Concelier Oracle CPU Connector - Operations Runbook

Last updated: 2026-04-22

This runbook is for operators who run the Oracle Critical Patch Update (CPU) connector in a Stella Ops Concelier instance. It covers configuration, the Excititor VEX mirror bootstrap, offline/air-gapped deployment, and the common failure modes to watch for.

1. Overview

The Concelier Oracle connector ingests Oracle Critical Patch Update advisories and maps them to canonical IDs.

For the default Excititor VEX mirror bootstrap, Stella Ops discovers Oracle updates from Oracle public security RSS and derives the matching CSAF JSON document URIs deterministically.

2. Authentication

• No authentication required for public advisories.

3. Configuration paths

The persisted source configuration is the primary operator path; see Advisory source credential entry for the shared workflow across connectors.

Primary operator path:

• Web UI: Security Posture -> Configure Sources or Ops -> Operations -> Feeds & Airgap -> Configure Sources
• CLI:

  stella db connectors configure oracle \
    --server https://concelier.example.internal \
    --set calendarUris=https://www.oracle.com/security-alerts/
  

Use the UI/CLI path only when overriding the default Oracle landing page or pinning specific advisories for mirrored or offline flows. Leaving the URI fields blank keeps the built-in public default.

Compatibility fallback (concelier.yaml):

concelier:
  sources:
    vndr:
      oracle:
        calendarUris:
          - "https://www.oracle.com/security-alerts/"
        advisoryUris: []
        requestDelay: "00:00:01"

Notes:

• Concelier uses Oracle calendar or index pages for the advisory connector.
• calendarUris and advisoryUris are both valid.
• At least one of them must be configured unless you rely on the built-in default Oracle landing page.
• calendarUris should point at Oracle calendar or index pages; the connector filters discovered links down to concrete /security-alerts/*.html advisory pages.

Example: pinning a specific quarterly CPU advisory directly

concelier:
  sources:
    vndr:
      oracle:
        advisoryUris:
          - "https://www.oracle.com/security-alerts/cpuapr2025.html"
        requestDelay: "00:00:00"

4. Excititor default public VEX bootstrap

• Discovery RSS: https://www.oracle.com/ocom/groups/public/@otn/documents/webcontent/rss-otn-sec.xml
• Derived CSAF base: https://www.oracle.com/docs/tech/security-alerts/

5. Offline and air-gapped deployments

• Mirror CPU advisories into the Offline Kit and repoint calendarUris or advisoryUris to the mirrored HTML endpoints for advisory ingestion.
• For Excititor mirror bootstrap, mirror the Oracle RSS feed and the derived /docs/tech/security-alerts/*csaf.json documents.

6. Common failure modes

• Schedule drift during quarterly CPU updates
• Oracle renaming RSS items or advisory stems in a way that changes the derived CSAF JSON path
• Mirroring only the HTML pages while omitting the derived CSAF JSON payloads needed by Excititor