Concelier KISA Connector - Operations Runbook
This runbook is for operators who run the Korea Internet & Security Agency (KISA / KrCERT / Boho) connector in a Stella Ops Concelier instance. The runtime/catalog source ID is krcert, so the live fetch pipeline runs as source:krcert:*. Pair this with the engineering brief in docs/dev/kisa_connector_notes.md.
1. Prerequisites
- Outbound HTTPS (or mirrored cache) for
https://www.boho.or.kr/. - Connector options defined under
concelier:sources:krcert:
concelier:
sources:
krcert:
feedUri: "https://www.boho.or.kr/kr/rss.do?bbsId=B0000133"
detailApiUri: "https://www.boho.or.kr/kr/bbs/view.do"
detailPageUri: "https://www.boho.or.kr/kr/bbs/view.do"
maxAdvisoriesPerFetch: 10
requestDelay: "00:00:01"
failureBackoff: "00:05:00"
mirrorFallbackEnabled: false
seedArchivePath: null
seedArchiveEntryName: null
mirrorOfficialVerified: false
mirrorTrustLevel: "mirror_unverified"
maxSeedItemsPerFetch: 250
Ensure the URIs stay absolute. Concelier adds the feedUri, detailApiUri, and detailPageUri hosts to the HttpClient allow-list automatically.
Legacy concelier:sources:kisa binding is still accepted for compatibility, but new setups should use concelier:sources:krcert.
Boho RSS item links carry nttId values and are used directly as the detail source. The historical KNVD IDX query shape is still supported for compatibility with old mirrors, but the public KNVD endpoint has stopped serving the connector’s original /rss/securityInfo.do feed.
Operator-managed RSS seed fallback is available for air-gapped or source-drift recovery, but it is disabled by default. When mirrorFallbackEnabled=true, seedArchivePath must point to a locally staged RSS/XML file or zip archive. This fallback is only a KrCERT/Boho RSS seed replay path; it does not fetch NVD, vendor advisories, or third-party mirrors as substitute authority. Fallback-derived documents are stamped with:
kisa.retrieval.authority=KrCERT/CCkisa.retrieval.retrievedFrom=operator-managed-rss-seedkisa.retrieval.officialVerified=true|falsekisa.retrieval.trustLevel=mirror_unverified|operator_checked_mirrorkisa.retrieval.rawSha256,kisa.retrieval.cacheKey, andkisa.retrieval.conformanceClaim
Use mirrorTrustLevel=operator_checked_mirror only after local operator review. mirrorOfficialVerified=true requires that trust level and should mean the staged RSS was checked against the official KrCERT/Boho source outside the connector.
2. Staging Smoke Test
- Restart the Concelier workers so the KISA options bind.
- Run a full connector cycle:
- CLI: run
stella db fetch --source krcert --stage fetch, then--stage parse, then--stage map. - REST:
POST /jobs/run { "kind": "source:krcert:fetch", "chain": ["source:krcert:parse", "source:krcert:map"] }
- CLI: run
- Confirm telemetry (Meter
StellaOps.Concelier.Connector.Kisa):kisa.feed.success,kisa.feed.itemskisa.feed.dropped_items,kisa.feed.unsupported_shapes,kisa.feed.no_itemskisa.seed_fallbackswhen local seed fallback is explicitly enabled and usedkisa.detail.success/.failureskisa.parse.success/.failureskisa.map.success/.failureskisa.cursor.updates
- Inspect logs for structured entries:
KISA feed returned {ItemCount}KISA fetched detail for {Idx}KISA mapped advisory {AdvisoryId} (severity={Severity})- Absence of warnings such as
document missing payload.
- Validate PostgreSQL state (schema
vuln):raw_documentstable metadata haskisa.idx,kisa.category,kisa.title.dtostable containsschemaVersion="kisa.detail.v1".advisoriestable includes aliases (IDX, CVE) andlanguage="ko".source_statesentry forkrcertshows recentcursor.lastFetchAt.source_states.cursor.lastFeedStatusisok,rss_no_items,rss_no_supported_items,unsupported_json,unsupported_html,unsupported_invalid_xml,unsupported_missing_channel, orseed_fallback.
Telemetry and fixture naming still use the historical kisa.* metric namespace, so dashboards should keep those series names even though the runtime source ID is now krcert.
3. Production Monitoring
- Dashboards:
rate(kisa_feed_items_total[15m])versusrate(concelier_source_http_requests_total{concelier_source="krcert"}[15m])increase(kisa_feed_unsupported_shapes_total[1h]) > 0should page or open source-drift triage.increase(kisa_feed_dropped_items_total[1h]) > 0should warn because RSS items may have lostIDX/nttIddetail identifiers.increase(kisa_seed_fallbacks_total[24h]) > 0should be reviewed with the operator-maintained seed provenance.increase(kisa_detail_failures_total{reason!="empty-document"}[1h])alert at>0increase(kisa_parse_failures_total[1h])for storage/HTML issuesincrease(kisa_map_failures_total[1h])to flag schema driftincrease(kisa_cursor_updates_total[6h]) == 0during active windows should warn
- Alerts: page when
rate(kisa_feed_success_total[2h]) == 0while other connectors are active; back off for maintenance windows announced onhttps://www.boho.or.kr/. - Logs: watch for repeated warnings (
document missing,DTO missing) or errors with reason tagsHttpRequestException,download,parse,map. Unsupported source shape warnings are expected to includestatus, dropped item count, and unsupported-shape count; they are not a healthy empty sync.
4. Localisation Handling
- Hangul categories flow into telemetry tags and logs. Dashboards must render UTF-8 and avoid transliteration.
- HTML content is sanitised before storage; translation teams can consume the
ContentHtmlfield safely. - Advisory severity remains as provided by KISA (
High,Medium, etc.). Map-level failures include the severity tag for filtering.
5. Fixture & Regression Maintenance
- Regression fixtures:
src/Concelier/__Tests/StellaOps.Concelier.Connector.Kisa.Tests/Fixtures/kisa-feed.xmlandkisa-detail.html. - Refresh via
UPDATE_KISA_FIXTURES=1 dotnet test src/Concelier/__Tests/StellaOps.Concelier.Connector.Kisa.Tests/StellaOps.Concelier.Connector.Kisa.Tests.csproj. - The telemetry regression (
KisaConnectorTests.Telemetry_RecordsMetrics) will fail if counters/log wiring drifts; treat failures as gating.
6. Known Issues
- RSS feeds only expose the current publication window; long outages require replay via archived feeds or manual
nttId/legacyIDXseeds. - KrCERT vulnerability notices are also available through Boho feed
https://www.boho.or.kr/kr/rss.do?bbsId=B0000302. Keep the default onB0000133unless the operator wants to mirror the vulnerability-notice stream separately. - Legacy endpoints that return JSON
RES_ERROR, HTML/challenge pages, invalid XML, or RSS items withoutIDX/nttIdare now recorded as unsupported feed shapes. Without an enabled local seed fallback, the connector records source-state failure/backoff instead of advancing as a successful empty sync. - Local seed fallback intentionally creates seed-derived detail DTOs from RSS item metadata and does not claim detail-page enrichment. It should be used for outage recovery or air-gap replay, not as a permanent replacement for an official feed contract.
- Detail pages occasionally throttle; the connector honours
requestDelayand reports failures with reasonHttpRequestException. Consider increasing delay for weekend backfills. - If
kisa.categorytags suddenly appear asunknown, verify KISA has not renamed RSS elements; update the parser fixtures before production rollout.
