Operate advisory feeds

Development configuration

The supplied stack follows Debian. The repository demonstrates another supported feed selection as:

SEAGULL_ADVISORY_FEEDS=Alpine make up

This starts the full development stack, including the importer. Feed names and export URLs are configuration; do not allow untrusted callers to redefine where the importer fetches intelligence. It is the process with outbound internet access.

Inspect freshness

From the backend checkout and its development database:

docker compose -f deploy/compose.yaml exec clickhouse clickhouse-client --user seagull -d seagull -q   "SELECT feed, argMax(outcome, checked_at), argMax(synced_at, checked_at), argMax(held, checked_at)
   FROM vulnerability_feed_syncs GROUP BY feed"

This is the repository's supplied operator query, using its development user/database names. Adapt credentials through your deployment's authorized access method; never embed production passwords in a command example.

Interpret failed attempts

A recent check with an old successful synchronization means the platform tried but did not obtain a complete feed. The previous successful time must not be replaced by the failed attempt. Also inspect how recent the feed's own newest listed data is; a successfully copied stale source is still stale intelligence.

Recovery

Read importer and writer logs separately. Fetch/translation failures belong to the importer; broker or projection failures belong to their respective boundary. The compacted log supports importer recovery and the writer keeps advisory versions. An advisory missing from an index is not automatically withdrawn.

No asset vulnerability results will appear merely because these tables are populated. Matching is still planned; see vulnerability intelligence.

Source evidence

Reviewed against the source baseline. Seagull-backend-v2/README.md · Seagull-backend-v2/cmd/advisory-importer/config.go · Seagull-backend-v2/internal/advisoryfeed/importer.go.