ISC Advisory RSS Processor — Design
Overview
Fetches ISC (Internet Systems Consortium) security advisories from the public
RSS 2.0 feed (https://kb.isc.org/v1/rss/en) and creates first-class
CVEMetadata rows (source=isc) for every CVE ID embedded in each advisory.
ISC maintains BIND, Kea, Stork, and ISC DHCP — critical DNS and DHCP infrastructure. Their KB feed mixes general articles with security advisories; only items containing CVE IDs are processed.
Feed
| Property | Value |
|---|---|
| URL | https://kb.isc.org/v1/rss/en |
| Auth | None — fully public |
| Format | RSS 2.0 with Atom namespace (xmlns:atom) |
| Items | Mix of KB articles; security advisories identified by CVE ID presence |
Parsing
| Field | Source |
|---|---|
| Advisory ID | Last path segment of <link> |
| Advisory URL | <link> (fallback: <guid>) |
| Title | <title> |
| Category | <category> (e.g. “BIND 9 > Security Advisories”) |
| Product | Derived from category: BIND, Kea, Stork, DHCP |
| CVE IDs | All CVE-\d{4}-\d{4,} matches in <title> + <description>, deduped |
| Published | <pubDate> parsed as RFC 1123Z → Unix seconds |
| Content Hash | SHA1(guid|pubDate|description) |
Storage
No new tables or columns. All tables already exist.
| Table | Rows inserted |
|---|---|
CVEMetadata | One per CVE per advisory; source="isc" |
CVEDescription | One per CVE per advisory; containerType="cna", lang="en" |
CVEMetadataReferences | One per CVE per advisory; type="advisory", referenceSource="isc" |
CVEAffected | One per CVE when product is identifiable; vendor="ISC" |
CVEAlias | For multi-CVE advisories: (cveIDs[0], "isc") → each sibling; conflict = DO NOTHING |
Incremental Strategy
On startup, load all sourceAdvisoryRef values from CVEMetadata where
source='isc' into a map[string]bool. Per advisory: if the URL is in the
set and --all is false, skip. After successful processing, add the URL to
the in-memory set.
Flags
| Flag | Default | Description |
|---|---|---|
--all | false | Reprocess all advisories, not just new ones |
--limit | 0 | Maximum advisories to process per run (0 = unlimited) |
ECS Schedule
Runs every 6 hours (cron(0 */6 * * ? *)).
Key Files
| File | Purpose |
|---|---|
cmd/isc-rss-processor/main.go | Main processor |
internal/isc/types.go | RSS feed and advisory Go structs |
internal/isc/parser.go | Feed parsing, CVE extraction, product detection |
internal/isc/mapper.go | Advisory → CVESourceData mapping |
schemas/isc_rss_advisory.schema.json | JSON Schema Draft 7 for parsed advisory object |
S3 Persistence
Not used. This processor does not currently archive payloads or quarantine failures to S3. Per the S3 Persistence Contract this is non-compliant — see the compliance matrix for the implementation roadmap.
Expected paths when implemented:
- Archive:
isc/files/{sha256}/{filename} - Quarantine:
failed-feeds/isc-processor/{YYYY-MM-DD}/{reason}/{filename} - Likely reasons:
parse-error