From 56d9e22d1ea7323ae65b4967dc933c678fc3b9f8 Mon Sep 17 00:00:00 2001 From: "andre.bolinhas" Date: Wed, 4 Nov 2026 13:22:20 +0000 Subject: [PATCH] Entry and exit discipline for the channel MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This document reaches every customer's agents from one hardcoded URL, so a publish is a decision taken on their behalf. Records what earns that — an actively exploited vulnerability, recognisable in one request, in software customers run, in the days before a fix — and the three steps out: in as log, promoted only with a reason, then into the engine or deleted. Also records that customers do not need this channel for their own rules. Create Custom Ruleset takes the same fields and reaches their own agents; the config pull and this feed are each forbidden from touching the other's sources. Co-Authored-By: Claude Opus 5 (1M context) Claude-Session: https://claude.ai/code/session_01N5fpE6Gu4W6JoFMXyb7t7r --- CVE-CHANNEL.md | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/CVE-CHANNEL.md b/CVE-CHANNEL.md index 75ff5db..926ba3b 100644 --- a/CVE-CHANNEL.md +++ b/CVE-CHANNEL.md @@ -13,6 +13,34 @@ Engine 3.0.47 and later fetch it hourly from: https://git.artica.center/Andre/edgeguard-owasp-feed/raw/branch/main/cve.json +## When a rule belongs here, and when it does not + +This document reaches every customer's agents from one hardcoded URL, so a +publish is a decision taken on their behalf. It earns that only in a narrow +case: **an actively exploited vulnerability, recognisable in a single request, +in software customers run, during the days before a real fix exists.** That is +a few a year. + +Entry and exit, so rules do not accumulate because publishing is easy: + +1. **In as `log`.** It records matches and scores nothing, so it refuses + nothing while you see what it would have caught. +2. **Promoted to `critical` only with a reason.** Severity is what acts — + `high` scores 4 against a default threshold of 5 and does nothing on its + own. A rule left at `high` is inert, not cautious. +3. **Then out.** Anything still worth enforcing after the emergency moves into + the engine, where it works with no network and cannot be withdrawn by a bad + publish — Log4Shell, Spring4Shell and PHP2Shell all live there. Anything no + longer worth it is deleted and the stamp bumped. + +A rule sitting here indefinitely is in the wrong place. + +**And customers do not need this channel for their own rules.** Create Custom +Ruleset in the console takes the same fields and reaches their agents through +the configuration pull, scoped to the sites they choose. The config pull is +forbidden from touching the sources this feed owns and this feed is forbidden +from touching theirs, so the two cannot clear each other. + ## Publishing a patch Add a rule to the single ruleset, bump `build_datetime`, commit, push. An