Pi CyberFeed

A cybersecurity dashboard built for the Raspberry Pi 5 with a Pimoroni HyperPixel 4.0 touchscreen. Pulls live RSS feeds, provider status, CISA KEV vulnerability signals, and keyword relevance scoring — all running locally with no cloud dependencies.

Plug in an external monitor and the dashboard auto-switches: full ops panel on the monitor, Pokémon battles on the Pi.

What It Does

• Live Feed — aggregates cybersecurity news from TLDR Sec, Krebs on Security, BleepingComputer, and NCSC. Auto-scrolling with tap/click to read full articles.
• Provider Status — real-time status for AWS, Azure, Cloudflare, and GitHub with incident details pulled from their public APIs.
• CISA KEV Signals — latest entries from CISA's Known Exploited Vulnerabilities catalogue.
• Relevance Scoring — keyword matching against your tech stack (Azure/M365, AWS/EKS, Kubernetes, GitLab, Cloudflare) with matching headline counts.
• Dual Display — auto-detects HDMI monitors. When connected, the dashboard moves to the monitor and the Pi screen shows animated Pokémon battles with a live status bar.
• Threat Bar — animated gradient strip that shifts from green to red based on active incidents and CVEs.
• Pokéball Easter Egg — appears when all four providers are green.

Hardware

• Raspberry Pi 5 (8GB recommended)
• Pimoroni HyperPixel 4.0 touchscreen (800×480)
• Micro HDMI cable (for external monitor, optional)
• Any 1080p+ monitor (optional)

Software Requirements

• Raspberry Pi OS (64-bit, Trixie or later) on X11 (not Wayland — Chromium touch breaks on Wayland)
• Chromium browser (pre-installed with Pi OS)
• Python 3.11+

Python Dependencies

pip install feedparser newspaper4k cloudscraper --break-system-packages

System Dependencies

sudo apt install -y unclutter xdotool

Setup

1. Clone the repo:

   git clone https://github.com/AmanSK5/pi-cyberfeed.git ~/dashboard
   cd ~/dashboard

2. Make scripts executable:

   chmod +x kiosk.sh display-switch.sh

3. Configure the HyperPixel overlay — add to /boot/firmware/config.txt under [all]:

   dtoverlay=vc4-kms-dpi-hyperpixel4
   

4. For HDMI auto-detection — add to /boot/firmware/config.txt:

   [HDMI:0]
   hdmi_group=0
   hdmi_force_hotplug=1
   
   [HDMI:1]
   hdmi_force_hotplug=1
   hdmi_group=2
   hdmi_mode=82
   

5. Set up autostart — create ~/.config/autostart/cyberfeed.desktop:

   [Desktop Entry]
   Type=Application
   Name=CyberFeed
   Exec=/home/<your-username>/dashboard/kiosk.sh
   X-GNOME-Autostart-enabled=true

6. Reboot:

   sudo reboot

Files

File	Description
index.html	Pi HyperPixel dashboard (landscape, 800×480)
monitor.html	External monitor dashboard (1080p, Concept C design)
pokemon.html	Pokémon battle screen (shown on Pi when HDMI connected)
fetcher.py	Python fetcher — RSS, status APIs, CISA KEV (runs every 15 min)
display-switch.sh	HDMI auto-detection daemon (checks both HDMI ports)
kiosk.sh	Boot launcher — starts fetcher, HTTP server, and display switch

Customisation

Change RSS Sources

Edit the FEEDS list in fetcher.py:

FEEDS = [
    {"name": "TLDR", "class": "source-tldr", "url": "https://tldr.tech/api/rss/infosec"},
    {"name": "Krebs", "class": "source-krebs", "url": "https://krebsonsecurity.com/feed/"},
    # Add your own sources here
]

Change Relevance Keywords

Edit RELEVANCE_KEYWORDS in fetcher.py to match your stack:

RELEVANCE_KEYWORDS = {
    "Azure / M365": ["azure", "microsoft 365", "m365", "entra", "intune"],
    "AWS / EKS": ["aws", "eks", "amazon web services"],
    # Add your own keywords here
}

Change Providers

The fetcher checks AWS, Azure, Cloudflare, and GitHub by default. Cloudflare and GitHub use the Atlassian Statuspage API. AWS and Azure use RSS feeds and page scraping.

Architecture

┌─────────────────────────────────────────────────┐
│  fetcher.py (every 15 min)                      │
│  ├─ RSS feeds → feedparser + newspaper4k        │
│  ├─ Status APIs → cloudscraper                  │
│  ├─ CISA KEV → JSON feed                        │
│  └─ writes feeds.json                           │
├─────────────────────────────────────────────────┤
│  python3 -m http.server 8080                    │
│  └─ serves HTML + feeds.json locally            │
├─────────────────────────────────────────────────┤
│  display-switch.sh (every 5 sec)                │
│  ├─ polls xrandr for HDMI                       │
│  ├─ HDMI detected → monitor.html + pokemon.html │
│  └─ HDMI removed → index.html on Pi             │
├─────────────────────────────────────────────────┤
│  Chromium (kiosk mode)                          │
│  └─ renders dashboard from localhost:8080       │
└─────────────────────────────────────────────────┘

Known Issues

• Scroll smoothness — the Pi 5 GPU can struggle driving two displays simultaneously. Scroll speed is set to 40px/sec which is a good balance.
• HDMI detection — some monitors don't negotiate properly with the Pi 5. The hdmi_force_hotplug config and the activation logic in display-switch.sh handle most cases.
• Wayland — do not use Wayland. Chromium touch input breaks. Use X11 via sudo raspi-config nonint do_wayland W1.

Credits

• Pokémon sprites from PokeAPI (Gen V Black/White animated)
• Status APIs from Cloudflare, GitHub, AWS, Azure
• CVE data from CISA KEV

License

MIT