# AGENTS
## Role
Implement the CISA ICS advisory connector to ingest US CISA Industrial Control Systems advisories (distinct from the general CERT feed).

## Scope
- Locate the official CISA ICS advisory feed/API (currently HTML/RSS) and define fetch cadence/windowing.
- Build fetch/cursor pipeline with retry/backoff and raw document storage.
- Parse advisory content for summary, impacted vendors/products, mitigation, CVEs.
- Map advisories into canonical `Advisory` records with aliases, references, affected ICS packages, and range primitives.
- Provide deterministic fixtures and automated regression tests.

## Participants
- `Source.Common` (HTTP/fetch utilities, DTO storage).
- `Storage.Mongo` (raw/document/DTO/advisory stores + source state).
- `Feedser.Models` (canonical advisory structures).
- `Feedser.Testing` (integration fixtures and snapshots).

## Interfaces & Contracts
- Job kinds: `ics-cisa:fetch`, `ics-cisa:parse`, `ics-cisa:map`.
- Persist upstream caching metadata (ETag/Last-Modified) when available.
- Alias set should include CISA ICS advisory IDs and referenced CVE IDs.

## In/Out of scope
In scope:
- ICS-specific advisories from CISA.
- Range primitives capturing vendor/equipment metadata.

Out of scope:
- General CISA alerts (covered elsewhere).

## Observability & Security Expectations
- Log fetch attempts, advisory counts, and mapping results.
- Sanitize HTML, removing scripts/styles before persistence.
- Honour upstream rate limits with exponential backoff.

## Tests
- Add `StellaOps.Feedser.Source.Ics.Cisa.Tests` to cover fetch/parse/map with canned fixtures.
- Snapshot canonical advisories; support fixture regeneration via env flag.
- Ensure deterministic ordering/time normalisation.
