Concelier CISA ICS Connector - Operations Runbook

This runbook is for operators who configure, validate, and operate the CISA Industrial Control Systems (ICS) connector (source:ics-cisa:*) in a Stella Ops Concelier instance. The connector defaults to CISA’s public ICS RSS feeds. GovDelivery remains available for operators that need the older personalised-topic feeds or an internal mirror that preserves that shape.

1. Feed Mode

Default mode:

GovDelivery mode is optional. Use it only when an operator has a confirmed personalised subscription code or when a local relay exposes GovDelivery-compatible topic feeds:

  1. Create a service mailbox reachable by the Ops crew (shared mailbox recommended).
  2. Browse to https://public.govdelivery.com/accounts/USDHSCISA/subscriber/new and subscribe the mailbox to the following GovDelivery topics:
    • USDHSCISA_16 — ICS-CERT advisories (legacy numbering: ICSA-YY-###).
    • USDHSCISA_19 — ICS medical advisories (ICSMA-YY-###).
    • USDHSCISA_17 — ICS alerts (IR-ALERT-YY-###) for completeness.
  3. Complete the verification email. After confirmation, note the personalised subscription code included in the “Manage Preferences” link. It has the shape code=AB12CD34EF.
  4. Store the code in the shared secret vault (or Offline Kit secrets bundle) as concelier/sources/icscisa/govdelivery/code.

ℹ️ GovDelivery does not expose a one-time API key; the personalised code is what authenticates the RSS pull. Never commit it to git.

2. Feed Validation

Use the following commands to confirm the selected feed mode is reachable before wiring it into Concelier.

Public mode:

curl -H "User-Agent: StellaOpsConcelier/ics-cisa" \
     "https://www.cisa.gov/cybersecurity-advisories/ics-advisories.xml"

GovDelivery mode (substitute <CODE> with the personalised value):

curl -H "User-Agent: StellaOpsConcelier/ics-cisa" \
     "https://content.govdelivery.com/accounts/USDHSCISA/topics/ICS-CERT/feed.rss?format=xml&code=<CODE>"

If the endpoint returns HTTP 200 and an RSS payload, archive the sample response (and any attachment URL schema) under docs/artifacts/icscisa/ as the connector’s document inventory. In GovDelivery mode, HTTP 403 or 406 usually means the subscription was not confirmed or the code was mistyped.

3. Configuration Snippet

Add the connector configuration to concelier.yaml (or equivalent environment variables):

concelier:
  sources:
    icscisa:
      usePublicFeeds: true
      publicFeedUris:
        - "https://www.cisa.gov/cybersecurity-advisories/ics-advisories.xml"
        - "https://www.cisa.gov/cybersecurity-advisories/ics-medical-advisories.xml"
      requestDelay: "00:00:01"
      failureBackoff: "00:05:00"

GovDelivery override:

concelier:
  sources:
    icscisa:
      usePublicFeeds: false
      govDelivery:
        code: "${CONCELIER_ICS_CISA_GOVDELIVERY_CODE}"
        topics:
          - "USDHSCISA_16"
          - "USDHSCISA_19"
          - "USDHSCISA_17"
      rssBaseUri: "https://content.govdelivery.com/accounts/USDHSCISA"
      requestDelay: "00:00:01"
      failureBackoff: "00:05:00"

Environment variable example:

export CONCELIER_SOURCES_ICSCISA_GOVDELIVERY_CODE="AB12CD34EF"

Concelier automatically registers the public feed, GovDelivery, detail-page, and configured attachment hosts with the Source.Common HTTP allow-list when the connector assembly is loaded.

Optional tuning keys (set only when needed):

4. Seeding Without Live RSS

If public egress or GovDelivery credentials are not available, populate the connector with the community CSV dataset before enabling the live fetch:

  1. Run ./devops/tools/fetch-ics-cisa-seed.sh (or .ps1) to download the latest CISA_ICS_ADV_*.csv files into src/__Tests/__Datasets/seed-data/ics-cisa/.
  2. Copy the CSVs (and the generated .sha256 files) into your Offline Kit staging area so they ship alongside the other feeds.
  3. Import the kit as usual. The connector can parse the seed data for historical context; fresh advisories require either public CISA RSS egress or a configured GovDelivery/internal mirror feed.
  4. Once the live path is available, update concelier:sources:icscisa and re-trigger source:ics-cisa:fetch.

The CSVs are licensed under ODbL 1.0 by the ICS Advisory Project. Preserve the attribution when redistributing them.

5. Integration Validation

  1. Ensure the selected public/GovDelivery/mirror feed is reachable and restart the Concelier workers.
  2. Run a dry-run fetch/parse/map chain:
    stella db fetch --source ics-cisa --stage fetch
stella db fetch --source ics-cisa --stage parse
stella db fetch --source ics-cisa --stage map
  3. Confirm logs contain ics-cisa detail fetch entries and that new documents/DTOs include attachments (see docs/artifacts/icscisa). Canonical advisories should expose PDF links as references.kind == "attachment" and affected packages should surface primitives.semVer.exactValue for single-version hits.
  4. If Akamai blocks direct fetches, set concelier:sources:icscisa:proxyUri to your allow-listed egress proxy and rerun the dry-run.

6. Rotation & Incident Response

7. Offline Kit Handling

For GovDelivery mode, include the personalised code in offline-kit/secrets/concelier/icscisa.env:

CONCELIER_SOURCES_ICSCISA_GOVDELIVERY_CODE=AB12CD34EF

The Offline Kit deployment script copies this file into the container secret directory mounted at /run/secrets/concelier. Ensure permissions are 600 and ownership matches the Concelier runtime user.

8. Telemetry & Monitoring

The connector emits metrics under the meter StellaOps.Concelier.Connector.Ics.Cisa. They allow operators to track Akamai fallbacks, detail enrichment health, and advisory fan-out.

Suggested alerts: