From c2a9a647b843fce1d0a7d8ada5c6c765675cabb9 Mon Sep 17 00:00:00 2001
From: okieselbach <26136457+okieselbach@users.noreply.github.com>
Date: Fri, 20 Mar 2026 13:56:55 +0000
Subject: [PATCH] chore: regenerate rules/dist from individual files

---
 rules/dist/analyze-rules.json | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/rules/dist/analyze-rules.json b/rules/dist/analyze-rules.json
index 08143abb..0a55071c 100644
--- a/rules/dist/analyze-rules.json
+++ b/rules/dist/analyze-rules.json
@@ -1114,7 +1114,7 @@
     {
       "ruleId": "ANALYZE-ID-003",
       "title": "Critical Vulnerability Detected",
-      "description": "Fires when the vulnerability correlation finds critical-severity CVEs or CISA KEV entries in installed software.",
+      "description": "Fires when the vulnerability correlation finds critical-severity CVEs or CISA KEV entries in installed software. This indicates the device has software with known, actively exploited vulnerabilities.",
       "severity": "critical",
       "category": "security",
       "version": "1.0.0",
@@ -1143,7 +1143,11 @@
         }
       ],
       "confidenceFactors": [
-        { "signal": "kev_confirmed", "condition": "exists", "weight": 10 }
+        {
+          "signal": "kev_confirmed",
+          "condition": "exists",
+          "weight": 10
+        }
       ],
       "confidenceThreshold": 80,
       "explanation": "The device has installed software with critical vulnerabilities. Software with CVEs rated CRITICAL (CVSS >= 9.0) or listed in the CISA Known Exploited Vulnerabilities catalog was detected. These vulnerabilities are actively targeted by attackers and should be remediated immediately.",