Vulnerability Operations Runbook

Audience: Platform on-call and operators triaging vulnerability scanning, advisory-feed, and findings problems in a Stella Ops deployment.

Purpose: Provide a fast, deterministic path to triage, mitigate, and evidence vulnerability-pipeline issues — invalid scanner packs or advisory feeds, unhealthy Scanner / Findings Ledger / VEX Lens / Concelier services, and stuck or failed jobs — while preserving reproducibility (hashes and digests) end to end.

Supported Scope

This runbook covers vulnerability operations for Docker Compose, Offline Kit, signed release manifests, and host/service-manager deployments.

Kubernetes and Helm mock overlays are retired. Do not use helm template, helm upgrade, helm rollback, or kubectl scaling/log commands for Stella Ops vulnerability operations.

Related runbooks: VEX Operations · Scanner worker not processing jobs · Concelier air-gap bundle deploy

Triage

  1. Capture the affected tenant, environment, scanner pack, advisory feed bundle, and release manifest digest.
  2. Verify scanner pack and advisory feed hashes against the signed release or Offline Kit manifest.
  3. Check scanner, Findings Ledger, VEX Lens, and Concelier service health through supported service endpoints and host logs.
  4. Review queue depth and failed job evidence from the Stella Ops UI/API.

Mitigation

  1. Pause affected vulnerability jobs if the feed or scanner pack is invalid.
  2. Re-import the last known-good Offline Kit feed bundle when feed corruption is confirmed.
  3. Restart affected services through Docker Compose or the host service manager.
  4. Re-run the failing vulnerability job and compare output digests.

Evidence