1. An apparatus comprising: an interface configured to receive unstructured information; and a hardware processor configured to: determine a threat score for the unstructured information by comparing at least some of the unstructured information to pre-identified information associated with a numerical value; responsive to the threat score exceeding a predetermined threshold, determine labels for Common Alerting Protocol fields of a Common Alerting Protocol file using at least some content within the unstructured information by: determining a first label for an urgency field of the Common Alerting Protocol file, determining a second label for a severity field of the Common Alerting Protocol file, determining a third label for a category field of the Common Alerting Protocol file, and determining a fourth label for a certainty field of the Common Alerting Protocol file; create the Common Alerting Protocol file that includes the determined labels; identify text located within the unstructured information that summarizes at least some of the content within the unstructured information; determine description information for a description Common Alerting Protocol field of the Common Alerting Protocol file using the identified text; and transmit the Common Alerting Protocol file to a decision system to determine at least one of a security risk or a safety risk for one or more subscribing clients.