Introduction

What are drools?

Our rules engine provides a powerful tool to help customize your application to your needs. This article will be a one-stop guide to everything drools related to allow you the ability to efficiently self-serve.

What is a rule?

Rules are pieces of knowledge often expresses as "When certain conditions occur, then do some tasks".

These take the following format.

rule <rule_name>
    <attribute> <value>

    When
        <Condition is True>
    Then 
        <Take desired Action>
end

The official Drools documentation recommends avoiding the use of getters inside the when block.

"We recommend using property access (age) over using getters explicitly (getAge()) because of performance enhancements through field indexing."

Writing drools

First, a word of warning.

Alt text: WARNING: The correct functioning of custom Drools code introduced here is the responsibility of the author. Custom code will be ignored by IriusRisk''s migration system, which could lead to errors after upgrading your IriusRisk instance.

Modules

The first step to writing great drools is to start with understanding the modules we place the drools inside. These are more than just names to group rules by as there is Hidden rules logic which depend on correct placement of the drool to obtain the behavior you expect.

We advise beginners to first create a rule inside the rules editor. This is available at Rules > Rules Editor.

A comprehensive guide on the conditions/actions outlined in this are available here. Rules Explanation

From here, we can modify the rule to meet our custom needs inside the drools engine with logic not available inside the rules editor. Simply navigate to Drools & find the rule you created, paying close attention to the module it is in.

More advanced users can create drools from scratch.

Drools	Rules Editor / Workflow Rules	Notes
`common`	-	Included in all the modules.
`main`	`Main`
`component`	`Component`
`threatComponent`	`Threat (Component conditions)`
`threatDataflow`	`Threat (Dataflow conditions)`
`workflow`	`Workflow`
`dataflow`	`Data Flow`

Packages

Below are the following packages that we can make use of when creating custom drools.

Irius Core:

our domain packages to create Drools

package com.iriusrisk.drools;

com.iriusrisk.drools.*
com.iriusrisk.factories.*
com.iriusrisk.utils.*
com.iriusrisk.model.*
com.iriusrisk.common.*
com.iriusrisk.AccessType.*

Main

This takes knowledge from the project level and produces the actions to create components, import templates etc.

ProjectFact

Getters:

Modifier and Type	Method
`java.lang.String`	`getDesc()`
`java.lang.Long`	`getId()`
`java.lang.String`	`getName()`
`java.lang.String`	`getUniqueId()`
`boolean`	`isTemplate()`
`boolean`	`isStandard()`

ProjectCustomFieldFact

Getters:

Modifier and Type	Method
`java.lang.String`	`getUniqueId()`
`UDTType.UDTTypeName`	`getType()`
`java.lang.String`	`getValue()`
`boolean`	`hasValue(java.lang.String operator, java.lang.String value)`

Modifiers:

modify($customFieldVar) {setValue(String value)}

ThreatFact

Getters:

Modifier and Type	Method
`int`	`getAvailabilityRiskRating()`
`java.lang.String`	`getComponentReferenceId()`
`int`	`getConfidentialityRiskRating()`
`java.lang.String`	`getDesc()`
`int`	`getEaseOfExploitationRiskRating()`
`int`	`getEffectiveMitigation()`
`org.joda.time.LocalDateTime`	`getExpiryDate()`
`int`	`getInherentRisk()`
`int`	`getIntegrityRiskRating()`
`java.lang.String`	`getLibraryUniqueId()`
`int`	`getMitigation()`
`java.lang.String`	`getName()`
`int`	`getProjectedRisk()`
`java.lang.String`	`getUniqueId()`
`int`	`getRisk()`
`java.lang.String`	`getSource()`
`java.lang.String`	`getState()`
`java.lang.Long`	`getThreatId()`
`java.lang.String`	`getUseCaseReferenceId()`
`boolean`	`isCalculateRisk()`
`boolean`	`isEditable()`
`boolean`	`isEdited()`

QuestionFact

Getters:

Modifier and Type	Method
`java.lang.String`	`getGroupId()`
`java.lang.String`	`getHint()`
`java.lang.String`	`getId()`
`int`	`getPriority()`
`java.lang.String`	`getText()`
`boolean`	`isAnswer()`
`boolean`	`isAutoPopulated()`
`boolean`	`isCanBeManuallyModified()`
`boolean`	`isDisabled()`
`boolean`	`isEphemeral()`
`boolean`	`isManuallyModified()`
`boolean`	`isModifiedFromUi()`
`boolean`	`isReadOnly()`

Insert:

insertLogical(new QuestionFact(...<<See constructors below>>...));

Constructors
`QuestionFact(int priority, String id, String text, String hint, boolean answer, boolean disabled, boolean readOnly, boolean ephemeral, boolean autoPopulated, boolean manuallyModified, boolean canBeManuallyModified, boolean modifiedFromUi, String groupId)`
`QuestionFact(QuestionGroupFact group, String id, String text, String hint)`
`QuestionFact(String id, boolean answer)`
`QuestionFact(String id, String text, int priority)`
`QuestionFact(String groupId, String id, String text)`
`QuestionFact(String groupId, String id, String text, int priority)`
`QuestionFact(String groupId, String id, String text, String hint)`

Modify:

modify($questionToAnswer) { setAnswer(boolean value) };

QuestionGroupFact

Getters:

Modifier and Type	Method
`java.lang.String`	`getCurrentAnswerId()`
`java.lang.String`	`getDescription()`
`java.lang.String`	`getId()`
`java.lang.String`	`getName()`
`int`	`getPriority()`
`java.lang.String`	`getText()`
`boolean`	`isCanBeAutoPopulated()`
`boolean`	`isDisabled()`
`boolean`	`isHidden()`
`boolean`	`isReadOnly()`
`boolean`	`isRequired()`
`boolean`	`isSingleSelect()`

Insert:

insertLogical(new QuestionGroupFact(<<See constructor>>))

Constructor
`QuestionGroupFact(int priority, String id, String name, String text, String description, String currentAnswerId, boolean disabled, boolean readOnly, boolean singleSelect, boolean required, boolean hidden, boolean canBeAutoPopulated)`
`QuestionGroupFact(String id, int priority)`
`QuestionGroupFact(String id, String currentAnswerId, boolean disabled, boolean readOnly, boolean singleSelect, boolean required, boolean hidden, boolean canBeAutoPopulated)`
`QuestionGroupFact(String id, String name, String text)`
`QuestionGroupFact(String id, String name, String text, int priority)`
`QuestionGroupFact(String id, String name, String text, int priority, Boolean singleSelect, Boolean required, String description)`

Conclusion

Getters:

Modifier and Type	Method
`java.lang.String`	`getComponentReferenceId()`
`java.lang.String`	`getId()`
`java.lang.String`	`getText()`
`com.iriusrisk.drools.model.ConclusionType`	`getType()`
`boolean`	`isVisible()`

Insert:

insertLogical(new Conclusion(ConlusionType type, String String id, String text));

Conclusion Types:

HIDDEN
ERROR
ALERT
WARNING
INFO
ADVICE
POLICY
MANDATORY

UserEvent

Getters:

Modifier and Type	Method
`java.lang.String`	`getType()` → `EVENT_PROJECT_CREATION`

TemplateUniqueId

Insert:

insertLogical(TemplateUniqueId.importTemplate(String String templateUniqueId));

Notification

Insert:

insertLogical(new com.iriusrisk.drools.model.Notification(Notificationtype type, String id, String text));

Notification Types:

ALERT
WARNING
INFO

AssignProjectToBusinessUnitDto

Insert:

insertLogical(new com.iriusrisk.drools.model.project.AssignProjectToBusinessUnitDto(String projectRef, String businessUnitRef));

AssignProjectToUserDto

Insert:

insertLogical(new com.iriusrisk.drools.model.project.AssignProjectToUserDto(String projectRef, String userName));

GenerateReportActionEvent

Insert:

insertLogical(String projectRef, Integer reportTypeValue, String format, String standardId));

standardId must be null except for Compliance report

ImportRiskPatternFactory

Insert:

insertLogical(ImportRiskPatternFactory.importSpecificProjectRisk(String libraryRef, String refPattern, String refUseCase, String refRisk, int priority));

ChangeProjectCountermeasureStateFact

Insert:

insertLogical(ChangeProjectCountermeasureStateFact.createImplementation(String uniqueId, Boolean overrideManualActions));

CreateComponentModel

Insert:

insertLogical(new CreateComponentModel(String componentDefinitionRef, String trustZoneUuid, Boolean isPersistent));

this is the end of the Main module drools documentation

Threat Model

This feeds on knowledge at the components and dataflow level and produces the actions to import risk patterns, apply security standards etc.

ProjectFact

Getters:

Modifier and Type	Method
`java.lang.String`	`getDesc()`
`java.lang.Long`	`getId()`
`java.lang.String`	`getName()`
`java.lang.String`	`getUniqueId()`
`boolean`	`isTemplate()`
`boolean`	`isStandard()`

ProjectCustomFieldFact

Getters:

Modifier and Type	Method
`java.lang.String`	`getUniqueId()`
`UDTType.UDTTypeName`	`getType()`
`java.lang.String`	`getValue()`
`boolean`	`hasValue(java.lang.String operator, java.lang.String value)`

Modifiers:

modify($customFieldVar) {setValue(String value)}

ComponentFact

Getters:

Modifier and Type	Method
`boolean`	`canBeMovedOfTrustzone()`
`java.lang.String`	`getComponentUuid()`
`java.lang.String`	`getComponentReferenceId()`
`java.util.List<java.lang.String>`	`getParentReferenceIds()`

ComponentDefinitionFact

Getters:

Modifier and Type	Method
`java.lang.String`	`getComponentReferenceId()`
`java.lang.String`	`getName()`
`java.lang.String`	`getUniqueId()`
`java.lang.String`	`getComponentCategoryReferenceId()`
`boolean`	`isCategoryOf(String componentCategoryReferenceId)`
`boolean`	`isAParent(java.util.List<String> componentsUniqueIds)`

ComponentQuestionFact

Getters:

Modifier and Type	Method
`java.lang.String`	`getGroupId()`
`java.lang.String`	`getHint()`
`java.lang.String`	`getId()`
`int`	`getPriority()`
`java.lang.String`	`getText()`
`boolean`	`isAnswer()`
`boolean`	`isAutoPopulated()`
`boolean`	`isCanBeManuallyModified()`
`boolean`	`isDisabled()`
`boolean`	`isEphemeral()`
`boolean`	`isManuallyModified()`
`boolean`	`isModifiedFromUi()`
`java.lang.String`	`getComponentReferenceId()`
`boolean`	`isReadOnly()`

Insert:

insertLogical(new ComponentQuestionFact(...<<See constructors below>>...));

Constructors
`ComponentQuestionFact(ComponentQuestionGroupFact group, String id, String text, String hint, String componentReferenceId)`
`ComponentQuestionFact(int priority, String id, String text, String hint, boolean answer, boolean disabled, boolean readOnly, boolean ephemeral, boolean autoPopulated, boolean manuallyModified, boolean canBeManuallyModified, boolean modifiedFromUi, String groupId, String componentReferenceId)`
`ComponentQuestionFact(String componentReferenceId, int priority, String id, java.lang.String text, String hint, boolean answer, boolean disabled, boolean readOnly, boolean ephemeral, boolean autoPopulated, boolean manuallyModified, boolean canBeManuallyModified, boolean modifiedFromUi, String groupId)`
`ComponentQuestionFact(String componentReferenceId, QuestionGroupFact group, String id, String text, String hint)`
`ComponentQuestionFact(String componentReferenceId, String id, boolean answer)`
`ComponentQuestionFact(String questionUniqueId, String componentReferenceId, boolean answer, boolean manuallyModified, boolean canBeManuallyModified, boolean autoPopulated)`
`ComponentQuestionFact(String componentReferenceId, String id, String text, int priority)`

DataFlowFact

Getters:

Modifier and Type	Method
`java.lang.String`	`getComponentSourceReferenceId()`
`java.lang.String`	`getComponentTargetReferenceId()`
`java.lang.String`	`getUniqueId()`

DataFlowAssetFact

Getters:

Modifier and Type	Method
`java.lang.String`	`getDataflowRef()`
`java.lang.String`	`getAssetName()`

TrustZoneFact

Getters:

Modifier and Type	Method
`java.lang.String`	`getComponentReferenceId()`
`java.lang.String`	`getTrustZoneUniqueId()`
`java.lang.String`	`getUuid()`
`boolean`	`isModified()`

SecurityClassificationFact

Getters:

Modifier and Type	Method
`java.lang.String`	`getDataFlowUniqueId()`
`java.lang.String`	`getUniqueId()`

TagFact

Getters:

Modifier and Type	Method
`java.lang.String`	`getDataFlowUniqueId()`
`java.lang.String`	`getTag()`

ExternalQuestionFact

Getters:

Type is always ExternalQuestionFact.SUPPLEMENTAL for main questionnaire questions

Modifier and Type	Method and Description
`QuestionFact`	`getQuestion()`
`java.lang.String`	`getType()`
`boolean`	`isModifiedByRules()`

Modifiers:

modify($questionToAnswer) { setAnswer(boolean value) };

ComponentQuestionGroupFact

Getters:

Modifier and Type	Method
`java.lang.String`	`getCurrentAnswerId()`
`java.lang.String`	`getDescription()`
`java.lang.String`	`getId()`
`java.lang.String`	`getName()`
`int`	`getPriority()`
`java.lang.String`	`getText()`
`boolean`	`isCanBeAutoPopulated()`
`boolean`	`isDisabled()`
`boolean`	`isHidden()`
`boolean`	`isReadOnly()`
`boolean`	`isRequired()`
`boolean`	`isSingleSelect()`
`private java.lang.String`	`getComponentReferenceId()`

Inserters:

insertLogical(new ComponentQuestionGroupFact(<<See constructor>>))

Constructor
`public ComponentQuestionGroupFact(java.lang.String id, java.lang.String name, java.lang.String text, int priority, java.lang.Boolean singleSelect, java.lang.Boolean required, java.lang.String description, java.lang.String componentReferenceId)`

Modifiers:

modify($questionToAnswer) { setAnswer(boolean value) };

Conclusion

Getters:

Modifier and Type	Method
`java.lang.String`	`getComponentReferenceId()`
`java.lang.String`	`getId()`
`java.lang.String`	`getText()`
`com.iriusrisk.drools.model.ConclusionType`	`getType()`
`boolean`	`isVisible()`

Insert:

insertLogical(new Conclusion(ConclusionType type, String id, String text));
insertLogical(new Conclusion(ConclusionType type, String id, String text, String componentReferenceId));

Conclusion Types

HIDDEN
ERROR
ALERT
WARNING
INFO
ADVICE
POLICY
MANDATORY

ImportWholeRiskPatternAwareDto

Getters:

Modifier and Type	Method
`java.lang.String`	`getRiskPatternReferenceId()`
`java.lang.String`	`getLibraryUniqueId()`
`java.lang.String`	`getTargetComponentReferenceId()`

ImportRiskPatternFactory

Inserters:

insertLogical(ImportRiskPatternFactory.importRiskPattern(String targetComponentRef, String libraryRef, String riskPatternRef, int priority));

insertLogical(ImportRiskPatternFactory.importRiskPatternInOrigin(String libraryRef, String productRef, String riskPatternRef, String targetRef, int priority, String dataFlowRef));

insertLogical(ImportRiskPatternFactory.importRiskPatternInDestination(String libraryRef, String productRef, String riskPatternRef, String targetRef, int priority, String dataFlowRef));

insertLogical(ImportRiskPatternFactory.importSpecificRisk(String targetComponentRef, String libraryRef, String refPattern, String refUseCase, String refRisk, int priority));

insertLogical(ImportRiskPatternFactory.importSpecificUseCase(String targetComponentRef, String libraryRef, String refPattern, String refUseCase, int priority));

ChangeComponentCountermeasureStateFact

Inserters:

insertLogical(ChangeComponentCountermeasureStateFact.createRequirement(String componentReferenceId, String countermeasureUniqueId, Boolean overrideManualActions));

insertLogical(ChangeComponentCountermeasureStateFact.createImplementation(String componentReferenceId, String countermeasureUniqueId, Boolean overrideManualActions));

insertLogical(ChangeComponentCountermeasureStateFact.createImplementation(String countermeasureUniqueId, Boolean overrideManualActions)); // for general product threats

ComponentNotification

Inserters:

insertLogical(new com.iriusrisk.drools.model.ComponentNotification(NotificationType type, String id, String text, String componentRef));

Notification Types

ALERT
WARNING
INFO

RiskMitigationModifier

Inserters:

insertLogical(RiskMitigationModifier.setMitigationValue(String targetComponentRef, String libraryRef, String riskPatternRef, String threatRef, String conuntermeasureRef, String mitigation"));

SecurityStandard

Inserters:

insertLogical(new SecurityStandard(String targetComponentRef, String standardName, String standardRef, boolean overrideCountermeasureManualActions));

Highly recommended to properly notify this action including also this two actions:

insertLogical(new ComponentNotification(NotificationType.INFO, "apply.standard." + standardName, "apply.standard.msg," + standardName, targetComponentRef, true));
insertLogical(new Conclusion(ConclusionType.POLICY, "id-" + standardName, "security.standard.will.apply", targetComponentRef, standardName));

this is the end of the Threat model drools documentation

Threat

This feeds on the same facts as the threat model session plus the threat & countermeasures resulting from the threat model session actions.

ThreatCustomFieldFact

Getters:

Modifier and Type	Method
`UDTType.UDTTypeName`	`getType()`
`java.lang.String`	`getUniqueId()`
`java.lang.String`	`getValue()`
`boolean`	`hasValue(java.lang.String operator, java.lang.String value)`
`java.lang.String`	`getComponentReferenceId()`
`java.lang.Long`	`getThreatId()`
`java.lang.String`	`getThreatUniqueId()`
`java.lang.String`	`getUseCaseReferenceId()`

Modifiers:

modify($customFieldVar) {setValue(String value)};

CountermeasureCustomFieldFact

Getters:

Modifier and Type	Method
`UDTType.UDTTypeName`	`getType()`
`java.lang.String`	`getUniqueId()`
`java.lang.String`	`getValue()`
`boolean`	`hasValue(java.lang.String operator, java.lang.String value)`
`java.lang.String`	`getComponentReferenceId()`
`java.lang.Long`	`getCountermeasureId()`
`java.lang.String`	`getCountermeasureUniqueId()`

Modifiers:

modify($customFieldVar) {setValue(String value)};

ThreatFact

Getters:

Modifier and Type	Method and Description
`int`	`getAvailabilityRiskRating()`
`java.lang.String`	`getComponentReferenceId()`
`int`	`getConfidentialityRiskRating()`
`java.lang.String`	`getDesc()`
`int`	`getEaseOfExploitationRiskRating()`
`int`	`getEffectiveMitigation()`
`org.joda.time.LocalDateTime`	`getExpiryDate()`
`int`	`getInherentRisk()`
`int`	`getIntegrityRiskRating()`
`java.lang.String`	`getLibraryUniqueId()`
`int`	`getMitigation()`
`java.lang.String`	`getName()`
`int`	`getProjectedRisk()`
`java.lang.String`	`getUniqueId()`
`int`	`getRisk()`
`java.lang.String`	`getSource()`
`java.lang.String`	`getState()`
`java.lang.Long`	`getThreatId()`
`java.lang.String`	`getUseCaseReferenceId()`
`boolean`	`isCalculateRisk()`
`boolean`	`isEditable()`
`boolean`	`isEdited()`

CountermeasureFact

Getters:

Modifier and Type	Method and Description
`java.lang.String`	`getComponentReferenceId()`
`java.lang.String`	`getCountermeasureState()`
`java.lang.String`	`getUniqueId()`
`void`	`changeState()`
`boolean`	`isEdited()`
`boolean`	`isFromRules()`
`boolean`	`isModifiedByRules()`
`boolean`	`isRequired()`

Modifiers:

modify($countermeasureVar) {changeState(String state**, String reason, boolean overrideManualActions)};

** The state parameter is case-sensitive and must be indicated as how the state is displayed in the UI selector for countermeasure state.

ThreatCountermeasureFact

Getters:

Modifier and Type	Method
`java.lang.String`	`getComponentReferenceId()`
`java.lang.Long`	`getCountermeasureId()`
`java.lang.String`	`getCountermeasureUniqueId()`
`java.lang.Integer`	`getMitigationValue()`
`java.lang.Long`	`getThreatId()`
`java.lang.String`	`getThreatUniqueId()`
`java.lang.String`	`getUseCaseReferenceId()`
`boolean`	`isCountermeasureFromRules()`
`boolean`	`isModifiedByRules()`
`boolean`	`isThreatEdited()`
`boolean`	`isThreatFromRules()`

Modifiers:

modify($threatCountermeasureVar) {setMitigationValue(Integer value), setModifiedByRules(true)};

This is now the end of the Threat section