Concelier Kaspersky ICS-CERT Connector - Operations Runbook

Last updated: 2026-05-10

This runbook is for operators who run the Kaspersky ICS-CERT connector in a Stella Ops Concelier instance. The source is disabled by default and requires explicit legal/operator approval per jurisdiction; this document covers that approval gate, configuration, the operator-managed seed fallback and its trust metadata, and the connector’s failure modes.

1. Overview

The Kaspersky ICS-CERT connector ingests ICS/SCADA advisories from the advisory RSS feed and maps them to canonical IDs. The source catalog remains disabled by default until an operator or legal owner approves Kaspersky ICS-CERT ingestion for the deployment jurisdiction.

2. Authentication

• No authentication required for public advisories unless a mirror enforces access controls.

3. Configuration (concelier.yaml)

concelier:
  sources:
    kaspersky-ics:
      feedUri: "https://ics-cert.kaspersky.com/feed-advisories/"
      windowSize: "P30D"
      windowOverlap: "P2D"
      maxPagesPerFetch: 3
      requestDelay: "PT0.5S"
      requestTimeout: "PT30S"
      failureBackoff: "PT5M"
      mirrorFallbackEnabled: false

4. Offline and air-gapped deployments

See the mirror operations guide for general mirror staging and verification, and trust anchors for verifying official/vendor transfer records.

• Do not check a downloaded Kaspersky ICS-CERT payload into the repository. Redistribution and export-control review are deployment-specific.
• The connector supports an operator-managed zipped RSS seed fallback. The fallback is disabled by default and only runs when mirrorFallbackEnabled=true and seedArchivePath points to a local ZIP archive.
• Seed archive shape: a ZIP containing one RSS/XML entry, for example feed-advisories.xml. Set seedArchiveEntryName when the archive contains more than one XML/RSS entry.
• Trust metadata is attached to seed-derived documents and advisory provenance:
  • kaspersky.retrieved_from=operator-managed-rss-seed
  • kaspersky.official_verified=true|false
  • kaspersky.trust_level=operator_checked_mirror|mirror_unverified
  • kaspersky.source_uri=offline-seed://kaspersky-ics/...
  • kaspersky.raw_sha256 and kaspersky.cache_key
• Use mirrorOfficialVerified=true only after the operator has verified the staged archive against an approved official/vendor transfer record. Otherwise keep mirrorTrustLevel=mirror_unverified.

5. Common failure modes

• Feed availability gaps for legacy advisories.
• Some upstream RSS entries include tracking query strings with bare ampersands. The connector now repairs bare & characters before XML parsing while preserving already-escaped entities, so malformed UTM query strings no longer block the whole feed.
• HTML/challenge payloads are detected before XML parsing. The fetch is skipped as degraded and cursor diagnostics record lastFeedStatus=degraded_html_challenge instead of surfacing an XML parser error.
• Cursor diagnostics include lastFeedStatus, lastFeedReason, lastFeedItemCount, lastFeedDroppedCount, lastFeedAmpersandRepairCount, lastFeedByteCount, lastFeedContentType, and lastFeedSource.
• The connector remains disabled by default in jurisdictions where Kaspersky ICS-CERT ingestion requires export-control or sanctions review. Use an approved mirror and document the legal approval before enabling it in those environments.