Concelier NVD Connector - Operations Runbook

Last updated: 2026-01-16

This runbook is for operators who run the NVD connector in a Stella Ops Concelier instance. It covers authentication, configuration, offline/air-gapped deployment, and the common failure modes to watch for.

1. Overview

The NVD connector ingests CVE records and CVSS metadata from the National Vulnerability Database (NVD) feed to enrich advisory observations.

2. Authentication

Requires an NVD API key configured in concelier.yaml under sources.nvd.auth.
An API key raises NVD’s request quota and is strongly recommended for any non-trivial fetch cadence.

For the shared credential-entry workflow across connectors, see Advisory source credential entry.

3. Configuration (`concelier.yaml`)

concelier:
  sources:
    nvd:
      baseUri: "<nvd-api-base>"
      auth:
        type: "api-key"
        header: "apiKey"
      maxDocumentsPerFetch: 20
      fetchTimeout: "00:00:45"
      requestDelay: "00:00:00"

4. Offline and air-gapped deployments

Mirror the NVD feed into the Offline Kit and repoint baseUri to the mirror.
Keep fetch ordering deterministic by maintaining stable paging settings.

5. Common failure modes