Skip to main content

How to Deactivate a Rule

This guide explains how to deactivate a Kiuwan rule and create a custom model.

Understanding rules and models

When you run a Kiuwan analysis, Kiuwan applies a set of rules to your source code. These rules detect various vulnerabilities and code quality issues, for example, SQL injections or path-traversal vulnerabilities.

Note: The set of rules used in an analysis is called a Model. Kiuwan offers over 3000 rules, but not all are active by default.

By default, Kiuwan uses the CQM, which includes a preselected set of active rules. Unless configured otherwise, every new application is automatically associated with CQM.
If needed you can deactivate specific rules, for example, if a rule is irrelevant to your project, produces false positives, or does not align with your validation needs. Kiuwan excludes the rules from the analysis when you deactivate them from the analysis.
For better flexibility, you can create a custom model with tailored rule sets and assign different models to different applications.

Check which model your application uses

If you are using Kiuwan Local Analyzer GUI:

  1. Click Advanced to see which model you are using. 

    A window will be displayed like this:

  2. Check the Analysis model field value:
    • If set to Automatic, CQM is used by default.
    • If another model is used, its name will be displayed.

If you are using Kiuwan website:

  1. Go to Application Management.
  2. Find your application and select Model from the drop-down menu on the right.
  3. A window opens with the Model associated with your application:

Create a new model based on CQM model

Note: CQM is the default Kiuwan model, and it’s read-only. You can use it, but you cannot modify it.

If you are using CQM and you want to modify it (for example, deactivating a rule), you must follow these steps:

  1. Create your custom model (most probably as a copy of CQM) - To create your custom model, please follow the instructions detailed at Advanced Model Management

  2. Find the rule and deactivate it - Go to the Rules tab of your custom model and find the rule using the filters (Rules Management)

    A rule is identified by two fields:

    • By name: For example, “Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')” 
    • By rule code: For example, OPT.JAVA.SEC_JAVA.SqlInjectionRule
  3. Click the green circle to deactivate or activate it. 

  4. Publish your model -  All the changes to the model are saved in a Draft version.

    To make the changes publicly available, click Publish and provide a version tag. 

    Once published, any new analysis of an application associated with this model will use this latest version.

  5. Associate your application to your custom model and run the analysis again - Find your application in Application Management, click Model, and select the created model.

    Now, when you run the analysis of the application, your custom model is used.

Create a new custom model when I already have one

 If you are already using a custom model:

  1. Follow step 2 (Find the rule and deactivate it)
  2. Publish your model as described above in step 4.
  3. Re-run your analysis.

 

Related to

Was this article helpful?
Powered by Zendesk