fix: address gap analysis findings for IriusRisk parser

- Update test CSVs from 12 to 14 columns (add MITRE reference, STRIDE-LM)
- Parse MITRE reference: CWE-NNN extracts to cwe field, other values to references
- Include STRIDE-LM in description when populated
- Add Critical to severity mapping
- Change static_finding to False per connector spec
- Update documentation to reflect all changes
- Add tests for CWE extraction, references, STRIDE-LM, and Critical severity

Authored by T. Walker - DefectDojo

Author: skywalke34

docs/content/supported_tools/parsers/file/iriusrisk.md

@@ -40,8 +40,8 @@ Sample IriusRisk scans can be found in the [sample scan data folder](https://git
 
 ### Total Fields in CSV
 
-- Total data fields: 12
-- Total data fields parsed: 12
+- Total data fields: 14
+- Total data fields parsed: 14
 - Total data fields NOT parsed: 0
 
 ### CSV Format Field Mapping Details
@@ -51,22 +51,25 @@ Sample IriusRisk scans can be found in the [sample scan data folder](https://git
 
 | Source Field             | DefectDojo Field     | Parser Line # | Notes                                                                 |
 | ------------------------ | -------------------- | ------------- | --------------------------------------------------------------------- |
-| Threat                   | title                | 47            | Truncated to 150 characters with "..." suffix if longer               |
-| Current Risk             | severity             | 49            | Mapped from IriusRisk risk levels to DefectDojo severity levels       |
-| Component                | component_name       | 79            | The affected asset or component from the threat model                 |
-| Threat                   | description          | 53            | Full threat text included as first line of structured description     |
-| Component                | description          | 54            | Included in structured description block                              |
-| Use case                 | description          | 55            | Threat category included in structured description                    |
-| Source                   | description          | 56            | Origin of the threat included in structured description               |
-| Inherent Risk            | description          | 57            | Pre-control risk level included in structured description             |
-| Current Risk             | description          | 58            | Current risk level included in structured description                 |
-| Projected Risk           | description          | 59            | Post-mitigation risk level included in structured description         |
-| Countermeasure progress  | description          | 60            | Percentage complete included in structured description                |
-| Weakness tests           | description          | 61            | Test status included in structured description                        |
-| Countermeasure tests     | description          | 62            | Test status included in structured description                        |
-| Owner                    | description          | 64-65         | Conditionally appended to description only when present               |
-| Risk Response            | mitigation           | 78            | Mitigation status percentages from IriusRisk                          |
-| Component + Threat + Risk Response | unique_id_from_tool | 69-71 | SHA-256 hash used for deduplication across reimports                  |
+| Threat                   | title                | 51            | Truncated to 150 characters with "..." suffix if longer               |
+| Current Risk             | severity             | 53            | Mapped from IriusRisk risk levels to DefectDojo severity levels       |
+| Component                | component_name       | 95            | The affected asset or component from the threat model                 |
+| Threat                   | description          | 57            | Full threat text included as first line of structured description     |
+| Component                | description          | 58            | Included in structured description block                              |
+| Use case                 | description          | 59            | Threat category included in structured description                    |
+| Source                   | description          | 60            | Origin of the threat included in structured description               |
+| Inherent Risk            | description          | 61            | Pre-control risk level included in structured description             |
+| Current Risk             | description          | 62            | Current risk level included in structured description                 |
+| Projected Risk           | description          | 63            | Post-mitigation risk level included in structured description         |
+| Countermeasure progress  | description          | 64            | Percentage complete included in structured description                |
+| Weakness tests           | description          | 65            | Test status included in structured description                        |
+| Countermeasure tests     | description          | 66            | Test status included in structured description                        |
+| Owner                    | description          | 68-69         | Conditionally appended to description only when present               |
+| STRIDE-LM               | description          | 70-71         | Conditionally appended to description only when present               |
+| Risk Response            | mitigation           | 94            | Mitigation status percentages from IriusRisk                          |
+| MITRE reference          | cwe                  | 82-85         | When value matches CWE-NNN pattern, integer is extracted to cwe field |
+| MITRE reference          | references           | 86-87         | When value does not match CWE pattern, stored as references           |
+| Component + Threat + Risk Response | unique_id_from_tool | 74-77 | SHA-256 hash used for deduplication across reimports                  |
 
 </details>
 
@@ -77,33 +80,34 @@ Sample IriusRisk scans can be found in the [sample scan data folder](https://git
 
 | Finding Field    | Default Value                    | Parser Line # | Notes                                                       |
 | ---------------- | -------------------------------- | ------------- | ----------------------------------------------------------- |
-| static_finding   | True                             | 81            | Threat model data is static analysis                        |
-| dynamic_finding  | False                            | 82            | Not from live scanning                                      |
-| active           | True (False when "Very low")     | 80            | Set to False when Current Risk is "Very low" (fully mitigated) |
-| unique_id_from_tool | SHA-256 hash                  | 83            | Hash of Component, Threat, and Risk Response                |
+| static_finding   | False                            | 97            | Threat model data is neither static nor dynamic analysis    |
+| dynamic_finding  | False                            | 98            | Threat model data is neither static nor dynamic analysis    |
+| active           | True (False when "Very low")     | 96            | Set to False when Current Risk is "Very low" (fully mitigated) |
+| unique_id_from_tool | SHA-256 hash                  | 99            | Hash of Component, Threat, and Risk Response                |
 
 </details>
 
 ## Special Processing Notes
 
 ### Status Conversion
 
-IriusRisk uses a four-level risk scale that is mapped to DefectDojo severity levels (lines 7-12):
+IriusRisk uses a five-level risk scale that is mapped to DefectDojo severity levels (lines 8-14):
 
+- `Critical` → Critical
 - `High` → High
 - `Medium` → Medium
 - `Low` → Low
 - `Very low` → Info
 
-Any unrecognized risk value defaults to Info (line 49). The mapping uses the "Current Risk" column, which reflects the risk level accounting for existing controls and represents the most accurate current exposure.
+Any unrecognized risk value defaults to Info (line 53). The mapping uses the "Current Risk" column, which reflects the risk level accounting for existing controls and represents the most accurate current exposure.
 
 ### Title Format
 
-Finding titles are derived from the "Threat" column (line 47). Threat descriptions longer than 150 characters are truncated to 147 characters with a "..." suffix appended. Shorter threat texts are used as-is without modification.
+Finding titles are derived from the "Threat" column (line 51). Threat descriptions longer than 150 characters are truncated to 147 characters with a "..." suffix appended. Shorter threat texts are used as-is without modification.
 
 ### Description Construction
 
-The parser constructs a structured markdown description containing all 12 CSV fields (lines 52-66):
+The parser constructs a structured markdown description containing all relevant CSV fields (lines 56-72):
 
 1. Full threat text (untruncated, regardless of title truncation)
 2. Component name
@@ -116,20 +120,29 @@ The parser constructs a structured markdown description containing all 12 CSV fi
 9. Weakness Tests (test status)
 10. Countermeasure Tests (test status)
 11. Owner (conditionally included only when the field contains a value)
+12. STRIDE-LM (conditionally included only when the field contains a value)
 
 Each field is formatted as a bold markdown label followed by the value, with fields separated by newlines.
 
+### MITRE Reference / CWE Extraction
+
+The parser reads the "MITRE reference" column (lines 79-87) and applies conditional mapping:
+
+- If the value matches the pattern `CWE-NNN` (e.g., "CWE-284"), the integer portion is extracted and set on the finding's `cwe` field.
+- If the value is present but does not match the CWE pattern (e.g., "T1059" for a MITRE ATT&CK technique), the full value is stored in the finding's `references` field.
+- If the column is empty, neither field is set.
+
 ### Mitigation Construction
 
-The mitigation field is populated directly from the "Risk Response" column (line 78), which contains the IriusRisk mitigation status in the format: "Planned mitigation: X%. Mitigated: Y%. Unmitigated: Z%." This preserves the original IriusRisk mitigation tracking percentages.
+The mitigation field is populated directly from the "Risk Response" column (line 94), which contains the IriusRisk mitigation status in the format: "Planned mitigation: X%. Mitigated: Y%. Unmitigated: Z%." This preserves the original IriusRisk mitigation tracking percentages.
 
 ### Active/Inactive Logic
 
-Findings are set to active by default (line 80). When the "Current Risk" value is "Very low", the finding is set to inactive, as this indicates the threat has been fully mitigated through implemented countermeasures.
+Findings are set to active by default (line 96). When the "Current Risk" value is "Very low", the finding is set to inactive, as this indicates the threat has been fully mitigated through implemented countermeasures.
 
 ### Deduplication
 
-The parser generates a `unique_id_from_tool` by computing a SHA-256 hash of the Component, Threat, and Risk Response fields concatenated with pipe delimiters (lines 69-71). This ensures that each distinct combination of component, threat, and mitigation state produces a unique identifier. On reimport, findings with matching unique IDs are recognized as the same finding rather than being duplicated.
+The parser generates a `unique_id_from_tool` by computing a SHA-256 hash of the Component, Threat, and Risk Response fields concatenated with pipe delimiters (lines 74-77). This ensures that each distinct combination of component, threat, and mitigation state produces a unique identifier. On reimport, findings with matching unique IDs are recognized as the same finding rather than being duplicated.
 
 ### Duplicate Rows in Source Data
 

dojo/tools/iriusrisk/parser.py

@@ -1,6 +1,7 @@
 import csv
 import hashlib
 import io
+import re
 
 from dojo.models import Finding
 
@@ -9,6 +10,7 @@
     "Low": "Low",
     "Medium": "Medium",
     "High": "High",
+    "Critical": "Critical",
 }
 
 
@@ -42,6 +44,8 @@ def get_findings(self, filename, test):
             countermeasure_tests = (row.get("Countermeasure tests") or "").strip()
             projected_risk = (row.get("Projected Risk") or "").strip()
             owner = (row.get("Owner") or "").strip()
+            mitre_reference = (row.get("MITRE reference") or "").strip()
+            stride_lm = (row.get("STRIDE-LM") or "").strip()
 
             # Title: truncate to 150 chars with ellipsis if needed
             title = threat[:147] + "..." if len(threat) > 150 else threat
@@ -63,13 +67,25 @@ def get_findings(self, filename, test):
             ]
             if owner:
                 description_parts.append(f"**Owner:** {owner}")
+            if stride_lm:
+                description_parts.append(f"**STRIDE-LM:** {stride_lm}")
             description = "\n".join(description_parts)
 
             # Unique ID for deduplication across reimports
             unique_id = hashlib.sha256(
                 f"{component}|{threat}|{risk_response}".encode(),
             ).hexdigest()
 
+            # Extract CWE from MITRE reference if present
+            cwe = None
+            references = ""
+            if mitre_reference:
+                cwe_match = re.match(r"CWE-(\d+)", mitre_reference)
+                if cwe_match:
+                    cwe = int(cwe_match.group(1))
+                else:
+                    references = mitre_reference
+
             finding = Finding(
                 test=test,
                 title=title,
@@ -78,9 +94,13 @@ def get_findings(self, filename, test):
                 mitigation=risk_response,
                 component_name=component,
                 active=current_risk != "Very low",
-                static_finding=True,
+                static_finding=False,
                 dynamic_finding=False,
                 unique_id_from_tool=unique_id,
             )
+            if cwe:
+                finding.cwe = cwe
+            if references:
+                finding.references = references
             findings.append(finding)
         return findings

unittests/scans/iriusrisk/many_vulns.csv

@@ -1,6 +1,7 @@
-"Component","Use case","Source","Threat","Risk Response","Inherent Risk","Current Risk","Countermeasure progress","Weakness tests","Countermeasure tests","Projected Risk","Owner"
-"Router","Elevation of Privilege","Created by Rules Engine","Accessing functionality not properly constrained by ACLs","Planned mitigation: 0%. Mitigated: 0%. Unmitigated: 100%.","High","High","0%","Not tested","Not tested","High",
-"API UX Authorization Management","Read or Post data","Created by Rules Engine","An adversary attempts to exploit an application by injecting additional, malicious content during its processing","Planned mitigation: 100%. Mitigated: 0%. Unmitigated: 0%.","Medium","Medium","0%","Not tested","Not tested","Very low",
-"API BS Connection Interface Reporting","Read or Post data","Created by Rules Engine","An attacker crafts malicious web links and distributes them hoping to induce users to click on the link","Planned mitigation: 34%. Mitigated: 66%. Unmitigated: 0%.","High","Low","66%","Not tested","Not tested","Very low",
-"app-srec-audit-events","Networking","Created by Rules Engine","Access to network traffic from other containers creates the potential for various types of attacks such as denial of service or spoofing attack","Planned mitigation: 0%. Mitigated: 100%. Unmitigated: 0%.","High","Very low","100%","Not tested","Not tested","Very low",
-"API BS Service Provider","General","Created by Rules Engine","An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions","Planned mitigation: 100%. Mitigated: 0%. Unmitigated: 0%.","Medium","Medium","0%","Not tested","Not tested","Very low","John Smith"
+"Component","Use case","Source","Threat","Risk Response","Inherent Risk","Current Risk","Countermeasure progress","Weakness tests","Countermeasure tests","Projected Risk","Owner","MITRE reference","STRIDE-LM"
+"Router","Elevation of Privilege","Created by Rules Engine","Accessing functionality not properly constrained by ACLs","Planned mitigation: 0%. Mitigated: 0%. Unmitigated: 100%.","High","High","0%","Not tested","Not tested","High",,"CWE-284","Elevation of Privilege"
+"API UX Authorization Management","Read or Post data","Created by Rules Engine","An adversary attempts to exploit an application by injecting additional, malicious content during its processing","Planned mitigation: 100%. Mitigated: 0%. Unmitigated: 0%.","Medium","Medium","0%","Not tested","Not tested","Very low",,"T1059",
+"API BS Connection Interface Reporting","Read or Post data","Created by Rules Engine","An attacker crafts malicious web links and distributes them hoping to induce users to click on the link","Planned mitigation: 34%. Mitigated: 66%. Unmitigated: 0%.","High","Low","66%","Not tested","Not tested","Very low",,,
+"app-srec-audit-events","Networking","Created by Rules Engine","Access to network traffic from other containers creates the potential for various types of attacks such as denial of service or spoofing attack","Planned mitigation: 0%. Mitigated: 100%. Unmitigated: 0%.","High","Very low","100%","Not tested","Not tested","Very low",,,
+"API BS Service Provider","General","Created by Rules Engine","An attacker injects, manipulates or forges malicious log entries in the log file, allowing her to mislead a log audit, cover traces of attack, or perform other malicious actions","Planned mitigation: 100%. Mitigated: 0%. Unmitigated: 0%.","Medium","Medium","0%","Not tested","Not tested","Very low","John Smith",,
+"Database Server","Data Storage","Created by Rules Engine","An attacker targets the database server to exfiltrate sensitive records","Planned mitigation: 0%. Mitigated: 0%. Unmitigated: 100%.","Critical","Critical","0%","Not tested","Not tested","Critical",,,

unittests/scans/iriusrisk/no_vuln.csv

@@ -1 +1 @@
-"Component","Use case","Source","Threat","Risk Response","Inherent Risk","Current Risk","Countermeasure progress","Weakness tests","Countermeasure tests","Projected Risk","Owner"
+"Component","Use case","Source","Threat","Risk Response","Inherent Risk","Current Risk","Countermeasure progress","Weakness tests","Countermeasure tests","Projected Risk","Owner","MITRE reference","STRIDE-LM"

unittests/scans/iriusrisk/one_vuln.csv

@@ -1,2 +1,2 @@
-"Component","Use case","Source","Threat","Risk Response","Inherent Risk","Current Risk","Countermeasure progress","Weakness tests","Countermeasure tests","Projected Risk","Owner"
-"Router","Elevation of Privilege","Created by Rules Engine","Accessing functionality not properly constrained by ACLs","Planned mitigation: 0%. Mitigated: 0%. Unmitigated: 100%.","High","High","0%","Not tested","Not tested","High",
+"Component","Use case","Source","Threat","Risk Response","Inherent Risk","Current Risk","Countermeasure progress","Weakness tests","Countermeasure tests","Projected Risk","Owner","MITRE reference","STRIDE-LM"
+"Router","Elevation of Privilege","Created by Rules Engine","Accessing functionality not properly constrained by ACLs","Planned mitigation: 0%. Mitigated: 0%. Unmitigated: 100%.","High","High","0%","Not tested","Not tested","High",,,