Concelier Cisco PSIRT Connector — OAuth Provisioning SOP

Last updated: 2026-04-22

Audience: Stella Ops operators provisioning credentials for the Concelier Cisco PSIRT connector.

1. Scope

This runbook describes how Ops provisions, rotates, and distributes Cisco PSIRT openVuln OAuth client credentials for the authenticated Concelier Cisco connector. It covers online and air-gapped environments, quota-aware execution, and escalation paths.

It does not describe the default Excititor public VEX mirror bootstrap; that path remains credential-free and uses Cisco’s public CSAF metadata and documents.

Primary operator path:

Web UI: Security Posture -> Configure Sources or Ops -> Operations -> Feeds & Airgap -> Configure Sources

CLI:

stella db connectors configure cisco \
  --server https://concelier.example.internal \
  --set clientId=... \
  --set clientSecret=...

Persisted source configuration is now the preferred operator path. Host-local YAML and external secret distribution remain compatibility fallbacks for older installs.

2. Prerequisites

Active Cisco.com account with access to the Cisco API Console
Cisco PSIRT openVuln API entitlement visible under My Apps & Keys
Concelier control-plane access

Entitlement notes:

There is no separate StellaOps-side fee for this connector.
Cisco still requires a Cisco.com account, API Console registration, and visible access to the PSIRT openVuln API entry.
If the openVuln API is not visible for the account, the connector cannot be fully activated until Cisco-side entitlement is in place.

3. Provisioning workflow

Register the application
- Sign in at https://apiconsole.cisco.com.
- Open My Apps & Keys.
- Click Register a New App.
- Choose:
  - Application Type: Service
  - Grant Type: Client Credentials
  - API: Cisco PSIRT openVuln API
- Record the generated clientId and clientSecret.

Verify token issuance

Request an access token:

curl -s https://id.cisco.com/oauth2/default/v1/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=${CLIENT_ID}" \
  -d "client_secret=${CLIENT_SECRET}"

Confirm HTTP 200 and a usable expires_in value.
Do not persist the token itself.

Authorize Concelier runtime
- Store the clientId and clientSecret in StellaOps through the Web UI or the CLI command shown above.
Connectivity validation
- From the Concelier control plane, run:
```
stella db fetch --source cisco --stage fetch
```
- Confirm no 401/403 responses in source diagnostics.

4. Rotation SOP

Step	Owner	Notes
1. Schedule rotation	Ops	Rotate every 90 days or immediately after suspected exposure.
2. Create replacement app	Ops	Repeat the registration flow and verify token issuance.
3. Stage new credentials	Ops + Concelier on-call	Store the replacement values in StellaOps and verify a staged fetch.
4. Cut over	Concelier on-call	Validate successful fetch/parse cycles during a low-traffic window.
5. Deactivate legacy app	Ops	Delete the old app in Cisco API Console after successful validation.

5. Offline Kit packaging

If the site still mirrors secrets out of band:

Generate the credential bundle using the Offline Kit CLI.
Store the encrypted payload under the site-approved secret bundle location.
Record the delivery fingerprint in the manifest.

6. Quota and throttling guidance

Cisco documents combined limits for requests per second, minute, and day per application.
Concelier must respect Retry-After on HTTP 429 responses.
If quota saturation persists, adjust job cadence before requesting higher quotas from Cisco.

7. Incident response

Token compromise: revoke the application in Cisco API Console, purge retained credentials, rotate immediately.
Persistent 401/403: verify the stored credentials, then verify token issuance directly against Cisco.
429 spikes: inspect scheduler cadence and source tuning before escalating upstream.