cravex2-reachability: Integrate triage rules in CRAVEX UI and API

[pombredanne]

Updated UI and API code for rules/policies in DejaCode CRAVEX

[tdruez]

UI implemented in:

• [cravex2-reachability] Implement rule tools triaging vulnerabilities #560

REST API implemented in:

• [cravex2-reachability] Integrate triage rules in CRAVEX API #365 #564

---

Vulnerability Triage REST API

• Triage recommendations endpoint exposing a product's active recommendations, one entry per vulnerability
• Full CRUD API for triage rulesets and analysis presets
• Ruleset assignment endpoint to list, assign, and unassign a product's triage rulesets, with parity to the existing "Manage triage rules" panel
• Enriched vulnerability analysis endpoint exposing preset attribution and user authorship, with a filter to separate auto-triaged analyses from user-reviewed ones

Usage

1. List a product's active triage recommendations

GET /api/v2/products/{uuid}/triage_records/

Returns one entry per vulnerability, from the highest-precedence ruleset currently assigned to the product:

[
 {
 "advisory_id": "CVE-2024-1234",
 "ruleset": "Active Exploit",
 "recommended_action": "upgrade",
 "matched_rules": ["exploited_vulnerability"],
 "request": null,
 "detected_date": "2026-08-01T10:00:00Z",
 "last_checked": "2026-08-18T09:00:00Z"
 }
]

2. Manage triage rulesets and analysis presets

Standard list/create/retrieve/update/delete endpoints:

/api/v2/triage_rulesets/
/api/v2/analysis_presets/

3. Assign or unassign a ruleset on a product

GET /api/v2/products/{uuid}/manage_triage_rulesets/

Lists every enabled ruleset in the product's dataspace, flagged with whether it's currently assigned:

[
 {"uuid": "...", "name": "Active Exploit", "recommended_action": "upgrade", "precedence": 600, "assigned": true},
 {"uuid": "...", "name": "Stale Vulnerability", "recommended_action": "apply_patch", "precedence": 300, "assigned": false}
]

POST /api/v2/products/{uuid}/manage_triage_rulesets/
Body: {"ruleset": "<uuid>", "assigned": true}

Assigns or unassigns that single ruleset for the product and re-evaluates it immediately, same behavior as the UI panel.

4. Vulnerability analysis update

The existing /api/v2/vulnerability_analyses/ endpoint now includes:

• applied_by_preset: the preset name, or null if the analysis is user-owned
• created_by / last_modified_by: null when the analysis has never been touched by a user
• a filter, ?applied_by_preset__isnull=true, to list only user-reviewed analyses (or false for auto-triaged ones)