The rule engine is Dvaro's backbone.
A scanner tells you what it saw. Dvaro checks each finding against a growing library of tested detection rules. A matched finding names the rule it matched, and a finding nothing accounts for is shown, never guessed.
What a rule is.
A detection rule is a written definition of one weakness. A person can read it and argue with it.
- What it meansThe weakness, described in plain words, so a reviewer and a client read the same thing.
- How it was testedPositive, negative and edge test cases. Nearly every rule carries all three.
- Where it came fromThe source behind the definition, kept with the rule.
- Who lets a new rule go liveA reviewer who approves it and a different person who promotes it, neither of them its author.
The library keeps growing. Rules are written from public vulnerability research, scanner documentation and vendor advisories.
Matching runs in two steps.
The candidate rules
First, Dvaro shortlists the candidate rules for a finding.
Checked one by one
Then it checks each condition of every candidate.
A match names its rule
When a rule matches, the finding names the rule it matched, so you can see exactly why Dvaro knows what it is.
This is what a rule looks like to a reviewer.
A real live rule from Dvaro's library, shown in the words a reviewer reads. How rules are built inside Dvaro stays inside Dvaro.
- What it means
- The server can be made to fetch an address an attacker chooses, so a request can reach internal systems the attacker cannot reach directly.
- Tested with
- 2 positive, 2 negative and 1 edge case
- Status
- Live
Nobody approves their own rule.
A reviewer approves a new rule, and a different person promotes it to live. Before approving, the reviewer sees what the rule would have matched in real data. AI may draft a rule. Nothing written by AI goes live by itself.
- 01DraftAuthor
A person writes it, or AI drafts it. It matches nothing yet.
- 02ReviewReviewer
Reads it in plain words, checks its test cases and what it would have matched.
- 03ApprovedReviewer, not the author
The author can never approve their own rule.
- 04LiveA different person
Promotes it. Only now does it match findings.
Dvaro says so, instead of guessing.
The finding stays visible with its scanner severity and evidence. A labelled AI assessment can account for it. Until something does, the decision for its asset stays Incomplete and names the finding, so you and the team that writes rules both see exactly what is missing.
Public data informs. Rules and your policy decide.
EPSS (Exploit Prediction Scoring System) and the KEV catalogue (Known Exploited Vulnerabilities) of CISA, the US Cybersecurity and Infrastructure Security Agency, sit next to each finding as context.
See which of your findings Dvaro's rules match today.
Bring one of your own reports, and ask us to show you a rule review in a demo.
Book a pilot