DOCS-9659: Set due date rules

[drichards-87]

What does this PR do? What is the motivation?

New docs for Set due date rules for Vulnerability Pipeline.

Merge instructions

Merge readiness:

• Ready for merge

Merge queue is enabled in this repo. To have it automatically merged after it receives the required reviews, create the PR (from a branch that follows the <yourname>/description naming convention) and then add the following PR comment:

/merge

Additional notes

[github-actions]

Preview links (active after the build_preview check completes)

New or renamed files

• https://docs-staging.datadoghq.com/deforest/docs-9659-assign-due-date/security/automation_pipelines/set_due_date

Modified Files

• https://docs-staging.datadoghq.com/deforest/docs-9659-assign-due-date/security/automation_pipelines/
• https://docs-staging.datadoghq.com/deforest/docs-9659-assign-due-date/security/automation_pipelines/mute
• https://docs-staging.datadoghq.com/deforest/docs-9659-assign-due-date/security/automation_pipelines/security_inbox

[JonRuben]

I'd recommend adding the following:

An explanation of what will remove the due date (rule passing, muted, due date removed)

An explanation of what happens when a rule becomes overdue. And if there's a notification sent when it does. -- Maybe a PM can help you identify what happens? Since I'm not sure.

Specify that the due date is set from the time in which the vuln was discovered, not the time the due date was created

A screenshot of what the due date looks like on the page, since it can be hard to find. I'm not sure if this is what we usually do, but I think it would help the customer a bunch.

[JonRuben]

Shouldn't there be quotes around "Cloud Infrastructure Anomaly Warnings"?

[drichards-87]

Are you required to surround the name in quotes when adding it in the UI?

[drichards-87]

If you're referring to style conventions, we don't have one for this. But I'd probably lean towards using bold vs. quotes for text that you would enter in a field. I can add that to the PR.

[JonRuben]

Definitely don't need it in quotes when adding it to the UI. Bold wuld be better.

[drichards-87]

I'd recommend adding the following:

An explanation of what will remove the due date (rule passing, muted, due date removed)

To clarify:

• Rule passes: If a rule starts passing, the due date no longer applies. That makes sense to me.
• Muted: If the vulnerability is muted, the due date no longer applies. This could occur if you manually mute the vulnerability, or if it's auto-muted by one of the mute rules, correct?
• Due date removed: How do you remove a due date? Can you do this manually on a vulnerability that has a due date? Or would this only occur if the due date rule is disabled or deleted?

An explanation of what happens when a rule becomes overdue. And if there's a notification sent when it does. -- Maybe a PM can help you identify what happens? Since I'm not sure.

I'll reach out to Etienne about this.

Specify that the due date is set from the time in which the vuln was discovered, not the time the due date was created

I'll add this to the instructions for adding a due date rule.

[JonRuben]

Muted: If the vulnerability is muted, the due date no longer applies. This could occur if you manually mute the vulnerability, or if it's auto-muted by one of the mute rules, correct?

Correct

Due date removed: How do you remove a due date? Can you do this manually on a vulnerability that has a due date? Or would this only occur if the due date rule is disabled or deleted?

You can only do this if the rule is disabled or deleted

[xlamorlette-datadog]

Also, the due date will be removed if the due date rule associated with the vulnerability has been modified and it doesn't match anymore the vulnerability.

[drichards-87]

Ah, okay, that's good to know. I'll add that to the PR.

[JonRuben]

I believe that "Application Code Vulnerability" and "Application Library Vulnerability" and "Container Image Vulnerability" are also options.

[drichards-87]

Thanks. Do you know where I could see this in the UI? I'm not seeing it in any of the orgs right now.

[drichards-87]

@JonRuben Thanks for the link.

P.S. I deleted your comment as this is a public repo, just to be safe.