Business rules

Introduction to business rules¶

Business rules are a general purpose tool for performing actions on datasets based on an event, e.g. setting an attribute's value or running a script. The goal of business rules is to automate as many tasks within the system as possible, saving time on repetitive maintenance and reducing human error.

Administration > Rules > Business Rules will take you to the Manage Business Rules page, which displays a list view of all existing business rules.

Table 1: List view contents

Create a new rule¶

Procedure

1. Navigate to Administration > Rules > Business Rules
2. Click the Create Rule button
3. Fill in the following and click Create:

Table 2: New rule properties

Events¶

The events field allows you to specify an event that will run a business rule.

Table 3: Event options

Conditions¶

Conditions allow you specify additional requirements beyond an event that will determine whether a rule is run.

Table 4. Condition interface

Actions¶

Actions are what will be performed when the event and conditions are met. Actions run in the order in which they appear on the list of actions, and can be dragged and dropped to change their order.

Table 5: Action options

Edit/delete a rule¶

Existing rules can be edited or deleted by clicking the Actions button that appears to the right on mouseover of the entry on the list view.

TUTORIAL: Close vulnerabilities on decommissioned hosts¶

A host may be decommissioned while it still has vulnerabilities associated with it. Rather than letting the orphaned vulnerabilities sit in your Brinqa application forever, it's possible to close them using a business rule. This tutorial will cover how to create a business rule that moves vulnerabilities to closed status when their host's status is set to "retired".

This tutorial requires your host data model to have an attribute "Status" which is mapped to a data source that provides host status data (e.g. Rapid7 Nexpose).

Procedure

1. Navigate to Administration > Rules > Business Rules
2. Click the Create Rule button
3. Enter "Retired Host Handler" for the Title
4. (Optional) Enter a Description like "Closes all associated vulnerabilities when a host is retired."
5. Select "Host" as the Data Model. Host is selected instead of vulnerability because the event that should run the rule occurs on host datasets.
6. Enter "1" as the Order, unless other business rules on hosts take precendence.
7. Select "After Update" for the Event. This will cause the rule to run after a host is updated.
8. Set the Condition to "Status Equals to Retired", replacing "Retired" with whatever wording your scanner uses for deactivated hosts. This will cause the rule to run only after a host's status is updated specifically to that deactivated state.
9. Click Add Action
10. Select "Run script" as the Action. Because the rule references the host data model, vulnerability status must be set with a script rather than via the "Set attribute" action.
11. Enter the following into the script field and click Create:

    def closed = "Closed"
    
    //Close all vulnerabilities
    current.vulnerabilities?.each { vuln ->
        if (vuln && vuln.status != closed) {
            vuln.status = closed
        }
    
    } 
    

12. Using the Accessible from field, choose whether this rule should be available to all your Brinqa applications or only the application you are currently administrating.
13. Click Create