Policy Management: Add Known Exploited Vulnerabilities feed and allow as a condition for Vulnerability ID rules

[setchy]

Current Behavior

Currently, we use a custom policy rule with a very long list of conditions to check for Vulnerability ID that are listed within a Known Exploited Vulnerabilities catalog (CISA or VulnCheck).

Maintaining this policy is time consuming due to its verbosity.

Proposed Behavior

Enhance the Policy Management feature to allow a simple rule configuration which would effectively check if the Vulnerability ID is found within a KEV catalog (CISA or VulnCheck)

Checklist

• [X] I have read and understand the contributing guidelines
• [X] I have checked the existing issues for whether this enhancement was already requested

[setchy]

ie: a more natural solution than this current workaround

[nscuro]

Thanks for the suggestion @setchy! I feel this might be a duplicate of https://github.com/DependencyTrack/dependency-track/issues/2267. Would you mind checking if that issue captures what you're asking for?

[setchy]

Thanks @nscuro :)

I was familiar with #2267, and although both relate to CISA KEV, i felt they had these differences

• my suggestion is to enhance the Policy Management conditions to leverage the KEV dataset (could also be extended to other public datasets)

• 2267 seemed more about enriching the vulnerability data for each dtrack project

What is your thoughts?

[nscuro]

Makes sense.

Although #2267 also mentions policies:

Once the data is included, I would request a policy to identify vulnerabilities outside of the KEV remediation timeline.

But yeah, overall it seems to me that #2267 is asking for a more "complete" integration with KEV, so perhaps a superset of this issue.

Leaving this enhancement request open then. Thanks again for raising it.

[setchy]

Thanks @nscuro. Essentially, making this a policy option

[setchy]

Updated the initial description to generalize the request (CISA or VulnCheck KEV catalogs)

[patrickmgarrity]

Details on how to implement VulnCheck KEV are here: https://docs.vulncheck.com/community/vulncheck-kev/introduction

Let me know if you have any questions or need help in doing so.