MSRC Security Updates – Connector Notes

API endpoints

Vulnerability summaries – GET https://api.msrc.microsoft.com/sug/v2.0/<locale>/vulnerabilities (requires api-version=2024-08-01, client credential bearer token).
Vulnerability detail – GET https://api.msrc.microsoft.com/sug/v2.0/<locale>/vulnerability/{id} (same headers/scopes).
CVRF package – the detail payload contains cvrfUrl pointing to a ZIP/JSON asset that is stable per revision. We surface the URL as a reference and capture it in metadata for future offline bundling.

Connector keeps a lastModifiedCursor and replays the previous 10 minutes on every fetch to cover late revisions.
MSRC limits requests to ~60/minute; requestDelay defaults to 250 ms and is configurable.

Uses Azure AD client credential flow against https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token with scope api://api.msrc.microsoft.com/.default.
Token refresh happens lazily and is cached until 60 seconds before expiry.
Configuration values (tenantId, clientId, clientSecret) must be supplied via feedser:sources:vndr:msrc.

Detail payload is persisted with the cvrfUrl in metadata (msrc.cvrfUrl).
Mapping stage emits the CVRF link as a reference so offline runs can fetch it later. When DownloadCvrf is enabled the connector also saves the ZIP artefact to the documents store (marked as msrc.cvrf=true) for Offline Kit staging.