[cravex2-reachability] Integrate triage rules in CRAVEX API #365

[tdruez]

Issues

• Issues: cravex2-reachability: Integrate triage rules in CRAVEX UI and API #365

Vulnerability Triage REST API

• Triage recommendations endpoint exposing a product's active recommendations, one entry per vulnerability
• Full CRUD API for triage rulesets and analysis presets
• Ruleset assignment endpoint to list, assign, and unassign a product's triage rulesets, with parity to the existing "Manage triage rules" panel
• Enriched vulnerability analysis endpoint exposing preset attribution and user authorship, with a filter to separate auto-triaged analyses from user-reviewed ones

Usage

1. List a product's active triage recommendations

GET /api/v2/products/{uuid}/triage_records/

Returns one entry per vulnerability, from the highest-precedence ruleset currently assigned to the product:

[
{
"advisory_id": "CVE-2024-1234",
"ruleset": "Active Exploit",
"recommended_action": "upgrade",
"matched_rules": ["exploited_vulnerability"],
"request": null,
"detected_date": "2026-08-01T10:00:00Z",
"last_checked": "2026-08-18T09:00:00Z"
}
]

2. Manage triage rulesets and analysis presets

Standard list/create/retrieve/update/delete endpoints:

/api/v2/triage_rulesets/
/api/v2/analysis_presets/

3. Assign or unassign a ruleset on a product

GET /api/v2/products/{uuid}/manage_triage_rulesets/

Lists every enabled ruleset in the product's dataspace, flagged with whether it's currently assigned:

[
{"uuid": "...", "name": "Active Exploit", "recommended_action": "upgrade", "precedence": 600, "assigned": true},
{"uuid": "...", "name": "Stale Vulnerability", "recommended_action": "apply_patch", "precedence": 300, "assigned": false}
]

POST /api/v2/products/{uuid}/manage_triage_rulesets/
Body: {"ruleset": "<uuid>", "assigned": true}

Assigns or unassigns that single ruleset for the product and re-evaluates it immediately, same behavior as the UI panel.

4. Vulnerability analysis update

The existing /api/v2/vulnerability_analyses/ endpoint now includes:

• applied_by_preset: the preset name, or null if the analysis is user-owned
• created_by / last_modified_by: null when the analysis has never been touched by a user
• a filter, ?applied_by_preset__isnull=true, to list only user-reviewed analyses (or false for auto-triaged ones)