Concelier CVE (MITRE) Connector - Operations Runbook

Last updated: 2026-06-22

This runbook is for operators who deploy and maintain the MITRE CVE connector in a Stella Ops Concelier instance. It covers configuration, offline mirroring, and the failure modes you are most likely to see in production.

For the richer CVE/cvelistV5 and CISA KEV connector workflow (smoke tests, metrics, dashboards), see the CVE & KEV connector operations playbook.

1. Overview

The CVE connector ingests MITRE CVE records to provide canonical vulnerability IDs and record metadata that other Concelier connectors and the Stella Ops policy engine resolve against.

2. Authentication

No authentication required for public CVE feeds.

3. Configuration (`concelier.yaml`)

concelier:
  sources:
    cve:
      baseUri: "<cve-feed-base>"
      maxDocumentsPerFetch: 20
      fetchTimeout: "00:00:45"
      requestDelay: "00:00:00"

4. Offline and air-gapped deployments

Mirror the CVE feed into the Offline Kit and repoint cveListV5Endpoint or baseEndpoint to the mirror. See the mirror operations guide for staging and verification steps.
For a full no-credential corpus backfill, mount an operator-approved cvelistV5 *_all_CVEs_at_midnight.zip archive and set cveListV5BaselineZipPath. Set cveListV5BaselineZipSha256 when the mirror publishes a digest; a mismatch fails closed before any document is stored. The connector resumes through the archive with cursor fields cveListV5BaselineSha256, cveListV5BaselineNextEntry, and cveListV5BaselineCompletedAt, then continues with the rolling deltaLog.json path.
The baseline archive is not vendored by Stella Ops. Treat it as operator-supplied offline material subject to the site’s data licensing and mirror approval process.

5. Common failure modes