Concelier CERT-In Connector — Operations Runbook

Last updated: 2026-05-31

Audience: Stella Ops operators running the Concelier CERT-In connector.

1. Overview

The CERT-In connector ingests advisories published by the Indian Computer Emergency Response Team (CERT-In) and maps them to canonical advisory IDs. The runtime/catalog source ID is cert-in, so the fetch pipeline runs as source:cert-in:*.

2. Authentication

No authentication is required for the public CERT-In advisory listing.

3. Configuration (`concelier.yaml`)

concelier:
  sources:
    cert-in:
      alertsEndpoint: "https://www.cert-in.org.in/s2cMainServlet?pageid=PUBADVLIST"
      windowSize: "30.00:00:00"
      windowOverlap: "2.00:00:00"
      maxPagesPerFetch: 5
      requestDelay: "00:00:00.500"

alertsEndpoint returns the paginated list of recent advisories and must be an absolute URI.
windowOverlap must be smaller than windowSize.
Raise maxPagesPerFetch for a one-time historical catch-up, then restore the default to avoid hammering the listing servlet.

CERT-In can also be configured through persisted source settings in the Web UI (Security Posture -> Configure Sources) or the CLI (stella db connectors configure cert-in ...); host-local YAML remains the compatibility fallback.

4. Offline and air-gapped deployments

Mirror the CERT-In advisory listing and detail pages into the Offline Kit and repoint alertsEndpoint to the mirror, preserving the query path so cursor state remains deterministic.

5. Common failure modes

Listing format changes or intermittent availability of www.cert-in.org.in. Capture the failing page and update src/Concelier/__Tests/StellaOps.Concelier.Connector.CertIn.Tests before rollout.
Aggressive fetch cadence — keep requestDelay at or above the default when egress is shared.