[{"data":1,"prerenderedAt":2818},["ShallowReactive",2],{"page-\u002Fdethereal\u002Fdiscovery-and-enrichment":3,"navigation":2497},{"id":4,"title":5,"body":6,"description":2481,"extension":2482,"meta":2483,"navigation":2492,"path":2493,"seo":2494,"stem":2495,"__hash__":2496},"docs\u002F03.dethereal\u002F05.discovery-and-enrichment.md","Discovery and Enrichment",{"type":7,"value":8,"toc":2445},"minimark",[9,13,17,20,25,39,44,52,226,233,243,250,254,257,263,293,299,322,326,329,424,427,431,434,440,444,447,477,480,484,491,493,497,505,509,512,592,599,602,606,625,637,640,660,663,675,678,684,693,700,704,707,731,933,942,946,949,960,966,972,979,989,1003,1009,1013,1023,1101,1106,1109,1115,1206,1209,1225,1242,1248,1259,1275,1279,1282,1340,1344,1347,1379,1386,1390,1393,1465,1476,1498,1502,1505,1565,1567,1571,1585,1589,1596,1621,1628,1632,1649,1653,1659,1665,1680,1683,1694,1696,1700,1706,1713,1717,1720,1783,1787,1793,2000,2018,2022,2046,2050,2093,2097,2102,2121,2124,2126,2130,2137,2348,2351,2400,2410,2413,2430,2432,2441],[10,11,5],"h1",{"id":12},"discovery-and-enrichment",[14,15,16],"p",{},"Discovery finds what's in your system. Enrichment describes how it's secured. Together, they transform a structural sketch into an analysis-ready threat model.",[18,19],"hr",{},[21,22,24],"h2",{"id":23},"part-1-infrastructure-discovery","Part 1: Infrastructure Discovery",[14,26,27,28,33,34,38],{},"Discovery scans your codebase to identify components, trust boundaries, and data flows. It runs during Step 2 of the ",[29,30,32],"a",{"href":31},"\u002Fdethereal\u002Fguided-workflow","guided workflow"," or standalone via ",[35,36,37],"code",{},"\u002Fdethereal:discover",".",[40,41,43],"h3",{"id":42},"what-discovery-finds","What Discovery Finds",[14,45,46,47,51],{},"The ",[48,49,50],"strong",{},"infrastructure-scout"," agent scans 10 source categories:",[53,54,60],"div",{"className":55,"tabIndex":57,"role":58,"ariaLabel":59},[56],"table-frame",0,"region","Table: What Discovery Finds",[61,62,63,82],"table",{},[64,65,66],"thead",{},[67,68,69,73,76,79],"tr",{},[70,71,72],"th",{},"#",[70,74,75],{},"Source",[70,77,78],{},"What It Finds",[70,80,81],{},"Examples",[83,84,85,100,114,128,142,156,170,184,198,212],"tbody",{},[67,86,87,91,94,97],{},[88,89,90],"td",{},"1",[88,92,93],{},"Code structure",[88,95,96],{},"Application components",[88,98,99],{},"package.json, go.mod, monorepo configs",[67,101,102,105,108,111],{},[88,103,104],{},"2",[88,106,107],{},"Infrastructure-as-Code",[88,109,110],{},"Cloud resources, networking",[88,112,113],{},"Terraform, CloudFormation, Pulumi, CDK",[67,115,116,119,122,125],{},[88,117,118],{},"3",[88,120,121],{},"Container definitions",[88,123,124],{},"Containerized services",[88,126,127],{},"Dockerfiles, docker-compose.yml",[67,129,130,133,136,139],{},[88,131,132],{},"4",[88,134,135],{},"Kubernetes manifests",[88,137,138],{},"Orchestrated workloads",[88,140,141],{},"Deployments, Services, NetworkPolicies",[67,143,144,147,150,153],{},[88,145,146],{},"5",[88,148,149],{},"API definitions",[88,151,152],{},"Service interfaces",[88,154,155],{},"OpenAPI specs, gRPC .proto, GraphQL schemas",[67,157,158,161,164,167],{},[88,159,160],{},"6",[88,162,163],{},"Network configuration",[88,165,166],{},"Load balancers, proxies",[88,168,169],{},"Nginx, HAProxy, Envoy, service mesh",[67,171,172,175,178,181],{},[88,173,174],{},"7",[88,176,177],{},"CI\u002FCD pipelines",[88,179,180],{},"Deployment infrastructure",[88,182,183],{},"GitHub Actions, GitLab CI, Jenkins",[67,185,186,189,192,195],{},[88,187,188],{},"8",[88,190,191],{},"Database schemas",[88,193,194],{},"Data stores",[88,196,197],{},"SQL migrations, ORM models, Prisma",[67,199,200,203,206,209],{},[88,201,202],{},"9",[88,204,205],{},"Environment files",[88,207,208],{},"Configuration",[88,210,211],{},".env.example, ConfigMaps (names only, never secret values)",[67,213,214,217,220,223],{},[88,215,216],{},"10",[88,218,219],{},"Documentation",[88,221,222],{},"Supporting evidence",[88,224,225],{},"README, ADRs, architecture diagrams",[14,227,228,229,232],{},"Before presenting results, the plugin shows a ",[48,230,231],{},"sources-checked summary"," so you can see what was scanned and what was skipped:",[234,235,240],"pre",{"className":236,"code":238,"language":239},[237],"language-text","Sources checked: IaC\u002FTerraform (12), Containers (3), K8s (—), CI\u002FCD (2), Code (5), API defs (1)\n","text",[35,241,238],{"__ignoreMap":242},"",[14,244,245,246,249],{},"A ",[35,247,248],{},"(—)"," means the source was checked but no matching files were found.",[40,251,253],{"id":252},"the-confidence-model","The Confidence Model",[14,255,256],{},"Each discovered element gets a confidence score across two dimensions:",[14,258,259,262],{},[48,260,261],{},"Existence confidence"," — how certain we are the component exists:",[264,265,266,277,283],"ul",{},[267,268,269,272,273,276],"li",{},[48,270,271],{},"High"," — explicit declaration (e.g., Terraform ",[35,274,275],{},"aws_rds_instance",")",[267,278,279,282],{},[48,280,281],{},"Medium"," — strong inference (e.g., SQL migration files imply a database)",[267,284,285,288,289,292],{},[48,286,287],{},"Low"," — weak inference (e.g., environment variable ",[35,290,291],{},"REDIS_URL"," implies Redis)",[14,294,295,298],{},[48,296,297],{},"Classification confidence"," — how certain the class assignment is:",[264,300,301,309,317],{},[267,302,303,305,306,308],{},[48,304,271],{}," — unambiguous mapping (e.g., ",[35,307,275],{}," is a Database)",[267,310,311,313,314,276],{},[48,312,281],{}," — probable mapping (e.g., Dockerfile with ",[35,315,316],{},"FROM postgres:15",[267,318,319,321],{},[48,320,287],{}," — ambiguous (e.g., generic service name)",[40,323,325],{"id":324},"pre-classification-from-iac","Pre-Classification From IaC",[14,327,328],{},"When the scout finds Infrastructure-as-Code, it pre-classifies components using a mapping table. For example:",[53,330,333],{"className":331,"tabIndex":57,"role":58,"ariaLabel":332},[56],"Table: Pre-Classification From IaC",[61,334,335,348],{},[64,336,337],{},[67,338,339,342,345],{},[70,340,341],{},"IaC Resource",[70,343,344],{},"Component Type",[70,346,347],{},"Suggested Class",[83,349,350,362,374,387,399,412],{},[67,351,352,356,359],{},[88,353,354],{},[35,355,275],{},[88,357,358],{},"STORE",[88,360,361],{},"Database",[67,363,364,369,371],{},[88,365,366],{},[35,367,368],{},"aws_elasticache_cluster",[88,370,358],{},[88,372,373],{},"Key-Value Store",[67,375,376,381,384],{},[88,377,378],{},[35,379,380],{},"aws_lambda_function",[88,382,383],{},"PROCESS",[88,385,386],{},"Serverless Function",[67,388,389,394,396],{},[88,390,391],{},[35,392,393],{},"aws_lb",[88,395,383],{},[88,397,398],{},"Load Balancer",[67,400,401,407,409],{},[88,402,403,404],{},"Kubernetes ",[35,405,406],{},"Deployment",[88,408,383],{},[88,410,411],{},"(from container image)",[67,413,414,419,421],{},[88,415,403,416],{},[35,417,418],{},"Service",[88,420,383],{},[88,422,423],{},"(from selector)",[14,425,426],{},"Pre-classifications are validated against the platform's class library before being presented to you. This deterministic pass runs before any LLM-assisted classification.",[40,428,430],{"id":429},"the-batch-confirmation-workflow","The Batch Confirmation Workflow",[14,432,433],{},"Discovery always presents all found elements in a single table for your review — it never auto-imports without confirmation:",[234,435,438],{"className":436,"code":437,"language":239},[237],"| # | Name | Type | Class | Confidence | Include? |\n|---|------|------|-------|------------|---------|\n| 1 | API Gateway | PROCESS | API Gateway | high | Y |\n| 2 | PostgreSQL | STORE | Database | high | Y |\n| 3 | Redis | STORE | Key-Value Store | high | Y |\n| 4 | Auth Service | PROCESS | — | medium | Y |\n| 5 | CloudWatch | EXTERNAL_ENTITY | — | low | ? |\n\nAre any components missing? Should any be removed or reclassified?\n",[35,439,437],{"__ignoreMap":242},[40,441,443],{"id":442},"the-blind-spots-interview","The Blind-Spots Interview",[14,445,446],{},"After you confirm the component list, the plugin runs a consolidated prompt to catch commonly missed elements:",[448,449,450,453,474],"blockquote",{},[14,451,452],{},"Discovery found your main components. Common elements NOT found in code:",[454,455,456,459,462,465,468,471],"ol",{},[267,457,458],{},"Shared infrastructure — IdP, DNS, CA, log aggregator, SIEM, secret manager",[267,460,461],{},"Side-channel data flows — logging pipelines, metrics, DNS resolution, backups",[267,463,464],{},"Deployment pipeline — CI\u002FCD platform, container registries, artifact stores",[267,466,467],{},"Third-party SaaS — OAuth providers, payment processors, CDN, email\u002FSMS",[267,469,470],{},"Human actors with privileged access — system admins, DBAs, on-call engineers",[267,472,473],{},"Shared credentials — service accounts used by multiple components",[14,475,476],{},"List anything else I missed, or say \"none\" to continue.",[14,478,479],{},"This is a single question, not a series of individual prompts. Items already discovered are confirmed and not re-asked.",[40,481,483],{"id":482},"discovery-cache","Discovery Cache",[14,485,486,487,490],{},"For multi-model projects, the first discovery saves a cache at ",[35,488,489],{},".dethernety\u002Fdiscovery-cache.json",". Subsequent models can reuse this cache, filtering out components already assigned to other models. The user can force a re-scan at any time.",[18,492],{},[21,494,496],{"id":495},"part-2-security-enrichment","Part 2: Security Enrichment",[14,498,499,500,33,502,38],{},"Enrichment populates security attributes on your model's components, data flows, and boundaries. It runs during Step 8 of the ",[29,501,32],{"href":31},[35,503,504],{},"\u002Fdethereal:enrich",[40,506,508],{"id":507},"enrichment-tiers","Enrichment Tiers",[14,510,511],{},"Components are enriched in priority order:",[53,513,516],{"className":514,"tabIndex":57,"role":58,"ariaLabel":515},[56],"Table: Enrichment Tiers",[61,517,518,531],{},[64,519,520],{},[67,521,522,525,528],{},[70,523,524],{},"Tier",[70,526,527],{},"Components",[70,529,530],{},"Why This Order",[83,532,533,553,566,579],{},[67,534,535,540,550],{},[88,536,537],{},[48,538,539],{},"Tier 1",[88,541,542,543,546,547,276],{},"Crown jewels (",[35,544,545],{},"crownJewel: true"," in ",[35,548,549],{},"structure.json",[88,551,552],{},"Highest-value targets — enrich first",[67,554,555,560,563],{},[88,556,557],{},[48,558,559],{},"Tier 2",[88,561,562],{},"Cross-boundary components",[88,564,565],{},"Exposed at trust transitions",[67,567,568,573,576],{},[88,569,570],{},[48,571,572],{},"Tier 3",[88,574,575],{},"Internet-facing components",[88,577,578],{},"Directly reachable from outside",[67,580,581,586,589],{},[88,582,583],{},[48,584,585],{},"Tier 4",[88,587,588],{},"Internal-only components",[88,590,591],{},"Lowest exposure",[14,593,594,595,598],{},"Each component is assigned to its ",[48,596,597],{},"highest-priority matching tier only"," — a crown jewel that is also cross-boundary appears only in Tier 1.",[14,600,601],{},"If stale elements exist (from adding components during enrichment), they're prioritized first regardless of tier.",[40,603,605],{"id":604},"class-templates-drive-the-questions","Class Templates Drive the Questions",[14,607,608,609,612,613,616,617,620,621,624],{},"Enrichment is not a fixed questionnaire. The questions come from each element's ",[48,610,611],{},"class template",", so they differ per element: a Database is asked about ",[35,614,615],{},"ssl_enabled",", ",[35,618,619],{},"password_encryption",", and ",[35,622,623],{},"log_connections","; a Load Balancer is asked about something else entirely.",[14,626,627,628,631,632,636],{},"This works because classification leaves a checklist behind. When you classify, the plugin writes a stub attribute file for each classified component and data item containing every field its class template defines, seeded to ",[35,629,630],{},"null"," — schema defaults are deliberately ",[633,634,635],"em",{},"not"," filled in, because a default describes the class, not your system. Those null fields are the checklist, and enrichment resolves every one of them.",[14,638,639],{},"For each element in scope, the enricher:",[454,641,642,647,654,657],{},[267,643,644,645],{},"Reads the stub to see which fields are still ",[35,646,630],{},[267,648,649,650,653],{},"Reads the class configuration guide, cached at ",[35,651,652],{},".dethereal\u002Fclass-cache\u002F\u003Cclass-id>.json",", for where each value can be found",[267,655,656],{},"Searches your code, IaC, and config files for concrete evidence",[267,658,659],{},"Asks you only about what it could not find, grouped per component to keep round-trips down",[14,661,662],{},"Budget for every template field on every in-scope element — not for a fixed six.",[448,664,665],{},[14,666,667,670,671,674],{},[48,668,669],{},"Classify first."," Template-driven enrichment needs those stubs on disk. An element with no class assigned is skipped and reported in the summary (",[35,672,673],{},"N elements skipped — unclassified","); only the six-attribute floor below is applied to it. The same applies if the platform is unreachable and the class cache is cold.",[14,676,677],{},"Proposals arrive as a batch confirmation table per tier:",[234,679,682],{"className":680,"code":681,"language":239},[237],"## Proposed Enrichment — Tier 1 (Crown Jewels)\n\n| # | Component | Class | Attribute | Current | Proposed | Source |\n|---|-----------|-------|-----------|---------|----------|--------|\n| 1 | payment-db | Database | ssl_enabled | null | true | postgresql.conf |\n| 2 | payment-db | Database | password_encryption | null | scram-sha-256 | pg_hba.conf |\n| 3 | payment-db | Database | log_connections | null | true | postgresql.conf |\n| ...\n\nApply these changes? (yes \u002F modify \u002F skip)\n",[35,683,681],{"__ignoreMap":242},[14,685,686,687,689,690,692],{},"Each tier is written to disk before the next one begins, so an interrupted run keeps the tiers it finished. If you decline a field, the plugin writes the template's documented unknown value rather than leaving it ",[35,688,630],{}," — a resumed pass reads ",[35,691,630],{}," as \"not yet asked\" and would ask again.",[14,694,695,696,699],{},"To see what is left, run a quality check: alongside the score it returns an ",[48,697,698],{},"attribute residual"," — the elements carrying the most unresolved template fields, with the field names, plus the elements it could not measure at all (usually a missing class template). Both lists are capped, so treat them as the top of the queue; the complete checklist is still the null fields in the attribute files.",[40,701,703],{"id":702},"the-six-attribute-floor","The Six-Attribute Floor",[14,705,706],{},"After template-driven enrichment, the enricher checks six security concepts on every in-scope component, whether or not its class template covered them. Anything the template missed is prompted for. Surface reports assume these are captured universally, so a template that omits one must not become a silent blind spot.",[14,708,709,712,713,716,717,720,721,616,724,727,728,730],{},[48,710,711],{},"Write these exact key names."," The ",[35,714,715],{},"control_coverage_rate"," quality factor (10% of the score) and the ",[35,718,719],{},"\u002Fdethereal:surface"," encryption and authentication coverage read these literal keys and no others. A semantically equivalent name that a class template happens to use (",[35,722,723],{},"transit_encryption_enforced",[35,725,726],{},"tls_enabled",", …) does ",[48,729,635],{}," satisfy the floor — and nothing raises an error. The element simply reads as having no positive security attribute.",[53,732,735],{"className":733,"tabIndex":57,"role":58,"ariaLabel":734},[56],"Table: The Six-Attribute Floor",[61,736,737,755],{},[64,738,739],{},[67,740,741,743,746,749,752],{},[70,742,72],{},[70,744,745],{},"Concept",[70,747,748],{},"Attribute key",[70,750,751],{},"Written on",[70,753,754],{},"Value that counts",[83,756,757,801,830,860,878,899],{},[67,758,759,761,764,769,772],{},[88,760,90],{},[88,762,763],{},"Authentication",[88,765,766],{},[35,767,768],{},"authentication_type",[88,770,771],{},"component",[88,773,774,775,616,778,616,781,784,785,788,789,792,793,796,797,800],{},"String — ",[35,776,777],{},"oauth2",[35,779,780],{},"mtls",[35,782,783],{},"sso",". ",[35,786,787],{},"none"," does not count. ",[35,790,791],{},"basic","\u002F",[35,794,795],{},"digest"," count only when ",[35,798,799],{},"encryption_in_transit"," is a current protocol",[67,802,803,805,808,812,815],{},[88,804,104],{},[88,806,807],{},"Encryption in transit",[88,809,810],{},[35,811,799],{},[88,813,814],{},"data flow (and component where meaningful)",[88,816,817,818,821,822,616,824,616,827],{},"String — e.g. ",[35,819,820],{},"TLS 1.3",". Rejected: ",[35,823,787],{},[35,825,826],{},"sslv3",[35,828,829],{},"tls 1.0",[67,831,832,834,837,842,844],{},[88,833,118],{},[88,835,836],{},"Encryption at rest",[88,838,839],{},[35,840,841],{},"encryption_at_rest",[88,843,771],{},[88,845,817,846,821,849,616,851,616,854,616,857],{},[35,847,848],{},"AES-256",[35,850,787],{},[35,852,853],{},"des",[35,855,856],{},"3des",[35,858,859],{},"rc4",[67,861,862,864,867,872,875],{},[88,863,132],{},[88,865,866],{},"Logging",[88,868,869],{},[633,870,871],{},"(no scored key)",[88,873,874],{},"—",[88,876,877],{},"Captured by the class template; nothing reads a floor-level key for this one",[67,879,880,882,885,890,893],{},[88,881,146],{},[88,883,884],{},"Access control",[88,886,887],{},[35,888,889],{},"implicit_deny_enabled",[88,891,892],{},"component (and boundary, though only the component value is scored)",[88,894,895,896],{},"Boolean ",[35,897,898],{},"true",[67,900,901,903,906,911,913],{},[88,902,160],{},[88,904,905],{},"Log telemetry",[88,907,908],{},[35,909,910],{},"monitoring_tools",[88,912,771],{},[88,914,915,916,919,920,792,922,925,926,929,930],{},"Non-empty ",[35,917,918],{},"string[]"," once ",[35,921,787],{},[35,923,924],{},"n\u002Fa"," entries are discarded. Use ",[35,927,928],{},"[]",", never ",[35,931,932],{},"[\"None\"]",[14,934,935,936,938,939,941],{},"Types are strict as well as names: a boolean ",[35,937,898],{}," for ",[35,940,841],{}," scores as absent, because that field wants the concrete algorithm string.",[40,943,945],{"id":944},"credential-enrichment","Credential Enrichment",[14,947,948],{},"Credential topology is critical for lateral movement analysis — it shows which components share credentials and where credential compromise could spread.",[14,950,951,952,955,956,959],{},"Capture is ",[48,953,954],{},"anchored to your data flows",", not to a cold inventory. A \"list all your credentials\" brain-dump reliably misses the shared service accounts that ",[633,957,958],{},"are"," the lateral-movement story, so the plugin asks flow by flow instead.",[14,961,962,965],{},[48,963,964],{},"Phase 1 — Flow-anchored capture:"," The plugin enumerates the cross-boundary flows it computed during tiering and asks about them in one batched table:",[234,967,970],{"className":968,"code":969,"language":239},[237],"For each of these cross-boundary flows: what credential authenticates it,\nand what ELSE does that credential reach?\n\n| # | Flow | Credential (id or \"none\"\u002F\"unknown\") | Also used by |\n|---|------|--------------------------------------|--------------|\n| 1 | API Server → PostgreSQL | db-admin-account | Worker → PostgreSQL |\n| 2 | Client → API Gateway | api-gateway-key | — |\n",[35,971,969],{"__ignoreMap":242},[14,973,974,975,978],{},"Come prepared to answer ",[633,976,977],{},"per flow"," rather than with a flat list — the \"also used by\" column is what makes shared credentials visible. A free-form sweep follows for anything no flow surfaced: break-glass accounts, CI deploy keys, certificates.",[14,980,981,984,985,988],{},[48,982,983],{},"Phase 2 — Mapping:"," The answers are consolidated into a credential → flows mapping and presented for confirmation. The plugin then writes ",[35,986,987],{},"required_credentials"," on flow attribute files — this is the key the analysis engine reads when deciding whether an attacker can traverse a flow.",[14,990,991,994,995,998,999,1002],{},[48,992,993],{},"Phase 3 — STORE scope:"," For components that store credential material (databases with password tables, secret managers), the plugin sets ",[35,996,997],{},"stores_credentials: true"," and ",[35,1000,1001],{},"credential_scope"," listing which credentials are stored there.",[14,1004,1005,1008],{},[48,1006,1007],{},"Phase 4 — Shared credential analysis:"," If the same credential appears on multiple flows across different boundaries, the plugin flags the credential blast radius — compromise of that credential exposes all linked components.",[40,1010,1012],{"id":1011},"data-item-classification","Data Item Classification",[14,1014,1015,1016,1022],{},"For cross-boundary flows carrying sensitive data, the plugin proposes data items with sensitivity and regulatory labels. Regulatory flags use the ",[29,1017,1021],{"href":1018,"rel":1019},"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Fblob\u002Fmain\u002Fdocs\u002Farchitecture\u002Fdethereal\u002FTHREAT_MODELING_WORKFLOW.md#canonical-sensitivity-and-regulatory-flag-vocabulary",[1020],"nofollow","canonical vocabulary"," — emit the exact casing, since the platform matches them case-sensitively:",[53,1024,1027],{"className":1025,"tabIndex":57,"role":58,"ariaLabel":1026},[56],"Table: Data Item Classification",[61,1028,1029,1041],{},[64,1030,1031],{},[67,1032,1033,1036,1039],{},[70,1034,1035],{},"Sensitivity",[70,1037,1038],{},"Regulatory Labels",[70,1040,81],{},[83,1042,1043,1059,1081,1091],{},[67,1044,1045,1048,1056],{},[88,1046,1047],{},"Restricted (Tier 1)",[88,1049,1050,616,1053],{},[35,1051,1052],{},"PHI",[35,1054,1055],{},"PCI cardholder",[88,1057,1058],{},"Health records, credit card numbers",[67,1060,1061,1064,1078],{},[88,1062,1063],{},"Confidential (Tier 2)",[88,1065,1066,616,1069,616,1072,616,1075],{},[35,1067,1068],{},"GDPR personal",[35,1070,1071],{},"PII",[35,1073,1074],{},"SOX financial",[35,1076,1077],{},"CCPA personal",[88,1079,1080],{},"Email addresses, session tokens",[67,1082,1083,1086,1088],{},[88,1084,1085],{},"Internal (Tier 3)",[88,1087,874],{},[88,1089,1090],{},"Metrics, operational logs",[67,1092,1093,1096,1098],{},[88,1094,1095],{},"Public (Tier 4)",[88,1097,874],{},[88,1099,1100],{},"Documentation, public APIs",[1102,1103,1105],"h4",{"id":1104},"origin-and-credential-flag","Origin and credential flag",[14,1107,1108],{},"Two more answers sit beside sensitivity on each data item. Both start unanswered, and the plugin never fills either in on its own — it asks or proposes, and you confirm.",[14,1110,1111,1114],{},[48,1112,1113],{},"Origin"," records who can write the item's content — and so whether an element that reads it is reading trusted input:",[53,1116,1119],{"className":1117,"tabIndex":57,"role":58,"ariaLabel":1118},[56],"Table: Origin and credential flag",[61,1120,1121,1133],{},[64,1122,1123],{},[67,1124,1125,1127,1130],{},[70,1126,1113],{},[70,1128,1129],{},"Meaning",[70,1131,1132],{},"Untrusted",[83,1134,1135,1145,1155,1165,1175,1186,1196],{},[67,1136,1137,1140,1143],{},[88,1138,1139],{},"Authenticated first party",[88,1141,1142],{},"Written only by the operator's own authenticated users or systems",[88,1144],{},[67,1146,1147,1150,1153],{},[88,1148,1149],{},"Curated internal",[88,1151,1152],{},"Internal content that passed a review or curation step",[88,1154],{},[67,1156,1157,1160,1163],{},[88,1158,1159],{},"Agent relayed",[88,1161,1162],{},"Produced or forwarded by another agent; at most this trusted",[88,1164],{},[67,1166,1167,1170,1173],{},[88,1168,1169],{},"Model generated",[88,1171,1172],{},"Written by a model and later read as input; at most this trusted",[88,1174],{},[67,1176,1177,1180,1183],{},[88,1178,1179],{},"Third party",[88,1181,1182],{},"Written by a known external party under an agreement",[88,1184,1185],{},"yes",[67,1187,1188,1191,1194],{},[88,1189,1190],{},"Arbitrary public",[88,1192,1193],{},"Anyone can write it",[88,1195,1185],{},[67,1197,1198,1201,1204],{},[88,1199,1200],{},"Not assessed",[88,1202,1203],{},"Answered as not established; treated as untrusted",[88,1205,1185],{},[14,1207,1208],{},"Typical Arbitrary public content: web pages, inbound email, public issues, public forms.",[14,1210,1211,1212,1215,1216,1219,1220,38],{},"Pick the ",[48,1213,1214],{},"least-trusted"," source of what the item holds: if any part of it comes from a public form, the item is Arbitrary public. When the source of the content is known, the plugin asks for the origin; when it is not, the item stays unanswered, which is different from Not assessed. The full vocabulary, with the tokens written to ",[35,1217,1218],{},"data-items.json",", is in the ",[29,1221,1224],{"href":1222,"rel":1223},"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Fblob\u002Fmain\u002Fdocs\u002Farchitecture\u002Fdethereal\u002FTHREAT_MODELING_WORKFLOW.md#canonical-data-origin-and-credential-vocabulary",[1020],"canonical data-origin and credential vocabulary",[14,1226,1227,1230,1231,1234,1235,1238,1239,1241],{},[48,1228,1229],{},"Credential"," records whether the item is a credential — a password, token, key, secret, or certificate. It is yes, no, or unknown. When a data item is classified with a credential-like data class (for example ",[633,1232,1233],{},"User Credentials"," or ",[633,1236,1237],{},"Authentication Tokens",", or any class whose name mentions a token, secret, password, key, or certificate) and you have not answered yet, the plugin proposes ",[48,1240,1185],{}," in the batch confirmation table:",[234,1243,1246],{"className":1244,"code":1245,"language":239},[237],"| # | Data item          | Class                 | Proposed credential |\n|---|--------------------|-----------------------|---------------------|\n| 1 | Session token      | Authentication Tokens | yes                 |\n| 2 | Login password     | User Credentials      | yes                 |\n",[35,1247,1245],{"__ignoreMap":242},[14,1249,1250,1251,1254,1255,1258],{},"Accept, change, or skip each row. If you answer ",[48,1252,1253],{},"no",", the plugin keeps your answer and stops proposing. These proposals do not change the quality score; ",[35,1256,1257],{},"\u002Fdethereal:review"," lists any still-unanswered items, and data items without an origin that flow to external parties or to model- or agent-driven components, as informational findings.",[14,1260,1261,1262,998,1264,1266,1267,1270,1271,1274],{},"You can set or change both fields later in the platform: open the data item and use the ",[48,1263,1113],{},[48,1265,1229],{}," selects on its ",[48,1268,1269],{},"General"," tab. Untrusted origins carry an ",[48,1272,1273],{},"untrusted"," chip in the list.",[40,1276,1278],{"id":1277},"boundary-enforcement","Boundary Enforcement",[14,1280,1281],{},"For each trust boundary, the enricher captures enforcement posture:",[53,1283,1286],{"className":1284,"tabIndex":57,"role":58,"ariaLabel":1285},[56],"Table: Boundary Enforcement",[61,1287,1288,1301],{},[64,1289,1290],{},[67,1291,1292,1295,1298],{},[70,1293,1294],{},"Attribute",[70,1296,1297],{},"Options",[70,1299,1300],{},"Security Impact",[83,1302,1303,1315,1327],{},[67,1304,1305,1309,1312],{},[88,1306,1307],{},[35,1308,889],{},[88,1310,1311],{},"true \u002F false",[88,1313,1314],{},"Whether the boundary blocks traffic by default",[67,1316,1317,1322,1324],{},[88,1318,1319],{},[35,1320,1321],{},"allow_any_inbound",[88,1323,1311],{},[88,1325,1326],{},"Whether unrestricted inbound is allowed",[67,1328,1329,1334,1337],{},[88,1330,1331],{},[35,1332,1333],{},"egress_filtering",[88,1335,1336],{},"deny_all \u002F allow_list \u002F allow_all \u002F unknown",[88,1338,1339],{},"Outbound traffic policy",[40,1341,1343],{"id":1342},"monitoring-tools","Monitoring Tools",[14,1345,1346],{},"The enricher captures which monitoring systems observe each component:",[264,1348,1349,1355,1361,1367,1373],{},[267,1350,1351,1354],{},[48,1352,1353],{},"SIEM"," — Security Information and Event Management",[267,1356,1357,1360],{},[48,1358,1359],{},"EDR"," — Endpoint Detection and Response",[267,1362,1363,1366],{},[48,1364,1365],{},"NDR"," — Network Detection and Response",[267,1368,1369,1372],{},[48,1370,1371],{},"APM"," — Application Performance Monitoring",[267,1374,1375,1378],{},[48,1376,1377],{},"Cloud-native"," — CloudTrail, Azure Monitor, GCP Cloud Audit Logs",[14,1380,1381,1382,38],{},"Components without any monitoring tools are flagged as SOC blind spots in the ",[29,1383,1385],{"href":1384},"\u002Fdethereal\u002Freview-and-analysis","attack surface analysis",[40,1387,1389],{"id":1388},"auth-failure-mode","Auth Failure Mode",[14,1391,1392],{},"For authenticated cross-boundary flows, the enricher captures what happens when authentication fails:",[53,1394,1397],{"className":1395,"tabIndex":57,"role":58,"ariaLabel":1396},[56],"Table: Auth Failure Mode",[61,1398,1399,1411],{},[64,1400,1401],{},[67,1402,1403,1406,1408],{},[70,1404,1405],{},"Mode",[70,1407,1129],{},[70,1409,1410],{},"Risk",[83,1412,1413,1426,1439,1452],{},[67,1414,1415,1420,1423],{},[88,1416,1417],{},[35,1418,1419],{},"deny",[88,1421,1422],{},"Connection refused",[88,1424,1425],{},"Safe default",[67,1427,1428,1433,1436],{},[88,1429,1430],{},[35,1431,1432],{},"fallback",[88,1434,1435],{},"Falls back to weaker auth",[88,1437,1438],{},"Potential downgrade attack",[67,1440,1441,1446,1449],{},[88,1442,1443],{},[35,1444,1445],{},"fail_open",[88,1447,1448],{},"Allows unauthenticated access",[88,1450,1451],{},"Critical vulnerability",[67,1453,1454,1459,1462],{},[88,1455,1456],{},[35,1457,1458],{},"unknown",[88,1460,1461],{},"Not documented",[88,1463,1464],{},"Risk unclear",[14,1466,1467,1468,1234,1470,1472,1473,1475],{},"Flows marked ",[35,1469,1445],{},[35,1471,1432],{}," appear authenticated in the model but may provide no security guarantee under failure conditions. The attack surface analysis (",[35,1474,719],{},") highlights these.",[448,1477,1478],{},[14,1479,1480,1483,1484,1487,1488,998,1491,1494,1495,1497],{},[48,1481,1482],{},"Known limitation:"," The platform's analysis engine does not currently incorporate ",[35,1485,1486],{},"auth_failure_mode"," into risk scoring. A flow with ",[35,1489,1490],{},"authType: \"OAuth2\"",[35,1492,1493],{},"auth_failure_mode: \"fail_open\""," receives full authentication credit in platform analysis. Treat fail-open and fallback flows as high-priority regardless of the engine's computed score. The local attack surface analysis (",[35,1496,719],{},") correctly annotates these flows.",[40,1499,1501],{"id":1500},"compliance-driven-enrichment","Compliance-Driven Enrichment",[14,1503,1504],{},"Your compliance drivers (from scope definition) determine which framework-specific prompts appear:",[53,1506,1509],{"className":1507,"tabIndex":57,"role":58,"ariaLabel":1508},[56],"Table: Compliance-Driven Enrichment",[61,1510,1511,1524],{},[64,1512,1513],{},[67,1514,1515,1518,1521],{},[70,1516,1517],{},"Integration Level",[70,1519,1520],{},"Frameworks",[70,1522,1523],{},"What's Prompted",[83,1525,1526,1539,1552],{},[67,1527,1528,1533,1536],{},[88,1529,1530],{},[48,1531,1532],{},"Full integration",[88,1534,1535],{},"SOC2, ISO 27001",[88,1537,1538],{},"Framework-specific attribute prompts — SOC2 covers access control, encryption in transit, and monitoring; ISO 27001 covers asset classification, cryptographic controls, and logging",[67,1540,1541,1546,1549],{},[88,1542,1543],{},[48,1544,1545],{},"Data-focused",[88,1547,1548],{},"PCI-DSS, HIPAA, GDPR",[88,1550,1551],{},"Data classification prompts, sensitivity mapping",[67,1553,1554,1559,1562],{},[88,1555,1556],{},[48,1557,1558],{},"Declared only",[88,1560,1561],{},"NIST CSF 2.0, NIS2, DORA",[88,1563,1564],{},"Recorded as drivers, no framework-specific prompts",[18,1566],{},[21,1568,1570],{"id":1569},"part-3-mitre-framework-integration","Part 3: MITRE Framework Integration",[14,1572,1573,1574,1577,1578,1580,1581,1584],{},"ATT&CK technique coverage is ",[48,1575,1576],{},"derived on the platform",", not annotated locally. Enrichment does not write technique IDs onto your attribute files — its job is to produce component attributes good enough for the platform's analysis policies to fire. Those policies attach techniques to the exposures they raise, and ",[35,1579,719],{}," reports coverage from there. Do not expect to find a ",[35,1582,1583],{},"mitre_attack_techniques"," field after enrichment; there isn't one, and its absence is not a failed run.",[40,1586,1588],{"id":1587},"verified-technique-lookup","Verified Technique Lookup",[14,1590,1591,1592,1595],{},"You can still look techniques up interactively — to understand an exposure the platform surfaced, for example. When the plugin does, it ",[48,1593,1594],{},"never generates technique IDs from memory",":",[454,1597,1598,1604],{},[267,1599,1600,1603],{},[48,1601,1602],{},"Search"," — it queries the platform's MITRE database using semantic descriptions (e.g., \"SQL injection against database\"), not remembered IDs",[267,1605,1606,1609,1610,1234,1613,1616,1617,1620],{},[48,1607,1608],{},"Validate"," — each candidate is confirmed against the platform and checked for format (",[35,1611,1612],{},"T####",[35,1614,1615],{},"T####.###"," for techniques, ",[35,1618,1619],{},"TA####"," for tactics). Anything that fails validation is dropped",[14,1622,1623,1624,1627],{},"All references come from the platform's graph database via the ",[35,1625,1626],{},"search_mitre_attack"," tool.",[40,1629,1631],{"id":1630},"d3fend-countermeasures","D3FEND Countermeasures",[14,1633,1634,1635,1638,1639,616,1642,616,1645,1648],{},"For each mapped ATT&CK technique, the plugin can look up D3FEND defensive techniques — countermeasures that address the identified threats. This helps you understand what controls exist for each technique. D3FEND IDs use the format ",[35,1636,1637],{},"D3-"," followed by 2 or more uppercase letters (e.g., ",[35,1640,1641],{},"D3-SPP",[35,1643,1644],{},"D3-IOPR",[35,1646,1647],{},"D3-HBPI",").",[40,1650,1652],{"id":1651},"coverage-assessment","Coverage Assessment",[14,1654,1655,1656,1658],{},"The attack surface analysis (",[35,1657,719],{},") shows which of the 15 Enterprise ATT&CK tactics are covered by the techniques the platform's analysis attached to your exposures:",[234,1660,1663],{"className":1661,"code":1662,"language":239},[237],"MITRE ATT&CK Coverage (platform-derived)\n  Techniques mapped: 12\n  Tactics covered (5\u002F15): Initial Access, Credential Access, Lateral Movement,\n    Collection, Exfiltration\n  Tactics not covered: Reconnaissance, Resource Development, Execution, Persistence,\n    Privilege Escalation, Stealth, Defense Impairment, Discovery, Command and Control,\n    Impact\n",[35,1664,1662],{"__ignoreMap":242},[14,1666,1667,1668,1670,1671,1673,1674,1677,1678,38],{},"Gaps in tactic coverage highlight areas where your model may be missing relevant threats. Re-running ",[35,1669,504],{}," will ",[48,1672,635],{}," move these numbers — they come from platform analysis, not from anything enrichment writes. To change coverage: push the model with ",[35,1675,1676],{},"\u002Fdethereal:sync push",", run an analysis, then re-run ",[35,1679,719],{},[14,1681,1682],{},"Until that has happened, the section reports the reason instead of a count — either \"Model not synced\" or \"No exposures — analysis has not produced technique mappings yet.\"",[448,1684,1688],{"className":1685},[1686,1687],"callout","callout-note",[14,1689,1690,1693],{},[48,1691,1692],{},"Note:"," Not all 15 tactics are expected to be relevant to every model. Tactics like Reconnaissance and Resource Development describe attacker preparation activities typically outside the scope of component-level threat modeling. Focus on gaps in tactics directly relevant to your system's architecture (e.g., Initial Access, Lateral Movement, Credential Access for internet-facing applications).",[18,1695],{},[21,1697,1699],{"id":1698},"part-4-control-enrichment","Part 4: Control Enrichment",[234,1701,1704],{"className":1702,"code":1703,"language":239},[237],"> \u002Fdethereal:enrich --focus controls\n",[35,1705,1703],{"__ignoreMap":242},[14,1707,1708,1709,1712],{},"The control pass is a ",[48,1710,1711],{},"separate enrichment invocation"," with its own 40-turn budget. Run it after the regular enrichment pass (or whenever your control library changes). It manages the link between elements and the platform's reusable security controls.",[40,1714,1716],{"id":1715},"greenfield-vs-brownfield","Greenfield vs Brownfield",[14,1718,1719],{},"Two paths exist depending on whether the Control already exists on the platform:",[53,1721,1724],{"className":1722,"tabIndex":57,"role":58,"ariaLabel":1723},[56],"Table: Greenfield vs Brownfield",[61,1725,1726,1739],{},[64,1727,1728],{},[67,1729,1730,1733,1736],{},[70,1731,1732],{},"Path",[70,1734,1735],{},"When",[70,1737,1738],{},"What happens",[83,1740,1741,1762],{},[67,1742,1743,1748,1751],{},[88,1744,1745],{},[48,1746,1747],{},"Greenfield",[88,1749,1750],{},"You want a new Control that doesn't exist yet",[88,1752,1753,1754,1757,1758,1761],{},"Plugin writes ",[35,1755,1756],{},"controls\u002Fgreenfield-\u003Ctemp>.json"," with ",[35,1759,1760],{},"{ id: null, name: ... }"," and adds a reference to your element. The next push asks the platform for a UUID and rebinds every reference atomically.",[67,1763,1764,1769,1772],{},[88,1765,1766],{},[48,1767,1768],{},"Brownfield",[88,1770,1771],{},"The Control already exists on the platform",[88,1773,1774,1775,1778,1779,1782],{},"Plugin pulls ",[35,1776,1777],{},"controls\u002F\u003Cid>.json"," and lets you edit per-(Control, ControlClass) attributes. Edits queue as ",[35,1780,1781],{},"pendingEdit"," blocks for the next push.",[40,1784,1786],{"id":1785},"per-control-files","Per-Control Files",[14,1788,1789,1790,1595],{},"Each Control referenced by your model gets its own file under ",[35,1791,1792],{},"controls\u002F",[234,1794,1798],{"className":1795,"code":1796,"language":1797,"meta":242,"style":242},"language-json shiki shiki-themes github-light github-dark-dimmed","{\n  \"id\": \"ctrl-encryption-package\",\n  \"name\": \"Database Encryption Package\",\n  \"lifecycle\": \"brownfield\",\n  \"classes\": [\n    {\n      \"classId\": \"class-encryption-at-rest\",\n      \"attributes\":         { \"algorithm\": \"AES-256\", \"keyRotationDays\": 30 },\n      \"platformAttributes\": { \"algorithm\": \"AES-128\", \"keyRotationDays\": 90 },\n      \"localEditedAt\": \"2026-04-19T10:21:00Z\",\n      \"pendingEdit\": { \"editedBy\": \"operator\", \"previousAttributes\": {...} }\n    }\n  ]\n}\n","json",[35,1799,1800,1809,1826,1839,1852,1861,1867,1880,1911,1938,1951,1982,1988,1994],{"__ignoreMap":242},[1801,1802,1805],"span",{"class":1803,"line":1804},"line",1,[1801,1806,1808],{"class":1807},"sYgZi","{\n",[1801,1810,1812,1816,1819,1823],{"class":1803,"line":1811},2,[1801,1813,1815],{"class":1814},"snmFh","  \"id\"",[1801,1817,1818],{"class":1807},": ",[1801,1820,1822],{"class":1821},"s-HuK","\"ctrl-encryption-package\"",[1801,1824,1825],{"class":1807},",\n",[1801,1827,1829,1832,1834,1837],{"class":1803,"line":1828},3,[1801,1830,1831],{"class":1814},"  \"name\"",[1801,1833,1818],{"class":1807},[1801,1835,1836],{"class":1821},"\"Database Encryption Package\"",[1801,1838,1825],{"class":1807},[1801,1840,1842,1845,1847,1850],{"class":1803,"line":1841},4,[1801,1843,1844],{"class":1814},"  \"lifecycle\"",[1801,1846,1818],{"class":1807},[1801,1848,1849],{"class":1821},"\"brownfield\"",[1801,1851,1825],{"class":1807},[1801,1853,1855,1858],{"class":1803,"line":1854},5,[1801,1856,1857],{"class":1814},"  \"classes\"",[1801,1859,1860],{"class":1807},": [\n",[1801,1862,1864],{"class":1803,"line":1863},6,[1801,1865,1866],{"class":1807},"    {\n",[1801,1868,1870,1873,1875,1878],{"class":1803,"line":1869},7,[1801,1871,1872],{"class":1814},"      \"classId\"",[1801,1874,1818],{"class":1807},[1801,1876,1877],{"class":1821},"\"class-encryption-at-rest\"",[1801,1879,1825],{"class":1807},[1801,1881,1883,1886,1889,1892,1894,1897,1899,1902,1904,1908],{"class":1803,"line":1882},8,[1801,1884,1885],{"class":1814},"      \"attributes\"",[1801,1887,1888],{"class":1807},":         { ",[1801,1890,1891],{"class":1814},"\"algorithm\"",[1801,1893,1818],{"class":1807},[1801,1895,1896],{"class":1821},"\"AES-256\"",[1801,1898,616],{"class":1807},[1801,1900,1901],{"class":1814},"\"keyRotationDays\"",[1801,1903,1818],{"class":1807},[1801,1905,1907],{"class":1906},"sviXB","30",[1801,1909,1910],{"class":1807}," },\n",[1801,1912,1914,1917,1920,1922,1924,1927,1929,1931,1933,1936],{"class":1803,"line":1913},9,[1801,1915,1916],{"class":1814},"      \"platformAttributes\"",[1801,1918,1919],{"class":1807},": { ",[1801,1921,1891],{"class":1814},[1801,1923,1818],{"class":1807},[1801,1925,1926],{"class":1821},"\"AES-128\"",[1801,1928,616],{"class":1807},[1801,1930,1901],{"class":1814},[1801,1932,1818],{"class":1807},[1801,1934,1935],{"class":1906},"90",[1801,1937,1910],{"class":1807},[1801,1939,1941,1944,1946,1949],{"class":1803,"line":1940},10,[1801,1942,1943],{"class":1814},"      \"localEditedAt\"",[1801,1945,1818],{"class":1807},[1801,1947,1948],{"class":1821},"\"2026-04-19T10:21:00Z\"",[1801,1950,1825],{"class":1807},[1801,1952,1954,1957,1959,1962,1964,1967,1969,1972,1975,1979],{"class":1803,"line":1953},11,[1801,1955,1956],{"class":1814},"      \"pendingEdit\"",[1801,1958,1919],{"class":1807},[1801,1960,1961],{"class":1814},"\"editedBy\"",[1801,1963,1818],{"class":1807},[1801,1965,1966],{"class":1821},"\"operator\"",[1801,1968,616],{"class":1807},[1801,1970,1971],{"class":1814},"\"previousAttributes\"",[1801,1973,1974],{"class":1807},": {",[1801,1976,1978],{"class":1977},"sNWHW","...",[1801,1980,1981],{"class":1807},"} }\n",[1801,1983,1985],{"class":1803,"line":1984},12,[1801,1986,1987],{"class":1807},"    }\n",[1801,1989,1991],{"class":1803,"line":1990},13,[1801,1992,1993],{"class":1807},"  ]\n",[1801,1995,1997],{"class":1803,"line":1996},14,[1801,1998,1999],{"class":1807},"}\n",[14,2001,46,2002,2005,2006,2009,2010,2013,2014,2017],{},[35,2003,2004],{},"attributes"," block is what you edit. The ",[35,2007,2008],{},"platformAttributes"," block is the raw server-side payload as of the last pull. Drift between them (",[35,2011,2012],{},"attributes !== platformAttributes && !pendingEdit",") is a sign that someone edited the Control on the platform behind your back; ",[35,2015,2016],{},"\u002Fdethereal:status"," flags it.",[40,2019,2021],{"id":2020},"the-two-write-rule","The Two-Write Rule",[14,2023,2024,2025,2027,2028,2031,2032,2034,2035,2038,2039,2045],{},"Every edit to ",[35,2026,2004],{}," must (a) bump ",[35,2029,2030],{},"localEditedAt"," and (b) populate ",[35,2033,1781],{},". The plugin enforces this via the ",[35,2036,2037],{},"set-local-edited"," MCP action — ",[48,2040,2041,2042,2044],{},"never edit ",[35,2043,1777],{}," by hand."," Direct edits bypass the safety check and drop your changes silently on the next reconciliation.",[40,2047,2049],{"id":2048},"push-time-safety","Push-Time Safety",[14,2051,2052,2053,2056,2057,616,2060,2063,2064,2067,2068,2071,2072,2075,2076,2078,2079,2081,2082,2085,2086,2088,2089,38],{},"Pushing edits to a Control assigned to multiple Models pauses on the ",[48,2054,2055],{},"shared-ownership prompt"," — the operator chooses ",[35,2058,2059],{},"cancel",[35,2061,2062],{},"push-anyway",", or ",[35,2065,2066],{},"push-unverified"," per Control. ",[35,2069,2070],{},"clone-and-swap"," is not yet available: choosing it returns ",[35,2073,2074],{},"CLONE_AND_SWAP_NOT_IMPLEMENTED"," and the Control is left untouched. If you reached for it because you did ",[48,2077,635],{}," want to mutate a shared Control, the equivalent today is ",[35,2080,2059],{},", then create a separate Control with ",[35,2083,2084],{},"\u002Fdethereal:enrich --focus controls"," — not ",[35,2087,2062],{},", which overwrites the shared Control on every model referencing it. See ",[29,2090,2092],{"href":2091},"\u002Fdethereal\u002Fsync-and-version-control#shared-ownership-prompts","Sync and Version Control",[40,2094,2096],{"id":2095},"status-visibility","Status Visibility",[14,2098,2099,2101],{},[35,2100,2016],{}," surfaces:",[264,2103,2104,2110],{},[267,2105,2106,2107,2109],{},"The count of pending shared-edit prompts (Controls with un-pushed ",[35,2108,1781],{}," blocks).",[267,2111,2112,2113,2116,2117,2120],{},"Drift hints (",[35,2114,2115],{},"attributes !== platformAttributes"," without a pendingEdit) and the ",[35,2118,2119],{},"promote-external-edit"," recovery verb to apply.",[14,2122,2123],{},"This keeps a queued review from being forgotten — for example, when you switch branches and come back to the model days later.",[18,2125],{},[21,2127,2129],{"id":2128},"enrichment-output-example","Enrichment Output Example",[14,2131,2132,2133,2136],{},"After enrichment, a component attribute file (",[35,2134,2135],{},"attributes\u002Fcomponents\u002F{id}.json",") looks like this — here, a PostgreSQL store classified as a Database:",[234,2138,2140],{"className":1795,"code":2139,"language":1797,"meta":242,"style":242},"{\n  \"componentId\": \"c-db\",\n  \"name\": \"PostgreSQL\",\n  \"type\": \"STORE\",\n  \"ssl_enabled\": true,\n  \"ssl_version\": \"TLSv1.3\",\n  \"password_encryption\": \"scram-sha-256\",\n  \"log_connections\": true,\n  \"authentication_type\": \"mtls\",\n  \"encryption_in_transit\": \"TLS 1.3\",\n  \"encryption_at_rest\": \"AES-256\",\n  \"implicit_deny_enabled\": true,\n  \"monitoring_tools\": [\"SIEM\", \"CloudWatch\"],\n  \"auth_failure_mode\": \"deny\",\n  \"asset_criticality\": \"high\",\n  \"stores_credentials\": true,\n  \"credential_scope\": [\"db-admin-account\"]\n}\n",[35,2141,2142,2146,2158,2169,2181,2192,2204,2216,2227,2239,2251,2262,2273,2292,2304,2317,2329,2343],{"__ignoreMap":242},[1801,2143,2144],{"class":1803,"line":1804},[1801,2145,1808],{"class":1807},[1801,2147,2148,2151,2153,2156],{"class":1803,"line":1811},[1801,2149,2150],{"class":1814},"  \"componentId\"",[1801,2152,1818],{"class":1807},[1801,2154,2155],{"class":1821},"\"c-db\"",[1801,2157,1825],{"class":1807},[1801,2159,2160,2162,2164,2167],{"class":1803,"line":1828},[1801,2161,1831],{"class":1814},[1801,2163,1818],{"class":1807},[1801,2165,2166],{"class":1821},"\"PostgreSQL\"",[1801,2168,1825],{"class":1807},[1801,2170,2171,2174,2176,2179],{"class":1803,"line":1841},[1801,2172,2173],{"class":1814},"  \"type\"",[1801,2175,1818],{"class":1807},[1801,2177,2178],{"class":1821},"\"STORE\"",[1801,2180,1825],{"class":1807},[1801,2182,2183,2186,2188,2190],{"class":1803,"line":1854},[1801,2184,2185],{"class":1814},"  \"ssl_enabled\"",[1801,2187,1818],{"class":1807},[1801,2189,898],{"class":1906},[1801,2191,1825],{"class":1807},[1801,2193,2194,2197,2199,2202],{"class":1803,"line":1863},[1801,2195,2196],{"class":1814},"  \"ssl_version\"",[1801,2198,1818],{"class":1807},[1801,2200,2201],{"class":1821},"\"TLSv1.3\"",[1801,2203,1825],{"class":1807},[1801,2205,2206,2209,2211,2214],{"class":1803,"line":1869},[1801,2207,2208],{"class":1814},"  \"password_encryption\"",[1801,2210,1818],{"class":1807},[1801,2212,2213],{"class":1821},"\"scram-sha-256\"",[1801,2215,1825],{"class":1807},[1801,2217,2218,2221,2223,2225],{"class":1803,"line":1882},[1801,2219,2220],{"class":1814},"  \"log_connections\"",[1801,2222,1818],{"class":1807},[1801,2224,898],{"class":1906},[1801,2226,1825],{"class":1807},[1801,2228,2229,2232,2234,2237],{"class":1803,"line":1913},[1801,2230,2231],{"class":1814},"  \"authentication_type\"",[1801,2233,1818],{"class":1807},[1801,2235,2236],{"class":1821},"\"mtls\"",[1801,2238,1825],{"class":1807},[1801,2240,2241,2244,2246,2249],{"class":1803,"line":1940},[1801,2242,2243],{"class":1814},"  \"encryption_in_transit\"",[1801,2245,1818],{"class":1807},[1801,2247,2248],{"class":1821},"\"TLS 1.3\"",[1801,2250,1825],{"class":1807},[1801,2252,2253,2256,2258,2260],{"class":1803,"line":1953},[1801,2254,2255],{"class":1814},"  \"encryption_at_rest\"",[1801,2257,1818],{"class":1807},[1801,2259,1896],{"class":1821},[1801,2261,1825],{"class":1807},[1801,2263,2264,2267,2269,2271],{"class":1803,"line":1984},[1801,2265,2266],{"class":1814},"  \"implicit_deny_enabled\"",[1801,2268,1818],{"class":1807},[1801,2270,898],{"class":1906},[1801,2272,1825],{"class":1807},[1801,2274,2275,2278,2281,2284,2286,2289],{"class":1803,"line":1990},[1801,2276,2277],{"class":1814},"  \"monitoring_tools\"",[1801,2279,2280],{"class":1807},": [",[1801,2282,2283],{"class":1821},"\"SIEM\"",[1801,2285,616],{"class":1807},[1801,2287,2288],{"class":1821},"\"CloudWatch\"",[1801,2290,2291],{"class":1807},"],\n",[1801,2293,2294,2297,2299,2302],{"class":1803,"line":1996},[1801,2295,2296],{"class":1814},"  \"auth_failure_mode\"",[1801,2298,1818],{"class":1807},[1801,2300,2301],{"class":1821},"\"deny\"",[1801,2303,1825],{"class":1807},[1801,2305,2307,2310,2312,2315],{"class":1803,"line":2306},15,[1801,2308,2309],{"class":1814},"  \"asset_criticality\"",[1801,2311,1818],{"class":1807},[1801,2313,2314],{"class":1821},"\"high\"",[1801,2316,1825],{"class":1807},[1801,2318,2320,2323,2325,2327],{"class":1803,"line":2319},16,[1801,2321,2322],{"class":1814},"  \"stores_credentials\"",[1801,2324,1818],{"class":1807},[1801,2326,898],{"class":1906},[1801,2328,1825],{"class":1807},[1801,2330,2332,2335,2337,2340],{"class":1803,"line":2331},17,[1801,2333,2334],{"class":1814},"  \"credential_scope\"",[1801,2336,2280],{"class":1807},[1801,2338,2339],{"class":1821},"\"db-admin-account\"",[1801,2341,2342],{"class":1807},"]\n",[1801,2344,2346],{"class":1803,"line":2345},18,[1801,2347,1999],{"class":1807},[14,2349,2350],{},"Three groups are mixed in one flat file:",[264,2352,2353,2369,2385],{},[267,2354,2355,2358,2359,616,2361,616,2364,616,2366,2368],{},[48,2356,2357],{},"Class-template fields"," — ",[35,2360,615],{},[35,2362,2363],{},"ssl_version",[35,2365,619],{},[35,2367,623],{},". These come from the Database class template and differ for every class.",[267,2370,2371,2358,2374,616,2376,616,2378,616,2380,616,2382,2384],{},[48,2372,2373],{},"Six-attribute floor keys",[35,2375,768],{},[35,2377,799],{},[35,2379,841],{},[35,2381,889],{},[35,2383,910],{},". Spelled exactly as above, on every component, regardless of class.",[267,2386,2387,2358,2390,616,2392,616,2395,616,2398,38],{},[48,2388,2389],{},"Plugin-enrichment fields",[35,2391,1486],{},[35,2393,2394],{},"asset_criticality",[35,2396,2397],{},"stores_credentials",[35,2399,1001],{},[14,2401,2402,2403,2406,2407,2409],{},"Crown-jewel status is not in this file: it is the first-class ",[35,2404,2405],{},"crownJewel"," field on the component in ",[35,2408,549],{},", which is what the enrichment tier sweep reads.",[14,2411,2412],{},"If you edit these files by hand, read → merge → write. Overwriting drops the groups you weren't thinking about.",[14,2414,2415,2416,2419,2420,2423,2424,2426,2427,1648],{},"MITRE ATT&CK tactic coverage is not stored on the attribute file. After you push the model and run an analysis, the platform emits ",[35,2417,2418],{},"Exposure"," nodes with ",[35,2421,2422],{},"EXPLOITED_BY"," edges to MITRE techniques — ",[35,2425,719],{}," §5 aggregates those techniques and reports tactic coverage (see ",[29,2428,2092],{"href":2429},"\u002Fdethereal\u002Fsync-and-version-control",[18,2431],{},[14,2433,2434,2437,2438,2440],{},[48,2435,2436],{},"Next:"," ",[29,2439,2092],{"href":2429}," — push\u002Fpull, conflict handling, git integration",[2442,2443,2444],"style",{},"html pre.shiki code .sYgZi, html code.shiki .sYgZi{--shiki-default:#24292E;--shiki-dark:#ADBAC7}html pre.shiki code .snmFh, html code.shiki .snmFh{--shiki-default:#005CC5;--shiki-dark:#8DDB8C}html pre.shiki code .s-HuK, html code.shiki .s-HuK{--shiki-default:#032F62;--shiki-dark:#96D0FF}html pre.shiki code .sviXB, html code.shiki .sviXB{--shiki-default:#005CC5;--shiki-dark:#6CB6FF}html pre.shiki code .sNWHW, html code.shiki .sNWHW{--shiki-default:#B31D28;--shiki-default-font-style:italic;--shiki-dark:#FF938A;--shiki-dark-font-style:italic}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":242,"searchDepth":1828,"depth":1828,"links":2446},[2447,2455,2468,2473,2480],{"id":23,"depth":1811,"text":24,"children":2448},[2449,2450,2451,2452,2453,2454],{"id":42,"depth":1828,"text":43},{"id":252,"depth":1828,"text":253},{"id":324,"depth":1828,"text":325},{"id":429,"depth":1828,"text":430},{"id":442,"depth":1828,"text":443},{"id":482,"depth":1828,"text":483},{"id":495,"depth":1811,"text":496,"children":2456},[2457,2458,2459,2460,2461,2464,2465,2466,2467],{"id":507,"depth":1828,"text":508},{"id":604,"depth":1828,"text":605},{"id":702,"depth":1828,"text":703},{"id":944,"depth":1828,"text":945},{"id":1011,"depth":1828,"text":1012,"children":2462},[2463],{"id":1104,"depth":1841,"text":1105},{"id":1277,"depth":1828,"text":1278},{"id":1342,"depth":1828,"text":1343},{"id":1388,"depth":1828,"text":1389},{"id":1500,"depth":1828,"text":1501},{"id":1569,"depth":1811,"text":1570,"children":2469},[2470,2471,2472],{"id":1587,"depth":1828,"text":1588},{"id":1630,"depth":1828,"text":1631},{"id":1651,"depth":1828,"text":1652},{"id":1698,"depth":1811,"text":1699,"children":2474},[2475,2476,2477,2478,2479],{"id":1715,"depth":1828,"text":1716},{"id":1785,"depth":1828,"text":1786},{"id":2020,"depth":1828,"text":2021},{"id":2048,"depth":1828,"text":2049},{"id":2095,"depth":1828,"text":2096},{"id":2128,"depth":1811,"text":2129},"Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance","md",{"category":2484,"position":1863,"tags":2485},"documentation",[2486,2487,2488,2489,2490,2491],"dethereal","discovery","enrichment","mitre","credentials","compliance",true,"\u002Fdethereal\u002Fdiscovery-and-enrichment",{"title":5,"description":2481},"03.dethereal\u002F05.discovery-and-enrichment","70ODnqGfnhgKFgIE9f_I26yH_0lAYOGrEYprfik8BHU",[2498,2553,2588,2635,2669,2713,2728,2798],{"title":2499,"description":2500,"path":2501,"stem":2502,"children":2503,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[2504,2508,2513,2518,2523,2528,2533,2538,2543,2548],{"title":2505,"path":2501,"stem":2506,"description":2507},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":2509,"path":2510,"stem":2511,"description":2512},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":2514,"path":2515,"stem":2516,"description":2517},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":2519,"path":2520,"stem":2521,"description":2522},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":2524,"path":2525,"stem":2526,"description":2527},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":2529,"path":2530,"stem":2531,"description":2532},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":2534,"path":2535,"stem":2536,"description":2537},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":2539,"path":2540,"stem":2541,"description":2542},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":2544,"path":2545,"stem":2546,"description":2547},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":2549,"path":2550,"stem":2551,"description":2552},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":2554,"description":2555,"path":2556,"stem":2557,"children":2558,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[2559,2563,2568,2573,2578,2583],{"title":2560,"path":2556,"stem":2561,"description":2562},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":2564,"path":2565,"stem":2566,"description":2567},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":2569,"path":2570,"stem":2571,"description":2572},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":2574,"path":2575,"stem":2576,"description":2577},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":2579,"path":2580,"stem":2581,"description":2582},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":2584,"path":2585,"stem":2586,"description":2587},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":2589,"description":2590,"path":2591,"stem":2592,"children":2593,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[2594,2598,2603,2607,2612,2617,2618,2621,2625,2630],{"title":2595,"path":2591,"stem":2596,"description":2597},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":2599,"path":2600,"stem":2601,"description":2602},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":2604,"path":31,"stem":2605,"description":2606},"The 11-Step Guided Workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":2608,"path":2609,"stem":2610,"description":2611},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":2613,"path":2614,"stem":2615,"description":2616},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":5,"path":2493,"stem":2495,"description":2481},{"title":2092,"path":2429,"stem":2619,"description":2620},"03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":2622,"path":1384,"stem":2623,"description":2624},"Review and Attack Surface Analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":2626,"path":2627,"stem":2628,"description":2629},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":2631,"path":2632,"stem":2633,"description":2634},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":2636,"description":2637,"path":2638,"stem":2639,"children":2640,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[2641,2644,2649,2654,2659,2664],{"title":2636,"path":2638,"stem":2642,"description":2643},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":2645,"path":2646,"stem":2647,"description":2648},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":2650,"path":2651,"stem":2652,"description":2653},"Reading the Report","\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":2655,"path":2656,"stem":2657,"description":2658},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":2660,"path":2661,"stem":2662,"description":2663},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":2665,"path":2666,"stem":2667,"description":2668},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":2670,"description":2671,"path":2672,"stem":2673,"children":2674,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[2675,2679,2684,2689,2694,2699,2703,2708],{"title":2676,"path":2672,"stem":2677,"description":2678},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":2680,"path":2681,"stem":2682,"description":2683},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":2685,"path":2686,"stem":2687,"description":2688},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":2690,"path":2691,"stem":2692,"description":2693},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":2695,"path":2696,"stem":2697,"description":2698},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":2650,"path":2700,"stem":2701,"description":2702},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":2704,"path":2705,"stem":2706,"description":2707},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":2709,"path":2710,"stem":2711,"description":2712},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":2714,"description":2715,"path":2716,"stem":2717,"children":2718,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[2719,2723],{"title":2720,"path":2716,"stem":2721,"description":2722},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":2724,"path":2725,"stem":2726,"description":2727},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":2729,"description":2730,"path":2731,"stem":2732,"children":2733,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[2734,2738,2743,2748,2753,2758,2763,2768,2773,2778,2783,2788,2793],{"title":2735,"path":2731,"stem":2736,"description":2737},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":2739,"path":2740,"stem":2741,"description":2742},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":2744,"path":2745,"stem":2746,"description":2747},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":2749,"path":2750,"stem":2751,"description":2752},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":2754,"path":2755,"stem":2756,"description":2757},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":2759,"path":2760,"stem":2761,"description":2762},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":2764,"path":2765,"stem":2766,"description":2767},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":2769,"path":2770,"stem":2771,"description":2772},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":2774,"path":2775,"stem":2776,"description":2777},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":2779,"path":2780,"stem":2781,"description":2782},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":2784,"path":2785,"stem":2786,"description":2787},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":2789,"path":2790,"stem":2791,"description":2792},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":2794,"path":2795,"stem":2796,"description":2797},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":2799,"description":2800,"path":2801,"stem":2802,"children":2803,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[2804,2808,2813],{"title":2805,"path":2801,"stem":2806,"description":2807},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":2809,"path":2810,"stem":2811,"description":2812},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":2814,"path":2815,"stem":2816,"description":2817},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748185207]