Concelier Adobe PSIRT Connector — Operations Runbook

Last updated: 2026-05-10

Audience: Stella Ops operators running the Concelier Adobe PSIRT connector.

1. Overview

The Adobe connector ingests Adobe PSIRT advisories and maps them to canonical IDs. The canonical runtime source ID is adobe.

2. Authentication

No authentication required for public advisories.

3. Configuration paths

Primary operator path:

Web UI: Security Posture -> Configure Sources or Ops -> Operations -> Feeds & Airgap -> Configure Sources

CLI:

stella db connectors configure adobe \
  --server https://concelier.example.internal \
  --set indexUri=https://mirror.example.internal/adobe/security-bulletin.html

The Adobe connector does not require credentials. Use the UI/CLI configuration path only when overriding the canonical Adobe public index or supplying additional mirror or index URIs. For networks where the Adobe/Akamai edge is unreachable, operators may also configure the disabled-by-default local seed fallback. The repository does not vendor Adobe payloads; the operator must stage and refresh the HTML files.

Compatibility fallback (concelier.yaml):

concelier:
  sources:
    adobe:
      indexUri: "https://helpx.adobe.com/security/security-bulletin.html"
      additionalIndexUris: []
      initialBackfill: "90.00:00:00"
      windowOverlap: "3.00:00:00"
      maxEntriesPerFetch: 100
      seedFallbackEnabled: false
      seedDirectory: null
      seedIndexFileName: "security-bulletin.html"
      seedOfficialVerified: false
      seedTrustLevel: "mirror_unverified"

4. Offline and air-gapped deployments

Mirror the Adobe index and detail pages into the Offline Kit.
Repoint indexUri and additionalIndexUris to the mirrored allowlisted endpoints.
When HTTP mirroring is not available, stage an operator-managed local seed directory and explicitly set seedFallbackEnabled=true.
The seed directory must include the Adobe index HTML at seedIndexFileName (default security-bulletin.html) and matching detail HTML files. Detail files are resolved from the original URL path first, then from details/<advisory-id>.html, details/<detail-file-name>, <advisory-id>.html, or <detail-file-name>.
Mark seedOfficialVerified=true only when the operator has checked the staged seed against Adobe’s official source; this requires seedTrustLevel=operator_checked_mirror. Otherwise keep seedTrustLevel=mirror_unverified.
Seeded documents carry adobe.seed.* metadata, including the relative index/detail file paths, trust level, official verification flag, and raw SHA-256.

Example seed layout:

adobe-seed/
  security-bulletin.html
  details/
    apsb25-85.html
    apsb25-87.html

Example seed fallback configuration:

concelier:
  sources:
    adobe:
      seedFallbackEnabled: true
      seedDirectory: "/var/lib/stella-ops/offline/adobe-seed"
      seedIndexFileName: "security-bulletin.html"
      seedOfficialVerified: true
      seedTrustLevel: "operator_checked_mirror"

5. Common failure modes

Adobe changes the bulletin index HTML layout or detail-table structure
Historic bulletin pages disappear or move without redirects
Operators mirror detail pages but forget to mirror the index page that seeds discovery
The public Adobe index times out from the Concelier network; with no enabled seed fallback, the connector fails closed instead of reporting a successful empty sync.
Seed fallback is enabled but the backfill window excludes every staged advisory; increase initialBackfill or stage newer detail pages.

6. Diagnostics

Adobe emits structured per-cycle counters for:

Index fetch/extract/drop: attempted and successful index fetches, extracted usable entries, kept entries, droppedOldByWindow, droppedBadId, and droppedBadUrl.
Detail capture: attempted, queued, unchanged, skipped, and failed detail documents.
Parse/map: parsedDetails and mappedRows, plus failure counters.

If every configured public index fails, the connector records source failure All Adobe index pages failed (...) and throws unless seedFallbackEnabled=true produces at least one queued or unchanged seed detail document. If the index keeps entries but every detail fetch returns no processable document, the connector records source failure instead of advancing the cursor as an empty success.