Add exposure_factor field to the ProductItemPurpose model #102

[tdruez]

#102

The weighted_risk_score risk factor is updated when:

• A ProductPackage is added/edited
• A ProductItemPurpose is updated
• Using fetchvulnerabilities management command
• New/updated Vulnerability affecting a package (risk_score is changed)

[tdruez]

@DennisClark The new weighted_risk_score field and logic have been implemented.

Now, I had to rework the Vulnerabilities tab putting the packages as the first column to make sense of the new computed risk value since that value applies to a ProductPackage.

Looking from a Vulnerability records perspective does not make sense if we want to promote the aggregate risk value that lives at the ProductPackage level.

Anyway, the code is not very stable yet but your input is needed at this stage.

[DennisClark]

@tdruez Testing in progress. The enhancements to the Product item purposes are good, except that when I updated the Core entry in Staging Starship it took a really long time (sorry I did not time it, since it happened kind of unexpectedly), possibly as much as 10 minutes, to complete, and it looked like the application was hung. I assume that it was updating the 2352 product package relationships in that dataspace. Anyway, it completed OK, but we might want some kind of message to the user before starting the updates.

[DennisClark]

@tdruez The risk weighted by the exposure factor of the product item purpose appears to be working fine in Cargo Manager 2.9.5 of Staging Starship. I updated a number of Purpose fields (they were all defaulted to Core at first) and the impact on the vulnerabilities tab worked just fine; in fact, it reduced the risk below the threshold (as it should) and I needed to toggle to all of the vulnerabilities to see the recalculated ones that were significantly lowered.

I appreciate the UI showing the base risk on the vulnerability and the weighted risk right next to it; that makes a lot of sense.

Since there is a lot of empty space in the Package fields of the Vulnerabilities tab, perhaps we could show the Purpose as a colored label in that field? That would be a rather nice bit of info to help the analyst reviewing the vulnerabilities.

[DennisClark]

Hi @tdruez As long as you are working on the Vulnerabilities tab, perhaps you can think about a way to address a not-so-good side effect of the risk threshold feature. If all of the vulnerabilities associated with the product are below the threshold it disables the Vulnerabilities tab, and the only way to activate it is to edit the Product risk threshold to a value low enough to see the hidden ones and save that change. So not really a bug, but a usability issue. Perhaps it would be better to keep the Vulnerabilities tab enabled and maybe put a 0 (zero) in the tab label. Please think about a good way to handle this, thanks.

[tdruez]

@DennisClark

The enhancements to the Product item purposes are good, except that
when I updated the Core entry in Staging Starship it took a really long time

The code was not yet optimize and each weighted_risk_score was computed and saved one by one.
I have converted the logic into a SQL UPDATE statement, where everything is computed and updated directly at the database level.
This should now be quite fast.

Since there is a lot of empty space in the Package fields of the Vulnerabilities tab, perhaps we could
show the Purpose as a colored label in that field?

I've added a few values in that area: the purpose, the exposure factor, and the "is deployed" value.
That should help to provide some extra context while looking at vulnerabilties.

Perhaps it would be better to keep the Vulnerabilities tab enabled.

The vulnerabilies tab will now stay enabled in case the threshold return 0 vulnerabilities.
The tab stay disabled in case no vulnerabilities are affecting the product at all, regardless of the risk threshold.

---

Couple extra changes:

• Added the vulnerability icon in Product list view. A "Is Vulnerable" filter is also available.
• The count in the Vulnerability tab was improve to include the count of affected packages and the count of unique vulnerabilities.
  Note that those count reflect the current risk threshold.

[DennisClark]

@tdruez Everything working fine as you described. The new fields on the package field are very nice additions, thanks. No problems found. Unless you are planning even more enhancements, this feature is ready I think!