Concelier ACSC Connector Operations

Last updated: 2026-05-10

Audience: Stella Ops operators running the Concelier ACSC connector.

1. Overview

The ACSC connector ingests the public Australian Cyber Security Centre (ACSC, part of the Australian Signals Directorate) RSS feeds and maps them to canonical advisory IDs. The runtime/catalog source ID is auscert.

2. Authentication

No authentication is required for public RSS feeds.
Some networks see long first-byte delays or timeouts from www.cyber.gov.au; when direct egress is unreliable, configure a controlled internal relay or Offline Kit mirror rather than disabling the source.

3. Configuration (`concelier.yaml`)

concelier:
  sources:
    auscert:
      baseEndpoint: "https://www.cyber.gov.au/"
      feeds:
        - "alerts|/rss/alerts|true"
        - "advisories|/rss/advisories|true"
        - "news|/rss/news|false"
        - "publications|/rss/publications|false"
        - "ism-updates|/rss/ism-updates|false"
      requestTimeout: "00:01:00"
      failureBackoff: "00:05:00"
      initialBackfill: "120d"
      enableRelayFallback: true
      preferRelayByDefault: false
      forceRelay: false
      relayEndpoint: null
      requestVersion: "2.0"
      versionPolicy: "RequestVersionOrLower"
      mirrorFallbackEnabled: false
      ausCertPortalRssUrl: "https://portal.auscert.org.au/rss/bulletins/"
      operatorCheckedMirrorFallbackEnabled: false

Legacy concelier:sources:acsc binding is still accepted for compatibility, but new setups should use concelier:sources:auscert so the documented defaults match /api/v1/advisory-sources.

4. Offline and Air-Gapped Deployments

Mirror ACSC RSS feeds into the Offline Kit and repoint baseEndpoint to the mirror.
Keep relative paths stable under the mirror (/rss/alerts, /rss/advisories, etc.) so cursor state and source-document IDs remain deterministic.
If using a relay, the relay must preserve feed content, ETag/Last-Modified headers when available, and final item links.
The AusCERT portal RSS fallback is a degraded operator-approved path, not an ACSC mirror. It is disabled by default and only runs after all enabled official ACSC feeds fail.
Records from the fallback are stamped with retrievedFrom=auscert-portal-rss, officialAcscVerification=not_claimed, and trustLevel=mirror_unverified unless the operator sets operatorCheckedMirrorFallbackEnabled=true, which stamps operator_checked_mirror.
Do not vendor live AusCERT portal RSS payloads into the repository unless BUSL/NOTICE and upstream redistribution terms have been reviewed. For air-gapped installs, stage an operator-managed mirror outside the source tree and configure ausCertPortalRssUrl or relayEndpoint to that approved endpoint.

5. Common Failure Modes

Direct requests to https://www.cyber.gov.au/rss/* can time out behind Akamai or regional egress controls. Configure relayEndpoint and leave enableRelayFallback=true, or force the relay for isolated installs.
If mirrorFallbackEnabled=true, the connector fetches ausCertPortalRssUrl after all enabled official ACSC feeds fail. These AusCERT ASB/ESB bulletins are not a drop-in replacement for ACSC Alerts/Advisories and may duplicate vendor-native connector content.
If one feed succeeds and a later feed fails, the connector preserves pending documents/mappings in cursor state so parse/map can continue instead of stranding source documents.
Feed schema updates can break parsing. Capture the failing RSS item and update src/Concelier/__Tests/StellaOps.Concelier.Connector.Acsc.Tests before rollout.