Nozomi Networks PSIRT RSS Processor — Design
Overview
Fetches Nozomi Networks PSIRT security advisories from the public RSS 2.0 feed
(https://security.nozominetworks.com/rss.xml) and creates first-class CVEMetadata
rows (source=nozomi) for every advisory. The feed contains ICS/OT security
bulletins for Nozomi Networks products (Guardian, CMC, Arc, Vantage, N2OS).
Feed
| Property | Value |
|---|---|
| URL | https://security.nozominetworks.com/rss.xml |
| Auth | None — fully public |
| Format | RSS 2.0 with dc, content, atom namespaces |
| Items | ~20–50 advisories |
| Generator | NozomiNetworksRSS |
Parsing
| Field | Source |
|---|---|
| Advisory ID | <title> (e.g. NN-2025:16-01) — validated against ^NN-\d{4}:\d+-\d+$ |
| Advisory URL | <link> (e.g. https://security.nozominetworks.com/NN-2025:16-01) |
| Description | <description> CDATA text |
| Product | Best-effort extraction from description: Guardian, CMC, Arc, Vantage, N2OS |
| Published | <pubDate> parsed as RFC 2822 → Unix seconds |
| Content Hash | SHA1 of `title |
Storage
No new tables or columns. All tables already exist.
| Table | Rows inserted |
|---|---|
CVEMetadata | One per advisory; source="nozomi", cveId = advisory ID (e.g. NN-2025:16-01) |
CVEDescription | One per advisory; containerType="nozomi", lang="en" |
CVEMetadataReferences | One per advisory; type="advisory", referenceSource="nozomi" |
CVEAffected | One per advisory (when product is detected); vendor="Nozomi Networks" |
Incremental Strategy
On startup, load all sourceAdvisoryRef values from CVEMetadata where source='nozomi'
into a map[string]bool. Per advisory: if the advisory ID is in the set and --force is
false, skip. After successful processing, add the advisory ID to the in-memory set.
Flags
| Flag | Default | Description |
|---|---|---|
--force | false | Reprocess all advisories, not just new ones |
--limit | 0 | Maximum advisories to process per run (0 = unlimited) |
ECS Schedule
Runs weekly on Mondays at 07:00 UTC (cron(0 7 ? * MON *)).
Key Files
| File | Purpose |
|---|---|
cmd/nozomi-rss-processor/main.go | Main processor |
internal/nozomi/types.go | RSS XML structs and Advisory type |
internal/nozomi/parser.go | Feed parsing and product extraction |
internal/nozomi/mapper.go | Advisory → CVESourceData mapping |
schemas/nozomi_rss_advisory.schema.json | JSON Schema Draft 7 for parsed advisory object |
S3 Persistence
Not used. This processor does not currently archive payloads or quarantine failures to S3. Per the S3 Persistence Contract this is non-compliant — see the compliance matrix for the implementation roadmap.
Expected paths when implemented:
- Archive:
nozomi/files/{sha256}/{filename} - Quarantine:
failed-feeds/nozomi-rss-processor/{YYYY-MM-DD}/{reason}/{filename} - Likely reasons:
parse-error