Neat aggregation. One thing worth adding to the feed pipeline: a staleness signal. Several of these sources (threat feeds especially) have update cadences measured in hours, not seconds. Displaying last-updated timestamps per source would help users weight freshness vs. noise when triaging.