Components Operational Risk

How Does Xray Determine the Operational Risk Severity?

Xray calculates the Operational Risk as High, Medium, Low and None (no known risk) using the following criteria: 

Calculating Operational Risk Effective Severity

Workflow

Step 1 Create Operational Risk Policy

An additional Policy type was added to support Operational Risk rules. The rules are based on the risk types determined by Xray. Violations are generated based on the rule criteria you select. For more information on Xray Policies, see Creating Xray Policies and Rules. 

Step 2 Attach Policy to Watch

Attach the Operational Risk Policy to a Watch or Watches to apply it on your resources. For more information on Xray Watches, see Configuring Xray Watches.

Step 3 View Operational Risk Data

View Operational Risk Data for your components in the Xray Data tab in Artifactory. 

Step 4 View Violations

View Operational Risk violations that were generated based on the Policy rules you set. 

Creating Operational Risk Policy

An Operational Risk Policy type includes rules that are based on the risk criteria determined by Xray. To create a Policy, do the following:

1. In the Administration module, select Watches & Policies and  from the Policies tab click New Policy. 
2. Select Policy type as Operational Risk, and click New Rule. 
   
3. Select the rule criteria. You can do one of the following:
   1. According to minimal risk level; low, medium or high.
   2. According to specific values of the sub-criteria under Custom Conditions. The Custom Conditions are based on the available Xray Operational Risk data. The relationship between the conditions is Or/And. 
      
      
      

For more information on creating Policies, see Creating Xray Policies and Rules. After creating the Policy, you can proceed to attach it to a Watch, as described in Configuring Xray Watches.

Viewing Operational Risk Data

The Xray Data tab in Artifactory now includes an additional tab for Operational Risk data. Each component is listed along with the Operational Risk information for each component. To access this data, see Analyzing Resource Scan Results.

Operational Risk Violations

A new type of violation, Operational Risk, is now listed under the Violations tab under Xray Data. The violations are generated according to the rules you have set in the Policy. The violation includes the Operational Risk component data. 

When you select a violation, the Operational Risk data is displayed. 

Ignoring an Operational Risk Violation

You can create an Ignore Rule to ignore an Operational Risk Violation. To create the Ignore Rule, click the Ignore Violation icon. For more information on Ignore Rules, see Ignore Rules. 

Upgrading Xray with Operational Risk Feature Support in Offline Mode

If you are working in an offline mode, you need to manually sync the database to download components data and enable Operational Risk detection. 

Do the following:

1. In the Administration module, go to Xray Security and Compliance and select Database Sync.
2. Select the Offline sync mode and click Generate Download Command.

3. A command is generated similar to this:
   

   jfrog xr offline-update --license-id=<LICENSE_ID> --version=<XRAY_VERSION>

4. If the command includes From and To parameters, remove them so the command looks like the example above. 
5. Copy the command and run it in the CLI. 
6. The CLI will download 2 files : comp_0.zip and vuln_0.zip
7. Unzip the components file, for example, comp_{NUMBER}.zip. It contains additional zip files such as:
   1. 2022-03-22__onboardingf__comp2801_2803__.zip

8. Place the extracted components zip files under the following folder in Xray server.

   ${XRAY_HOME}/var/work/server/updates/data_migration/public_comps_operational_risk_files/

   
   

9. Trigger the components operational risk persistence migration:
   

   [post] <XRAY_URL>/api/v1/migration/trigger/public_comps_operational_risk
   
   Content-Type:application/json

10. Use the migration values REST API to monitor the operational risk migration process. To learn more about running Xray commands, see Xray REST API.
    Once the migration is completed, the migration status will be set to finished. In case of any other status that contains failure information, check the logs and or contact JFrog's customer support.
    

    [GET] <XRAY_URL>/api/v1/migration/data/value?key=public_comps_operational_risk

    Sample Response:

    {
       "key": "public_comps_operational_risk",
       "value": "finished"
    }

REST API Support

The following REST APIs have been updated to support the Operational Risk feature: 

• Scan Build V1
• Scan Build V2
• Build Summary
• Artifact summary
• Find Component by Name
• Get Violations
• Create Policy
• Create Ignore Rule