Concelier KISA Connector - Operations Runbook

This runbook is for operators who run the Korea Internet & Security Agency (KISA / KrCERT / Boho) connector in a Stella Ops Concelier instance. The runtime/catalog source ID is krcert, so the live fetch pipeline runs as source:krcert:*. Pair this with the engineering brief in docs/dev/kisa_connector_notes.md.

1. Prerequisites

concelier:
  sources:
    krcert:
      feedUri: "https://www.boho.or.kr/kr/rss.do?bbsId=B0000133"
      detailApiUri: "https://www.boho.or.kr/kr/bbs/view.do"
      detailPageUri: "https://www.boho.or.kr/kr/bbs/view.do"
      maxAdvisoriesPerFetch: 10
      requestDelay: "00:00:01"
      failureBackoff: "00:05:00"
      mirrorFallbackEnabled: false
      seedArchivePath: null
      seedArchiveEntryName: null
      mirrorOfficialVerified: false
      mirrorTrustLevel: "mirror_unverified"
      maxSeedItemsPerFetch: 250

Ensure the URIs stay absolute. Concelier adds the feedUri, detailApiUri, and detailPageUri hosts to the HttpClient allow-list automatically.

Legacy concelier:sources:kisa binding is still accepted for compatibility, but new setups should use concelier:sources:krcert.

Boho RSS item links carry nttId values and are used directly as the detail source. The historical KNVD IDX query shape is still supported for compatibility with old mirrors, but the public KNVD endpoint has stopped serving the connector’s original /rss/securityInfo.do feed.

Operator-managed RSS seed fallback is available for air-gapped or source-drift recovery, but it is disabled by default. When mirrorFallbackEnabled=true, seedArchivePath must point to a locally staged RSS/XML file or zip archive. This fallback is only a KrCERT/Boho RSS seed replay path; it does not fetch NVD, vendor advisories, or third-party mirrors as substitute authority. Fallback-derived documents are stamped with:

Use mirrorTrustLevel=operator_checked_mirror only after local operator review. mirrorOfficialVerified=true requires that trust level and should mean the staged RSS was checked against the official KrCERT/Boho source outside the connector.

2. Staging Smoke Test

  1. Restart the Concelier workers so the KISA options bind.
  2. Run a full connector cycle:
    • CLI: run stella db fetch --source krcert --stage fetch, then --stage parse, then --stage map.
    • REST: POST /jobs/run { "kind": "source:krcert:fetch", "chain": ["source:krcert:parse", "source:krcert:map"] }
  3. Confirm telemetry (Meter StellaOps.Concelier.Connector.Kisa):
    • kisa.feed.success, kisa.feed.items
    • kisa.feed.dropped_items, kisa.feed.unsupported_shapes, kisa.feed.no_items
    • kisa.seed_fallbacks when local seed fallback is explicitly enabled and used
    • kisa.detail.success / .failures
    • kisa.parse.success / .failures
    • kisa.map.success / .failures
    • kisa.cursor.updates
  4. Inspect logs for structured entries:
    • KISA feed returned {ItemCount}
    • KISA fetched detail for {Idx}
    • KISA mapped advisory {AdvisoryId} (severity={Severity})
    • Absence of warnings such as document missing payload.
  5. Validate PostgreSQL state (schema vuln):
    • raw_documents table metadata has kisa.idx, kisa.category, kisa.title.
    • dtos table contains schemaVersion="kisa.detail.v1".
    • advisories table includes aliases (IDX, CVE) and language="ko".
    • source_states entry for krcert shows recent cursor.lastFetchAt.
    • source_states.cursor.lastFeedStatus is ok, rss_no_items, rss_no_supported_items, unsupported_json, unsupported_html, unsupported_invalid_xml, unsupported_missing_channel, or seed_fallback.

Telemetry and fixture naming still use the historical kisa.* metric namespace, so dashboards should keep those series names even though the runtime source ID is now krcert.

3. Production Monitoring

4. Localisation Handling

5. Fixture & Regression Maintenance

6. Known Issues