Logic Enhancement within Policy Creation

[robotsalesmenDS]

Current Behavior

In the image above we are trying to write a policy that "FAILs", if these conditions exist. Our goal is to make RULE this applicable across all projects.

  "IS" "Critical 
  
  OR 
  
  "IS" "High" 
  
  OR
  
  "IS NOT" "CVE-2018-2225"

It appears we cannot do this because the "Vulnerability ID" "CVE-2018-20225" is "Critical" also.

Proposed Behavior

Can we add a feature that adds more granularity to the "Vulnerability ID"?

Checklist

• I have read and understand the contributing guidelines
• I have checked the existing issues for whether this enhancement was already requested