CERT-IT RSS Processor — Design

Overview

Fetches security advisories from CSIRT-ITA (Italian Computer Security Incident Response Team, under ACN — Agenzia per la Cybersicurezza Nazionale) and creates CVEMetadata rows (source=cert-it) under the original CVE IDs.

Advisories are in Italian. The <description> field is unstructured plain text; structured fields (CVE IDs, severity, PoC status, exploitation status, product name, CSIRT bulletin codes) are extracted by regex. Items with no CVE reference are skipped.

Feed

Parsing

The <description> field contains Italian plain text. After HTML-unescaping (the feed may encode entities as “/” or directly as UTF-8 curly quotes), the following signals are extracted:

Severity extraction

The feed expresses severity as an Italian keyword embedded in free text, e.g.:

…una vulnerabilità con gravità "alta" in Docker Model Runner…
…con gravità "critica" e per la quale risulta disponibile…

The regex (?i)gravit[^\s]*\s+.{0,15}(critica|alta|media|bassa) tolerates any quote style (straight ", curly "…", or none) between gravità and the keyword. Mapping:

No CVSS vector string is present in the feed.

Product extraction from title

Three heuristic patterns tried in order:

1. Colon prefix — ^(.+?):\s+\S — text before the first colon is the product (e.g. Langflow: rilevata 0-day… → Langflow)
2. After “in”/“per” — vulnerabilità in X / aggiornamenti per X → X
3. Supply-chain — versioni malevole su X / libreria Python X → X

Italian qualifier prefixes (prodotti, firmware, software, libreria, etc.) are stripped from the result (e.g. prodotti Fortinet → Fortinet).

ID Strategy

All items reference upstream CVE IDs — no VDB minting needed. Multi-CVE advisories create one CVEMetadata row per CVE with all others listed as aliases. Items without any CVE ID are skipped (skippedNoCVE counter).

Storage

No new tables or columns. All tables already exist.

The stored score is synthetic. 9.5 / 8.0 / 5.0 / 2.0 are stand-ins for the Italian severity keyword, not a computed CVSS base score, yet they are written as an ordinary cvssV3_1 baseScore with containerType="cna" (internal/certit/mapper.go:64-75). A consumer averaging or comparing baseScore across sources cannot distinguish them from measured scores. CVEMetadata.vectorString is NULL for every row, correctly — the feed carries no vector.

rawDataJSON captures all parsed fields including poc_available, active_exploit, and bulletin_ids for downstream use.

Incremental Strategy

On startup, load all sourceAdvisoryRef values from CVEMetadata where source='cert-it' into a map[string]bool. Per advisory: if the URL is already in the set and neither --all nor --force is set, skip. After successful processing, add the URL to the in-memory set.

Flags

Error Alerting

All lifecycle events are published to SNS → Lambda → Slack via the shared internal/notify package:

Per-item DB errors are accumulated via notifier.RecordError() and flushed in a single task.errored SNS event via notifier.HasErrors() at the end of the processing loop. This means a partial run that stored some records but failed on others still triggers a Slack alert.

Fatal errors (feed fetch failure, feed parse failure) call notifier.Errored() immediately and os.Exit(1).

ECS Schedule

Runs once daily at 06:00 UTC (cron(0 6 * * ? *)).

Local Testing

# Backfill against prod (first 10 items)
just go-cert-it-rss-backfill prod false 10 false

# Full reprocess against prod
just go-cert-it-rss-backfill prod true 0 false

# Run in local ARM64 container (mirrors ECS)
just cert-it-rss-processor prod

Key Files

S3 Persistence

• Archive path: cert-it/files/{sha256}/{filename} ✓
• Quarantine path: failed-feeds/cert-it-rss-processor/{YYYY-MM-DD}/{reason}/{filename} ✓
• Failure reasons emitted: parse-error, store-error

Uses s3client.Uploader from internal/s3client/uploader.go. Skipped when S3_BUCKET_NAME is unset (local dev).

See the S3 Persistence Contract for the full reason taxonomy.