1. An apparatus comprising: an interface configured to receive unstructured information; and a processor configured to: determine labels for Common Alerting Protocol fields of a Common Alerting Protocol file using at least some content within the unstructured information by: determining a first label for an urgency field of the Common Alerting Protocol file, determining a second label for a severity field of the Common Alerting Protocol file, determining a third label for a category field of the Common Alerting Protocol file, and determining a fourth label for a certainty field of the Common Alerting Protocol file; create the Common Alerting Protocol file that includes the determined labels; and transmit the Common Alerting Protocol file to a decision system to determine at least one of a security risk or a safety risk for one or more subscribing clients.