scanpolicy

func DefaultPrioritizer ¶

func DefaultPrioritizer(expl *exploit.Source) engine.Prioritizer

DefaultPrioritizer scores a finding from its severity and the component's declared exposure and criticality, optionally escalating on exploitability. expl may be nil, in which case enrichment is skipped.

func GateThresholds ¶ added in v0.98.0

func GateThresholds(g *saga.GateConfig) (map[string]sarif.Severity, map[string]string)

GateThresholds converts a descriptor's gate block into the per-control map a Policy takes. Nil when unset, which leaves every control on the default threshold.

Here rather than beside either caller for the reason in the package doc. A verdict is the answer Draugr exists to give, and one entry point applying the descriptor's gate while another applied a fixed default would have an agent and CI disagree about the same descriptor. With nothing in either answer to show which policy produced it.

Validation has already refused a per-control threshold in the other vocabulary from the gate, so the two maps are never both populated and a value that parses as neither cannot reach here.

Returned as two maps because a threshold only means something in the vocabulary its gate asks in. Parsing every value as a severity and keeping what survived silently discarded a band, which is the whole per-control block on a band gate, and a band gate is the default.

func Unreachable ¶ added in v0.116.0

func Unreachable(model saga.Model, band string) []string

Unreachable names the components that cannot produce the band this run gates on, with what each one is classified as and the worst band it can actually reach.

Empty when the run gates on severity: a severity threshold is reachable from any classification, because it does not read one.