previously-seen item forward.
• Polling interval bounds the latency. RSS isn't push; your alert latency is at best one interval. 5-10 minutes is a reasonable balance for most feeds.

Related use cases

For sitemap-driven discovery, see sitemap new URLs. For JSON-API style monitoring, see JSON API field monitoring. For academic feeds specifically, see academic journal & paper updates.