Concelier CERT/CC Connector — Operations Runbook

Last updated: 2026-05-31

Audience: Stella Ops operators running the Concelier CERT/CC connector.

1. Overview

The CERT/CC connector ingests vulnerability notes published by the CERT Coordination Center (Carnegie Mellon Software Engineering Institute) through the VINCE Vulnerability Notes API, then maps them to canonical advisory IDs. The runtime/catalog source ID is cert-cc, so the fetch pipeline runs as source:cert-cc:*.

2. Authentication

No authentication is required; the VINCE Vulnerability Notes API serves public advisories.

3. Configuration (`concelier.yaml`)

concelier:
  sources:
    cert-cc:
      baseApiUri: "https://www.kb.cert.org/vuls/api/"   # must end with a trailing slash
      maxMonthlySummaries: 6        # summary endpoints requested per plan
      maxNotesPerFetch: 25          # detail bundles processed per fetch pass
      detailRequestDelay: "00:00:00.100"
      enableDetailMapping: true
      summaryWindow:
        windowSize: "30.00:00:00"
        overlap: "3.00:00:00"
        initialBackfill: "365.00:00:00"
        minimumWindowSize: "1.00:00:00"

baseApiUri must be an absolute URI ending in a trailing slash.
The sliding summaryWindow controls which monthly summary endpoints are requested; raise initialBackfill for a one-time historical catch-up and restore the default afterwards.
Set enableDetailMapping: false for dry runs or migration staging, where parse/map stages should skip detail mapping.

CERT/CC can also be configured through persisted source settings in the Web UI (Security Posture -> Configure Sources) or the CLI (stella db connectors configure cert-cc ...); host-local YAML remains the compatibility fallback.

4. Offline and air-gapped deployments

Mirror the VINCE API responses into the Offline Kit and repoint baseApiUri to the mirror, preserving the /vuls/api/ path layout so cursor state and source-document IDs remain deterministic.

5. Common failure modes

Upstream throttling — increase detailRequestDelay or lower maxNotesPerFetch before requesting relief from CERT/CC.
VINCE API schema changes can break parsing. Capture the failing payload and update src/Concelier/__Tests/StellaOps.Concelier.Connector.CertCc.Tests before rollout.