[cravex2-reachability] Implement rule tools triaging vulnerabilities

[tdruez]

Issues

• cravex2-reachability: Implement rule tools triaging vulnerabilities #364
• cravex2-reachability: Integrate triage rules in CRAVEX UI and API #365

Vulnerability Triage Engine

• Rules engine that evaluates configurable triage rules against a product's vulnerabilities and recommends a remediation action
• Seven built-in rules covering risk score, weighted risk score, known exploits, reachability, unresolved analysis, staleness, and dev-only packages
• Triage rulesets combine one or more rules with a single recommended action (upgrade, apply patch, notify, etc.) and a precedence used to resolve conflicts when several rulesets match the same vulnerability
• Per-product ruleset assignment so each product only evaluates the rulesets relevant to it
• Analysis presets let a ruleset automatically apply default vulnerability analysis values (state, justification, responses, detail) to the vulnerabilities it matches, without ever overwriting an analysis a user has already set
• Automatic re-evaluation triggered whenever a vulnerability analysis or a product's packages change
• Automatic Request creation for each new match, when a ruleset is configured with a request template
• Management commands to seed reference rulesets in a dataspace and to manually re-evaluate a dataspace
• Background task support for bulk imports and scheduled full-dataspace evaluation
• Redesigned product vulnerabilities tab showing the recommended action, matched rules, and current analysis for each vulnerability, with a filter to narrow the table down to a given recommended action

Usage

1. Create triage rulesets

Triage rulesets are managed from the admin. Each ruleset combines one or more rules with their parameters, a recommended action, and a precedence. Optionally, a ruleset can be linked to an analysis preset (to auto-apply default analysis values) and/or a request template (to auto-open a Request for each match).

A set of reference rulesets and presets can also be seeded into a dataspace:

./manage.py create_triage_rulesets <dataspace>

2. Assign rulesets to a product

From the product vulnerabilities tab, open Manage triage rules and select which of the dataspace's rulesets should be evaluated for this product.

3. Evaluation

Once assigned, a product's rulesets are re-evaluated automatically whenever a vulnerability analysis is added, changed, or removed, or whenever a package is added to or removed from the product. Evaluation can also be run on demand for an entire dataspace with the evaluate_triage management command.

4. Reviewing recommendations

The product vulnerabilities tab shows, for each vulnerability, the recommended action from the highest-precedence matching ruleset, the rules that triggered it, and the current analysis (including whether it was auto-applied by a preset). The table can be filtered down to a given recommended action.

5. Automatic requests

When a ruleset has a request template configured, a DejaCode Request is automatically opened for each newly detected match, using the template's creator as requester.

Available rules

Rule	Description
Risk Score	Vulnerabilities at or above a configured risk score
Weighted Risk	Vulnerabilities affecting a package whose weighted risk score in the product meets a threshold
Exploited Vulnerability	Vulnerabilities with a known active exploit
Reachable Vulnerability	Vulnerabilities confirmed as reachable in the product context
Unresolved Vulnerability	Vulnerabilities affecting the product where at least one package has no completed analysis
Stale Vulnerability	Vulnerabilities above a risk threshold left unaddressed beyond a configured number of days
Dev-Only Vulnerable Package	Vulnerabilities affecting only non-deployed packages in the product

A ruleset can combine any number of these rules; a vulnerability matches the ruleset as soon as one of its active rules matches.

Reference analysis presets

The create_triage_rulesets command seeds the following presets, each linked to a matching reference ruleset:

Preset	Analysis state	Description
Auto-Close - Dev Only	Not affected	Automatically closes vulnerabilities that affect only non-deployed packages
Flag - Active Exploit	In triage	Flags vulnerabilities with a known active exploit for immediate human review
Flag - Stale Vulnerability	In triage	Flags high-risk vulnerabilities left unaddressed beyond the configured threshold