Write and test policies

The panel on the right holds Policy Name, Enabled, Scope, Priority, and Description.

Each rule has a Rule Name, Violation Message, and Violation Severity (0.0 to 10.0), and one or more statements added with Add Statement. A statement compares a property (for example vulnerability.severity) with a value. A rule matches when all its statements are true; Add Rule adds another rule to the same policy.

Preview shows the violations the policy would produce without saving it. Save a copy saves it under a new policy.

Convert to Rego policy turns the policy into Rego and can't be undone. To keep the Visual Builder version, select Save a copy first.

Rego is the policy language of Open Policy Agent. Use it for logic the Visual Builder can't express, or to set a violation's action. A Rego policy is plain text, so a copy can be kept in version control.

Policies receive input data with component properties (id, name, version, type, packageUrl in PURL format, a licenses array, an internal flag) and vulnerability properties (severity as a 0-10 CVSS score, vendorId as the advisory identifier such as a CVE, epss, and the vex analysis). The example below skips the four VEX states that mean no action is needed: not_affected, false_positive, resolved, and resolved_with_pedigree. The other two states, exploitable and in_triage, still produce a violation.

This policy flags libraries with high-severity, high-EPSS vulnerabilities that have no VEX resolution:

package observer

import future.keywords.in

violation[v] {
	input.component.type == "library"

	some vulnerability in input.vulnerabilities
	vulnerability.severity > 7
	vulnerability.epss > 0.5

	# Exclude VEX-resolved vulnerabilities
	not vulnerability.vex.state == "not_affected"
	not vulnerability.vex.state == "false_positive"
	not vulnerability.vex.state == "resolved"
	not vulnerability.vex.state == "resolved_with_pedigree"

	v := {
		"severity": vulnerability.severity,
		"message": sprintf(
			"%s with severity>7 (%v) and EPSS>0.5 (%0.2f) is not tolerated",
			[
				vulnerability.vendorId,
				vulnerability.severity,
				vulnerability.epss,
			],
		),
	}
}

Test it in the Rego Playground: paste the policy, paste the sample input below, and select Evaluate.

A JavaScript policy receives the same input as a Rego policy. Define a Policy function that takes { component, vulnerabilities, namespace } and returns an array of violations, or null when there are none.

This policy flags components with vulnerabilities above a severity threshold:

function Policy({ component, vulnerabilities }) {
  const SEVERITY_THRESHOLD = 7;

  if (vulnerabilities && vulnerabilities.length > 0) {
    return vulnerabilities
      .filter((vulnerability) => vulnerability.severity > SEVERITY_THRESHOLD)
      .map((vulnerability) => ({
        severity: vulnerability.severity,
        message: `${component.name} has a high-severity vulnerability (ID: ${vulnerability.vendorId}, Severity: ${vulnerability.severity}). `,
      }));
  }

  return null;
}