VEX Operations Runbook

Audience: Platform on-call and operators triaging VEX (Vulnerability Exploitability eXchange) ingestion and mapping problems in a Stella Ops deployment.

Purpose: Provide a fast, deterministic path to triage, mitigate, and evidence VEX issues — bad signatures, stale or mismatched documents, mapping failures, and VEX Lens service health — without losing the audit trail.

Supported Scope

This runbook covers VEX operations for Docker Compose, Offline Kit, signed release manifests, and host/service-manager deployments.

Kubernetes and Helm deployment procedures are retired. Do not use Helm mock overlays, helm upgrade, helm rollback, kubectl logs, or Kubernetes resource captures as Stella Ops VEX operations evidence.

Related runbooks: Vulnerability Operations · Concelier air-gap bundle deploy

Triage

  1. Capture the VEX document id, tenant, product, release manifest digest, and affected vulnerability ids.
  2. Verify VEX document signature, digest, and source against the release or Offline Kit evidence.
  3. Check VEX Lens service health through the supported service endpoint and host logs.
  4. Review mapping failures and reason codes from the Stella Ops API or persisted evidence store.

Mitigation

  1. Reject unsigned, stale, or mismatched VEX documents.
  2. Re-import the last known-good VEX bundle when source data corruption is confirmed.
  3. Restart affected services through Docker Compose or the host service manager.
  4. Re-run VEX mapping and attach before/after evidence.

Evidence