The Rules subsystem within IriusRisk is the heavy lifter when calculating threats and risks. It processes the data entered into a threat model, including the diagram, data flows, trust models and so on. By examining the data, it is able to calculate overall risk, mitigate various threats, introduce new risks, and so on.
The Rules engine is based on the business rules management system (BRMS) Drools, largely developed by IBM and Red Hat, but now a part of Apache Kie. (See https://drools.org/). IriusRisk has provided a powerful user interface to aid custom rules development, which is found by navigating to the Rules page.
As can be seen from the Rules landing page, IriusRisk contains thousands of rules, each performing important actions when processing a threat model. To create your own rule, click on Create rule, showing you a page for entering the rule details.
Begin by naming the rule, and storing it in an appropriate place. By default, the rule is stored in the global space, but it is recommended that you store it in a custom library. It is often advisable to have a dedicated library for a specific set of rules–for instance, a set of rules creating and responding to a questionnaire might best be stored in a single library for that purpose.
Next, choose the rule's "context"--whether the rule should run using data associated with a project as a whole, for instance, or with component, threat or data flow data instead. Each context brings with it specific data and actions that can be performed.
Having chosen a context, you can select one or more conditions indicating when the rule should be triggered. For instance, you can specify that a rule only be triggered on project creation, or in fact should run every time rules are run. Selecting multiple conditions "ands" them together–all the conditions would have to be true for the rule to trigger.
Next, choose the action to take if the conditions are matched. You can notify a user of something, for instance, or automatically mark a countermeasure as implemented.
The rules subsystem is a large and complex topic. There are several articles in the IriusRisk documentation exploring various ways they can be leveraged.
