Concelier CERT-FR Connector — Operations Runbook

Last updated: 2026-05-31

Audience: Stella Ops operators running the Concelier CERT-FR connector.

1. Overview

The CERT-FR connector ingests advisories (avis) and alerts (alertes) published by the French national CERT (ANSSI) and maps them to canonical advisory IDs. The runtime/catalog source ID is cert-fr, so the fetch pipeline runs as source:cert-fr:*.

2. Authentication

No authentication is required for the public CERT-FR feeds.

3. Configuration (`concelier.yaml`)

concelier:
  sources:
    cert-fr:
      feedUri: "https://www.cert.ssi.gouv.fr/avis/feed/"
      additionalFeedUris:
        - "https://www.cert.ssi.gouv.fr/alerte/feed/"
      initialBackfill: "365.00:00:00"
      windowOverlap: "2.00:00:00"
      maxItemsPerFetch: 100
      requestDelay: "00:00:00"

The CERT-FR alert feed is small and slow-moving (≈40 alert-class items spanning several years). initialBackfill defaults to 365 days so the connector does not silently drop items older than a short window; keep it generous for this low-volume curated feed.
feedUri and every entry in additionalFeedUris must be absolute URIs.

CERT-FR can also be configured through persisted source settings in the Web UI (Security Posture -> Configure Sources) or the CLI (stella db connectors configure cert-fr ...); host-local YAML remains the compatibility fallback.

4. Offline and air-gapped deployments

Mirror the CERT-FR feeds into the Offline Kit and repoint feedUri / additionalFeedUris to the mirror, keeping the feed paths stable so cursor state remains deterministic.

5. Common failure modes

Feed schema changes or outages. Capture the failing feed item and update src/Concelier/__Tests/StellaOps.Concelier.Connector.CertFr.Tests before rollout.
A short backfill window silently dropping older items — verify initialBackfill is wide enough for the curated feed’s cadence.