The Rules subsystem within IriusRisk is the heavy lifter when calculating threats and risks. It processes the data entered into a threat model, including the diagram, data flows, trust models and so on. By examining the data, it is able to calculate overall risk, mitigate various threats, introduce new risks, and so on.
The Rules engine is based on the business rules management system (BRMS) Drools, largely developed by IBM and Red Hat, but now a part of Apache Kie. (See https://drools.org/). IriusRisk has provided a powerful user interface to aid custom rules development, which is found by navigating to the Rules page.
As can be seen from the Rules landing page, IriusRisk contains thousands of rules, each performing important actions when processing a threat model. To create your own rule, click on Create rule, showing you a page for entering the rule details.
Begin by naming the rule, and storing it in an appropriate place. By default, the rule is stored in the global space, but it is recommended that you store it in a custom library. It is often advisable to have a dedicated library for a specific set of rules–for instance, a set of rules creating and responding to a questionnaire might best be stored in a single library for that purpose.
Next, choose the rule's "context"--whether the rule should run using data associated with a project as a whole, for instance, or with component, threat or data flow data instead. Each context brings with it specific data and actions that can be performed.
Having chosen a context, you can select one or more conditions indicating when the rule should be triggered. For instance, you can specify that a rule only be triggered on project creation, or in fact should run every time rules are run. Selecting multiple conditions "ands" them together–all the conditions would have to be true for the rule to trigger.
To enable greater flexibility in our rules engine when creating a rule, once the rule context has been selected and a second condition has been added, the user will have the option to choose whether the rule triggers when all conditions are met (AND operator) or when any condition is met (OR operator). There are conditions that allow users to add specific actions, so these will not be available for Match any.
The conditions that support these actions are:
Next, choose the action to take if the conditions are matched. You can notify a user of something, for instance, or automatically mark a countermeasure as implemented.
The rules subsystem is a large and complex topic. There are several articles in the IriusRisk documentation exploring various ways they can be leveraged.
