[{"data":1,"prerenderedAt":2501},["ShallowReactive",2],{"page-\u002Fdethereal\u002Fmodel-concepts":3,"navigation":2184},{"id":4,"title":5,"body":6,"description":2170,"extension":2171,"meta":2172,"navigation":2179,"path":2180,"seo":2181,"stem":2182,"__hash__":2183},"docs\u002F03.dethereal\u002F04.model-concepts.md","Threat Model Concepts",{"type":7,"value":8,"toc":2117},"minimark",[9,13,17,20,25,33,36,38,42,58,160,173,175,179,186,246,252,254,258,261,266,273,283,289,295,302,306,309,368,382,386,397,509,528,538,561,575,587,589,593,596,602,606,609,613,616,675,680,682,686,689,693,754,758,769,863,873,877,889,993,1007,1011,1036,1038,1042,1046,1049,1067,1071,1074,1089,1092,1104,1106,1110,1114,1121,1338,1361,1387,1393,1397,1423,1425,1428,1431,1437,1462,1482,1484,1488,1494,1497,1516,1520,1523,1547,1554,1556,1560,1563,1569,1573,1576,1579,1582,1586,1589,1592,1595,1599,1602,1606,1626,1630,1637,1644,1646,1650,1653,1660,1663,1689,1696,1699,1777,1779,1782,1794,1798,1812,1816,1827,1990,1999,2003,2064,2068,2092,2103,2105,2113],[10,11,5],"h1",{"id":12},"threat-model-concepts",[14,15,16],"p",{},"A threat model is a structured representation of your system that captures what components exist, how they communicate, what data they handle, and what security controls protect them. This page explains the building blocks.",[18,19],"hr",{},[21,22,24],"h2",{"id":23},"methodology","Methodology",[14,26,27,28,32],{},"Dethereal's default methodology is ",[29,30,31],"strong",{},"STRIDE-per-element"," — the plugin systematically evaluates spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege for each component, boundary crossing, and data flow. This maps directly to the data flow diagram (DFD) modeling approach and integrates with MITRE ATT&CK for concrete technique identification.",[14,34,35],{},"The underlying data model is methodology-agnostic. STRIDE is the built-in interpretive overlay; the platform's module system can support additional methodologies (PASTA, attack trees) as analysis modules.",[18,37],{},[21,39,41],{"id":40},"model-scope","Model Scope",[14,43,44,45,48,49,53,54,57],{},"Before modeling the system you declare ",[29,46,47],{},"scope"," — the framing that tells analysis what this model is for and what to hold constant. Scope is set at scope-definition time (e.g. via ",[50,51,52],"code",{},"\u002Fdethereal:create","), stored on the model itself, and round-trips through ",[50,55,56],{},".dethereal\u002Fscope.json"," on sync:",[59,60,66],"div",{"className":61,"tabIndex":63,"role":64,"ariaLabel":65},[62],"table-frame",0,"region","Table: Model Scope",[67,68,69,82],"table",{},[70,71,72],"thead",{},[73,74,75,79],"tr",{},[76,77,78],"th",{},"Field",[76,80,81],{},"Meaning",[83,84,85,108,130,140,150],"tbody",{},[73,86,87,93],{},[88,89,90],"td",{},[29,91,92],{},"Depth",[88,94,95,96,99,100,103,104,107],{},"How deep the model reasons: ",[50,97,98],{},"architecture",", ",[50,101,102],{},"design",", or ",[50,105,106],{},"implementation",".",[73,109,110,115],{},[88,111,112],{},[29,113,114],{},"Modeling intent",[88,116,117,118,99,121,99,124,103,127,107],{},"Why the model exists: ",[50,119,120],{},"initial",[50,122,123],{},"security_review",[50,125,126],{},"compliance",[50,128,129],{},"incident_response",[73,131,132,137],{},[88,133,134],{},[29,135,136],{},"Compliance drivers",[88,138,139],{},"Regulatory\u002Fstandards obligations in scope (e.g. PCI-DSS, HIPAA) — these drive which compliance prompts appear during enrichment.",[73,141,142,147],{},[88,143,144],{},[29,145,146],{},"Exclusions",[88,148,149],{},"What you deliberately put out of scope, so analysis doesn't fault their absence.",[73,151,152,157],{},[88,153,154],{},[29,155,156],{},"Trust assumptions",[88,158,159],{},"What the model treats as trusted (e.g. \"cloud control plane is trusted\").",[14,161,162,163,166,167,172],{},"Scope is ",[29,164,165],{},"seed context for analysis",", not a score — it shapes which findings matter rather than computing risk directly. Crown jewels are also declared at scope-definition time (see ",[168,169,171],"a",{"href":170},"#crown-jewels","Crown Jewels",").",[18,174],{},[21,176,178],{"id":177},"components","Components",[14,180,181,182,185],{},"Components are the things in your system. Every component has a ",[29,183,184],{},"type"," that determines its behavior in security analysis:",[59,187,190],{"className":188,"tabIndex":63,"role":64,"ariaLabel":189},[62],"Table: Components",[67,191,192,205],{},[70,193,194],{},[73,195,196,199,202],{},[76,197,198],{},"Type",[76,200,201],{},"What It Represents",[76,203,204],{},"Examples",[83,206,207,220,233],{},[73,208,209,214,217],{},[88,210,211],{},[29,212,213],{},"PROCESS",[88,215,216],{},"Running software that processes data",[88,218,219],{},"API servers, web applications, workers, microservices",[73,221,222,227,230],{},[88,223,224],{},[29,225,226],{},"STORE",[88,228,229],{},"Anything that persists data",[88,231,232],{},"Databases, caches, file storage, message queues",[73,234,235,240,243],{},[88,236,237],{},[29,238,239],{},"EXTERNAL_ENTITY",[88,241,242],{},"People or systems outside your control",[88,244,245],{},"End users, third-party APIs, OAuth providers",[14,247,248,251],{},[29,249,250],{},"Why types matter:"," The analysis engine treats each type differently. A STORE holding credentials has different threat implications than a PROCESS routing traffic. STORE components must be classified for data sensitivity analysis to work — this is why the classification quality gate requires 100% STORE classification.",[18,253],{},[21,255,257],{"id":256},"trust-boundaries","Trust Boundaries",[14,259,260],{},"Trust boundaries define security zones in your architecture. They represent where the rules change — different network segments, different authentication requirements, different access controls.",[262,263,265],"h3",{"id":264},"why-hierarchy-matters","Why Hierarchy Matters",[14,267,268,269,272],{},"A ",[29,270,271],{},"flat"," model loses security context:",[274,275,280],"pre",{"className":276,"code":278,"language":279},[277],"language-text","defaultBoundary\u002F\n├── User (EXTERNAL_ENTITY)\n├── Web Server (PROCESS)\n├── API Server (PROCESS)\n└── Database (STORE)\n","text",[50,281,278],{"__ignoreMap":282},"",[14,284,268,285,288],{},[29,286,287],{},"hierarchical"," model captures trust transitions:",[274,290,293],{"className":291,"code":292,"language":279},[277],"defaultBoundary\u002F\n├── Internet Zone\u002F\n│   └── User (EXTERNAL_ENTITY)\n├── DMZ\u002F\n│   └── Web Server (PROCESS)\n└── Internal Network\u002F\n    ├── Application Tier\u002F\n    │   └── API Server (PROCESS)\n    └── Data Tier\u002F\n        └── Database (STORE)\n",[50,294,292],{"__ignoreMap":282},[14,296,297,298,301],{},"The analysis engine identifies threats at ",[29,299,300],{},"boundary crossings"," — data flows that move between trust zones. A flat model has no boundary crossings, so the analysis has nothing to work with.",[262,303,305],{"id":304},"boundary-enforcement-attributes","Boundary Enforcement Attributes",[14,307,308],{},"Each boundary can have enforcement attributes that describe how it controls traffic:",[59,310,313],{"className":311,"tabIndex":63,"role":64,"ariaLabel":312},[62],"Table: Boundary Enforcement Attributes",[67,314,315,328],{},[70,316,317],{},[73,318,319,322,325],{},[76,320,321],{},"Attribute",[76,323,324],{},"Values",[76,326,327],{},"What It Means",[83,329,330,343,355],{},[73,331,332,337,340],{},[88,333,334],{},[50,335,336],{},"implicit_deny_enabled",[88,338,339],{},"true \u002F false",[88,341,342],{},"Boundary blocks traffic by default",[73,344,345,350,352],{},[88,346,347],{},[50,348,349],{},"allow_any_inbound",[88,351,339],{},[88,353,354],{},"Boundary allows unrestricted inbound",[73,356,357,362,365],{},[88,358,359],{},[50,360,361],{},"egress_filtering",[88,363,364],{},"deny_all \u002F allow_list \u002F allow_all \u002F unknown",[88,366,367],{},"Outbound traffic policy",[14,369,370,371,374,375,378,379,107],{},"These attributes feed into the attack surface analysis — a boundary with ",[50,372,373],{},"implicit_deny_enabled: true"," and ",[50,376,377],{},"egress_filtering: deny_all"," provides stronger isolation than one with ",[50,380,381],{},"allow_any_inbound: true",[262,383,385],{"id":384},"trust-zones-planes-domains-and-conduits","Trust Zones, Planes, Domains, and Conduits",[14,387,388,389,392,393,396],{},"Beyond enforcement posture, each boundary can carry ",[29,390,391],{},"zoning"," — your declared segmentation intent. Zoning is stored on the boundary in ",[50,394,395],{},"structure.json"," and round-trips to the platform:",[59,398,401],{"className":399,"tabIndex":63,"role":64,"ariaLabel":400},[62],"Table: Trust Zones, Planes, Domains, and Conduits",[67,402,403,412],{},[70,404,405],{},[73,406,407,409],{},[76,408,78],{},[76,410,411],{},"What It Captures",[83,413,414,451,472,492],{},[73,415,416,421],{},[88,417,418],{},[50,419,420],{},"zone",[88,422,423,424,427,428,432,433,99,436,99,439,99,442,99,445,103,448,107],{},"The ",[29,425,426],{},"trust zone"," — the exposure tier the boundary sits on: ",[429,430,431],"em",{},"who can reach it",". One of ",[50,434,435],{},"UNTRUSTED",[50,437,438],{},"PUBLIC",[50,440,441],{},"EXPOSED",[50,443,444],{},"INTERNAL",[50,446,447],{},"RESTRICTED",[50,449,450],{},"VENDOR",[73,452,453,458],{},[88,454,455],{},[50,456,457],{},"planes",[88,459,460,461,464,465,99,468,471],{},"The boundary's operational ",[29,462,463],{},"role",": ",[50,466,467],{},"WORKLOAD",[50,469,470],{},"MANAGEMENT",", or both.",[73,473,474,479],{},[88,475,476],{},[50,477,478],{},"domains",[88,480,481,482,485,486,99,489,172],{},"Free-text business-function ",[29,483,484],{},"tags"," (e.g. ",[50,487,488],{},"payments",[50,490,491],{},"identity",[73,493,494,499],{},[88,495,496],{},[50,497,498],{},"conduits",[88,500,501,504,505,508],{},[29,502,503],{},"Approved channels"," — directional peer boundaries this one is ",[429,506,507],{},"meant"," to talk to, each with an optional justification.",[14,510,511,514,515,517,518,521,522,524,525,527],{},[29,512,513],{},"A trust zone inherits down."," A boundary with no zone of its own takes the zone of its nearest declaring ancestor; if nothing up the chain declares one, it falls back to the default ",[50,516,444],{}," (and is flagged). Set a zone explicitly wherever the trust level genuinely changes — especially when a child is ",[429,519,520],{},"stricter"," than its parent (a ",[50,523,447],{}," store inside an ",[50,526,444],{}," tier), since inheritance would otherwise understate it.",[14,529,530,533,534,537],{},[29,531,532],{},"Structural containers abstain — zone the leaves, not the wrapper."," A boundary that mainly ",[429,535,536],{},"nests"," other boundaries (a VPC, a Kubernetes cluster, a cloud account) usually spans several tiers at once, so no single zone is correct for it. Leave it unset and zone the leaf boundaries inside; the review shows the container's span as a display roll-up rather than forcing one zone onto the whole subtree.",[14,539,540,543,544,547,548,551,552,554,555,557,558,560],{},[29,541,542],{},"Domains and planes are tags, not structure."," Use them to describe ",[429,545,546],{},"what"," a boundary is for and ",[429,549,550],{},"how"," it operates, separate from ",[429,553,431],{},". Model identity, compute-node, location, and business grouping as ",[50,556,478],{},"\u002F",[50,559,457],{}," tags rather than as zone-bearing boundaries.",[14,562,563,566,567,570,571,574],{},[29,564,565],{},"Conduits are approved crossings."," A conduit records that a boundary is ",[429,568,569],{},"supposed"," to communicate with a peer, in a chosen direction, with a reason. It is declared design intent — the platform records it but does ",[29,572,573],{},"not"," verify or enforce it. Whether the real flows match your declared conduits is the job of security analysis, which reads your zoning as its baseline.",[14,576,577,578,582,583,107],{},"Zoning is authored two ways that write the same fields: the guided workflow ratifies it step by step (see ",[168,579,581],{"href":580},"\u002Fdethereal\u002Fguided-workflow","Guided Workflow","), and the platform GUI edits it directly. For the complete how-to — inheritance rules, the Zoning overview, worked examples — see the platform guide ",[168,584,586],{"href":585},"\u002Fplatform\u002Fboundary-trust-zones","Boundary Trust Zones",[18,588],{},[21,590,592],{"id":591},"data-flows","Data Flows",[14,594,595],{},"Data flows are directed connections between components. They represent who talks to whom, using what protocol.",[274,597,600],{"className":598,"code":599,"language":279},[277],"API Server → PostgreSQL: SQL queries (TLS 1.3)\nEnd Users → Web Server: HTTPS requests\n",[50,601,599],{"__ignoreMap":282},[262,603,605],{"id":604},"cross-boundary-flows","Cross-Boundary Flows",[14,607,608],{},"When a data flow crosses a trust boundary (source and target are in different boundaries), it becomes high-priority for security analysis. Cross-boundary flows are where authentication, encryption, and access controls are most critical.",[262,610,612],{"id":611},"flow-attributes","Flow Attributes",[14,614,615],{},"Data flows can carry security attributes:",[59,617,620],{"className":618,"tabIndex":63,"role":64,"ariaLabel":619},[62],"Table: Flow Attributes",[67,621,622,631],{},[70,623,624],{},[73,625,626,628],{},[76,627,321],{},[76,629,630],{},"Purpose",[83,632,633,643,665],{},[73,634,635,640],{},[88,636,637],{},[50,638,639],{},"required_credentials",[88,641,642],{},"Which credentials are needed for this flow (drives lateral movement analysis)",[73,644,645,650],{},[88,646,647],{},[50,648,649],{},"auth_failure_mode",[88,651,652,653,99,656,99,659,99,662],{},"What happens when authentication fails: ",[50,654,655],{},"deny",[50,657,658],{},"fallback",[50,660,661],{},"fail_open",[50,663,664],{},"unknown",[73,666,667,672],{},[88,668,669],{},[50,670,671],{},"encryption_in_transit",[88,673,674],{},"TLS version, mTLS, none",[14,676,423,677,679],{},[50,678,649],{}," is particularly important — a flow that appears authenticated but fails open under error conditions provides no security guarantee.",[18,681],{},[21,683,685],{"id":684},"data-items","Data Items",[14,687,688],{},"Data items classify what data flows carry. They're attached to data flows and describe the sensitivity of the information.",[262,690,692],{"id":691},"sensitivity-levels","Sensitivity Levels",[59,694,697],{"className":695,"tabIndex":63,"role":64,"ariaLabel":696},[62],"Table: Sensitivity Levels",[67,698,699,708],{},[70,700,701],{},[73,702,703,706],{},[76,704,705],{},"Level",[76,707,204],{},[83,709,710,721,732,743],{},[73,711,712,718],{},[88,713,714,717],{},[29,715,716],{},"Restricted"," (Tier 1)",[88,719,720],{},"Regulated PII, cardholder data, credentials, health records",[73,722,723,729],{},[88,724,725,728],{},[29,726,727],{},"Confidential"," (Tier 2)",[88,730,731],{},"Internal business data, session tokens, API keys",[73,733,734,740],{},[88,735,736,739],{},[29,737,738],{},"Internal"," (Tier 3)",[88,741,742],{},"Internal operational data, metrics",[73,744,745,751],{},[88,746,747,750],{},[29,748,749],{},"Public"," (Tier 4)",[88,752,753],{},"Public content, documentation",[262,755,757],{"id":756},"regulatory-labels","Regulatory Labels",[14,759,760,761,764,765,768],{},"Data items can carry ",[29,762,763],{},"regulatory flags"," — free-text compliance labels, kept separate from the sensitivity level. The recommended canonical set (matched ",[29,766,767],{},"exactly and case-sensitively"," by the platform's compliance queries, so spelling and case matter):",[59,770,773],{"className":771,"tabIndex":63,"role":64,"ariaLabel":772},[62],"Table: Regulatory Labels",[67,774,775,788],{},[70,776,777],{},[73,778,779,782,785],{},[76,780,781],{},"Label",[76,783,784],{},"Framework",[76,786,787],{},"Sensitivity floor",[83,789,790,802,814,827,839,851],{},[73,791,792,797,800],{},[88,793,794],{},[50,795,796],{},"PCI cardholder",[88,798,799],{},"PCI-DSS",[88,801,716],{},[73,803,804,809,812],{},[88,805,806],{},[50,807,808],{},"PHI",[88,810,811],{},"HIPAA",[88,813,716],{},[73,815,816,821,824],{},[88,817,818],{},[50,819,820],{},"GDPR personal",[88,822,823],{},"GDPR",[88,825,826],{},"Confidential (special-category data is Restricted)",[73,828,829,834,837],{},[88,830,831],{},[50,832,833],{},"PII",[88,835,836],{},"General",[88,838,727],{},[73,840,841,846,849],{},[88,842,843],{},[50,844,845],{},"SOX financial",[88,847,848],{},"SOX",[88,850,727],{},[73,852,853,858,861],{},[88,854,855],{},[50,856,857],{},"CCPA personal",[88,859,860],{},"CCPA",[88,862,727],{},[14,864,865,866,872],{},"A data item may carry several flags; its sensitivity is the highest applicable floor. This set is the ",[168,867,871],{"href":868,"rel":869},"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Fblob\u002Fmain\u002Fdocs\u002Farchitecture\u002Fdethereal\u002FTHREAT_MODELING_WORKFLOW.md#canonical-sensitivity-and-regulatory-flag-vocabulary",[870],"nofollow","single source of truth in the architecture docs"," — it's extensible, but emit the canonical casing so scope queries match. Your compliance drivers (set during scope definition) determine which regulatory prompts appear during enrichment.",[262,874,876],{"id":875},"origin","Origin",[14,878,879,881,882,884,885,888],{},[29,880,876],{}," records who can write a data item's content (",[50,883,875],{}," in ",[50,886,887],{},"data-items.json","). From most to least trusted:",[59,890,893],{"className":891,"tabIndex":63,"role":64,"ariaLabel":892},[62],"Table: Origin",[67,894,895,906],{},[70,896,897],{},[73,898,899,901,903],{},[76,900,876],{},[76,902,81],{},[76,904,905],{},"Untrusted",[83,907,908,920,932,944,956,969,981],{},[73,909,910,915,918],{},[88,911,912],{},[50,913,914],{},"authenticated_first_party",[88,916,917],{},"Written only by the operator's own authenticated users or systems",[88,919],{},[73,921,922,927,930],{},[88,923,924],{},[50,925,926],{},"curated_internal",[88,928,929],{},"Internal content that passed a review or curation step",[88,931],{},[73,933,934,939,942],{},[88,935,936],{},[50,937,938],{},"agent_relayed",[88,940,941],{},"Produced or forwarded by another agent; at most this trusted",[88,943],{},[73,945,946,951,954],{},[88,947,948],{},[50,949,950],{},"model_generated",[88,952,953],{},"Written by a model and later read as input; at most this trusted",[88,955],{},[73,957,958,963,966],{},[88,959,960],{},[50,961,962],{},"third_party",[88,964,965],{},"Written by a known external party under an agreement",[88,967,968],{},"yes",[73,970,971,976,979],{},[88,972,973],{},[50,974,975],{},"arbitrary_public",[88,977,978],{},"Anyone can write it",[88,980,968],{},[73,982,983,988,991],{},[88,984,985],{},[50,986,987],{},"not_assessed",[88,989,990],{},"Answered as not established; treated as untrusted",[88,992,968],{},[14,994,995,996,998,999,1001,1002,107],{},"Use the least-trusted source of what the item holds — one public source makes it ",[50,997,975],{},". Leave it absent when you don't know; absent is not the same as ",[50,1000,987],{},". See the ",[168,1003,1006],{"href":1004,"rel":1005},"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Fblob\u002Fmain\u002Fdocs\u002Farchitecture\u002Fdethereal\u002FTHREAT_MODELING_WORKFLOW.md#canonical-data-origin-and-credential-vocabulary",[870],"canonical data-origin and credential vocabulary",[262,1008,1010],{"id":1009},"credential-flag","Credential Flag",[14,1012,1013,1018,1019,99,1022,1025,1026,1028,1029,1031,1032,107],{},[29,1014,1015],{},[50,1016,1017],{},"is_credential"," records whether the data item is a credential — a password, token, key, secret, or certificate. It is ",[50,1020,1021],{},"true",[50,1023,1024],{},"false",", or absent (unknown). When an item is bound to a credential-like data class and the flag is unanswered, enrichment proposes ",[50,1027,1021],{}," for you to confirm; it never sets the flag on its own, and an answered ",[50,1030,1024],{}," is kept. See ",[168,1033,1035],{"href":1034},"\u002Fdethereal\u002Fdiscovery-and-enrichment#origin-and-credential-flag","Discovery and Enrichment",[18,1037],{},[21,1039,1041],{"id":1040},"classes-and-modules","Classes and Modules",[262,1043,1045],{"id":1044},"what-classes-are","What Classes Are",[14,1047,1048],{},"Classes are predefined types from the platform's module system. When you classify a component as \"Database\" or \"Web Application,\" you're assigning it a class that comes with:",[1050,1051,1052,1056,1064],"ul",{},[1053,1054,1055],"li",{},"An attribute schema (which security properties are relevant)",[1053,1057,1058,1059,1063],{},"Schema default values, which describe the class rather than your system — they are not written into your model; every field starts empty and enrichment fills it from evidence or from you (see ",[168,1060,1062],{"href":1061},"\u002Fdethereal\u002Fdiscovery-and-enrichment#class-templates-drive-the-questions","Class Templates Drive the Questions",")",[1053,1065,1066],{},"Guidance for enrichment",[262,1068,1070],{"id":1069},"how-classification-works","How Classification Works",[14,1072,1073],{},"Classification happens in two passes:",[1075,1076,1077,1083],"ol",{},[1053,1078,1079,1082],{},[29,1080,1081],{},"Deterministic (Pass 1):"," The plugin queries the platform for available classes and matches components by name and type. \"PostgreSQL\" matches \"Database\" with high confidence — no AI needed.",[1053,1084,1085,1088],{},[29,1086,1087],{},"LLM-assisted (Pass 2):"," For ambiguous components, the AI proposes classes based on boundary context and peer components.",[14,1090,1091],{},"You always confirm classifications before they're written. The plugin never auto-classifies without showing you what it's doing.",[14,1093,1094,1095,1099,1100,107],{},"For more on the classification process, see the ",[168,1096,1098],{"href":1097},"\u002Fdethereal\u002Fcommand-reference#detherealclassify","classify command"," or the platform's ",[168,1101,1103],{"href":1102},"\u002Fplatform\u002Fcomponent-configuration-guide","Component Configuration Guide",[18,1105],{},[21,1107,1109],{"id":1108},"security-attributes","Security Attributes",[262,1111,1113],{"id":1112},"the-6-key-component-attributes","The 6 Key Component Attributes",[14,1115,1116,1117,1120],{},"A floor of six security properties that enrichment captures on every in-scope component, whatever its class template happens to cover. Four have a component attribute key; encryption in transit is recorded on the data flow, and logging has no scored key. The ",[29,1118,1119],{},"attribute key"," column is what you must write — the scorer reads these literal names:",[59,1122,1125],{"className":1123,"tabIndex":63,"role":64,"ariaLabel":1124},[62],"Table: The 6 Key Component Attributes",[67,1126,1127,1146],{},[70,1128,1129],{},[73,1130,1131,1134,1137,1140,1143],{},[76,1132,1133],{},"#",[76,1135,1136],{},"Concept",[76,1138,1139],{},"Attribute key",[76,1141,1142],{},"Written on",[76,1144,1145],{},"Value the scorer accepts",[83,1147,1148,1191,1229,1263,1282,1302],{},[73,1149,1150,1153,1156,1161,1164],{},[88,1151,1152],{},"1",[88,1154,1155],{},"Authentication",[88,1157,1158],{},[50,1159,1160],{},"authentication_type",[88,1162,1163],{},"component",[88,1165,1166,1167,99,1170,99,1173,1176,1177,1180,1181,557,1184,1187,1188,1190],{},"String — e.g. ",[50,1168,1169],{},"oauth2",[50,1171,1172],{},"mtls",[50,1174,1175],{},"sso",". ",[50,1178,1179],{},"none"," does not count. ",[50,1182,1183],{},"basic",[50,1185,1186],{},"digest"," count only when ",[50,1189,671],{}," is a non-deprecated string",[73,1192,1193,1196,1199,1203,1209],{},[88,1194,1195],{},"2",[88,1197,1198],{},"Encryption in transit",[88,1200,1201],{},[50,1202,671],{},[88,1204,1205,1208],{},[29,1206,1207],{},"data flow"," (and component where meaningful)",[88,1210,1166,1211,1214,1215,99,1217,99,1220,99,1223,99,1226],{},[50,1212,1213],{},"TLS 1.3",". Rejected: ",[50,1216,1179],{},[50,1218,1219],{},"sslv3",[50,1221,1222],{},"ssl v3",[50,1224,1225],{},"tls 1.0",[50,1227,1228],{},"tls1.0",[73,1230,1231,1234,1237,1242,1244],{},[88,1232,1233],{},"3",[88,1235,1236],{},"Encryption at rest",[88,1238,1239],{},[50,1240,1241],{},"encryption_at_rest",[88,1243,1163],{},[88,1245,1166,1246,1214,1249,99,1251,99,1254,99,1257,99,1260],{},[50,1247,1248],{},"AES-256",[50,1250,1179],{},[50,1252,1253],{},"des",[50,1255,1256],{},"3des",[50,1258,1259],{},"triple-des",[50,1261,1262],{},"rc4",[73,1264,1265,1268,1271,1276,1279],{},[88,1266,1267],{},"4",[88,1269,1270],{},"Logging",[88,1272,1273],{},[429,1274,1275],{},"(no scored key)",[88,1277,1278],{},"—",[88,1280,1281],{},"Captured by the class template; nothing reads a floor-level key for this one",[73,1283,1284,1287,1290,1294,1297],{},[88,1285,1286],{},"5",[88,1288,1289],{},"Access control",[88,1291,1292],{},[50,1293,336],{},[88,1295,1296],{},"component (boundaries too, but only the component value is scored)",[88,1298,1299,1300],{},"Boolean ",[50,1301,1021],{},[73,1303,1304,1307,1310,1315,1317],{},[88,1305,1306],{},"6",[88,1308,1309],{},"Log telemetry",[88,1311,1312],{},[50,1313,1314],{},"monitoring_tools",[88,1316,1163],{},[88,1318,1319,1320,1323,1324,557,1326,1329,1330,1333,1334,1337],{},"Non-empty ",[50,1321,1322],{},"string[]"," after discarding ",[50,1325,1179],{},[50,1327,1328],{},"n\u002Fa",". Use ",[50,1331,1332],{},"[]",", never ",[50,1335,1336],{},"[\"None\"]",". Components with no monitoring tools are detection blind spots",[14,1339,1340,1343,1344,1347,1348,99,1351,1354,1355,1357,1358,1360],{},[29,1341,1342],{},"Write these key names literally."," ",[50,1345,1346],{},"control_coverage_rate"," (10 points of the quality score) and the attack-surface report's encryption and authentication coverage read these exact keys and no others — a semantically equivalent name that a class template happens to use (",[50,1349,1350],{},"transit_encryption_enforced",[50,1352,1353],{},"tls_enabled",", …) does not satisfy the floor. Types are strict too: a boolean ",[50,1356,1021],{}," for ",[50,1359,1241],{}," scores as absent, because that key wants the concrete algorithm string.",[14,1362,1363,1364,1366,1367,1370,1371,1374,1375,99,1377,99,1379,99,1381,1383,1384,107],{},"Note that ",[50,1365,671],{}," is scored ",[29,1368,1369],{},"per cross-boundary data flow",", not per component — it belongs on the flow's attribute file under ",[50,1372,1373],{},"attributes\u002FdataFlows\u002F",". The other scored keys (",[50,1376,1160],{},[50,1378,1241],{},[50,1380,336],{},[50,1382,1314],{},") are component attributes, stored in individual files under ",[50,1385,1386],{},"attributes\u002Fcomponents\u002F",[14,1388,1389,1390,107],{},"These attributes are a floor, not the whole enrichment job: the primary pass resolves every field declared by each element's assigned class template. See ",[168,1391,1035],{"href":1392},"\u002Fdethereal\u002Fdiscovery-and-enrichment",[262,1394,1396],{"id":1395},"additional-attributes","Additional Attributes",[1050,1398,1399,1407,1415],{},[1053,1400,1401,1406],{},[29,1402,1403],{},[50,1404,1405],{},"asset_criticality"," — high\u002Fmedium\u002Flow, the business impact of compromise",[1053,1408,1409,1414],{},[29,1410,1411],{},[50,1412,1413],{},"stores_credentials"," — true for STORE components that hold credential material",[1053,1416,1417,1422],{},[29,1418,1419],{},[50,1420,1421],{},"credential_scope"," — which credential identifiers are stored (drives lateral movement analysis)",[18,1424],{},[21,1426,171],{"id":1427},"crown-jewels",[14,1429,1430],{},"Crown jewels are your most valuable assets — the data or capabilities an attacker would target. You name them during scope definition:",[274,1432,1435],{"className":1433,"code":1434,"language":279},[277],"Crown jewels: [\"Cardholder data\", \"User PII\", \"API authentication keys\"]\n",[50,1436,1434],{"__ignoreMap":282},[14,1438,1439,1440,1443,1444,1446,1447,1450,1451,1454,1455,1458,1459,1461],{},"During classification, these free-text names are fuzzy-matched to actual components and tagged with ",[50,1441,1442],{},"crownJewel: true"," on the component in ",[50,1445,395],{}," (the first-class ",[50,1448,1449],{},"Component.crownJewel"," field, synced to the platform). Crown-jewel marks are tracked ",[29,1452,1453],{},"per component","; marking a data item, boundary, or flow stays local. Besides this AI classify path, crown jewels can also be toggled per component ",[29,1456,1457],{},"directly in the GUI"," (component settings → General tab → crown button) — both write the same ",[50,1460,1449],{}," field. Crown jewels receive priority treatment:",[1050,1463,1464,1470,1476],{},[1053,1465,1466,1469],{},[29,1467,1468],{},"Enrichment tier 1"," — enriched first, with the most thorough prompts",[1053,1471,1472,1475],{},[29,1473,1474],{},"Control gap analysis"," — crown jewels without controls are flagged as highest-priority gaps",[1053,1477,1478,1481],{},[29,1479,1480],{},"Attack surface"," — appear in the top tier of the surface analysis",[18,1483],{},[21,1485,1487],{"id":1486},"quality-scoring","Quality Scoring",[14,1489,1490,1491,1493],{},"The quality score (0-100) measures how completely your model captures the system. It is ",[29,1492,573],{}," a security rating — a model with 95\u002F100 quality could describe a system with critical vulnerabilities. The score reflects modeling completeness, not security posture.",[14,1495,1496],{},"The score is computed from 7 weighted factors: component classification (25), attribute completion (20), boundary hierarchy (15), data flow coverage (15), data classification (10), control coverage (10), and credential coverage (5).",[14,1498,1499,1500,1503,1504,1507,1508,1511,1512,1515],{},"Score labels: ",[29,1501,1502],{},"Starting"," (0-39), ",[29,1505,1506],{},"In Progress"," (40-69), ",[29,1509,1510],{},"Good"," (70-89), ",[29,1513,1514],{},"Comprehensive"," (90-100). Analysis readiness requires 70+.",[262,1517,1519],{"id":1518},"the-3-quality-gates","The 3 Quality Gates",[14,1521,1522],{},"Three progressive gates enforce increasing strictness:",[1050,1524,1525,1531,1541],{},[1053,1526,1527,1530],{},[29,1528,1529],{},"Gate 1 (Creation, advisory)"," — flags structural issues without blocking: missing classifications, unnamed flows, single-component boundaries",[1053,1532,1533,1536,1537,1540],{},[29,1534,1535],{},"Gate 2 (Sync, blocking)"," — must pass before ",[50,1538,1539],{},"\u002Fdethereal:sync push",": manifest completeness, structure validity, reference integrity",[1053,1542,1543,1546],{},[29,1544,1545],{},"Gate 3 (Analysis, blocking)"," — must pass for meaningful analysis: 100% classification, >= 80% attribute completion, data items classified for sensitive flows, >= 1 cross-boundary flow",[14,1548,1549,1550,107],{},"For the full factor breakdown, gate criteria, and example output, see ",[168,1551,1553],{"href":1552},"\u002Fdethereal\u002Freview-and-analysis#quality-review-detherealreview","Review and Analysis",[18,1555],{},[21,1557,1559],{"id":1558},"the-split-file-directory-format","The Split-File Directory Format",[14,1561,1562],{},"Threat models are stored as a directory of JSON files:",[274,1564,1567],{"className":1565,"code":1566,"language":279},[277],"threat-models\u002Fmy-system\u002F\n├── manifest.json          # Model metadata\n├── structure.json         # Boundary and component hierarchy\n├── dataflows.json         # Data flow connections\n├── data-items.json        # Data classifications\n├── README.md              # Auto-generated summary\n├── .dethereal\u002F            # Workflow metadata\n│   ├── state.json         # Current workflow state\n│   ├── scope.json         # Scope definition\n│   ├── quality.json       # Quality score cache\n│   ├── discovery.json     # Discovery provenance (gitignore)\n│   ├── sync.json          # Sync metadata (gitignore)\n│   ├── control-audit.log  # Append-only control-decision ledger (commit)\n│   ├── class-cache\u002F       # Cached class templates and guides\n│   │   └── {class-id}.json\n│   └── template-fields\u002F   # Per-element template field manifests\n│       └── {element-id}.json\n├── attributes\u002F            # Per-element security attributes\n│   ├── boundaries\u002F\n│   │   └── {id}.json\n│   ├── components\u002F\n│   │   └── {id}.json\n│   ├── dataFlows\u002F\n│   │   └── {id}.json\n│   └── dataItems\u002F\n│       └── {id}.json\n└── controls\u002F              # Per-Control library files (one per referenced Control)\n    └── {id}.json\n",[50,1568,1566],{"__ignoreMap":282},[262,1570,1572],{"id":1571},"manifestjson","manifest.json",[14,1574,1575],{},"Model metadata: name, description, and which platform modules it uses.",[262,1577,395],{"id":1578},"structurejson",[14,1580,1581],{},"The hierarchy of trust boundaries and components, with visual coordinates for diagram rendering. This is where the boundary tree lives.",[262,1583,1585],{"id":1584},"dataflowsjson","dataflows.json",[14,1587,1588],{},"An array of directed connections between components. Each flow has a source, target, protocol, and description.",[262,1590,887],{"id":1591},"data-itemsjson",[14,1593,1594],{},"An array of data classification items attached to data flows. Captures what sensitive data is flowing through the system.",[262,1596,1598],{"id":1597},"attributes","attributes\u002F",[14,1600,1601],{},"Per-element attribute files containing security properties. Each element type has its own subdirectory. Attribute files are created during classification (as stubs) and populated during enrichment.",[262,1603,1605],{"id":1604},"controls","controls\u002F",[14,1607,1608,1609,1612,1613,1615,1616,1615,1618,1620,1621,1625],{},"Per-Control files for the control library. Each Control referenced by the model (via ",[50,1610,1611],{},"controls[]"," on a component, boundary, flow, or data item in ",[50,1614,395],{}," \u002F ",[50,1617,1585],{},[50,1619,887],{},") gets a file here. See ",[168,1622,1624],{"href":1623},"#controls-and-the-control-library","Controls and the Control Library"," below.",[262,1627,1629],{"id":1628},"id-handling","ID Handling",[14,1631,1632,1633,1636],{},"When you create a model locally, components get ",[29,1634,1635],{},"temporary reference IDs"," (UUIDs). These link elements together (e.g., a data flow's source\u002Ftarget IDs reference components in structure.json).",[14,1638,1639,1640,1643],{},"After pushing to the platform, the server assigns ",[29,1641,1642],{},"permanent IDs"," that are written back to your local files. The original temporary IDs become obsolete.",[18,1645],{},[21,1647,1649],{"id":1648},"metadata-directories","Metadata Directories",[14,1651,1652],{},"Two metadata directories track plugin state:",[262,1654,1656,1659],{"id":1655},"dethernety-project-root",[50,1657,1658],{},".dethernety\u002F"," (Project Root)",[14,1661,1662],{},"Plugin-level metadata shared across models:",[1050,1664,1665,1673,1681],{},[1053,1666,1667,1672],{},[29,1668,1669],{},[50,1670,1671],{},"models.json"," — registry of all local models with names, paths, and timestamps",[1053,1674,1675,1680],{},[29,1676,1677],{},[50,1678,1679],{},"discovery-cache.json"," — cached discovery results for multi-model projects (gitignore)",[1053,1682,1683,1688],{},[29,1684,1685],{},[50,1686,1687],{},"decomposition-plan.json"," — multi-model decomposition plan (when modeling complex systems)",[262,1690,1692,1695],{"id":1691},"dethereal-per-model",[50,1693,1694],{},".dethereal\u002F"," (Per Model)",[14,1697,1698],{},"Per-model workflow metadata inside each model directory:",[1050,1700,1701,1709,1717,1725,1733,1741,1749,1769],{},[1053,1702,1703,1708],{},[29,1704,1705],{},[50,1706,1707],{},"state.json"," — current workflow state and completed states",[1053,1710,1711,1716],{},[29,1712,1713],{},[50,1714,1715],{},"scope.json"," — scope definition (crown jewels, compliance drivers, etc.)",[1053,1718,1719,1724],{},[29,1720,1721],{},[50,1722,1723],{},"quality.json"," — cached quality score (deleted on backward transitions)",[1053,1726,1727,1732],{},[29,1728,1729],{},[50,1730,1731],{},"discovery.json"," — discovery provenance (gitignore — may contain infrastructure details)",[1053,1734,1735,1740],{},[29,1736,1737],{},[50,1738,1739],{},"sync.json"," — sync metadata (gitignore — per-user state)",[1053,1742,1743,1748],{},[29,1744,1745],{},[50,1746,1747],{},"control-audit.log"," — append-only ledger of shared-ownership control decisions",[1053,1750,1751,1756,1757,1760,1761,1764,1765,1768],{},[29,1752,1753],{},[50,1754,1755],{},"class-cache\u002F"," — class templates and configuration guides cached at classification time. This is what makes enrichment work offline, and it is the basis the attribute-completion factor is measured against. Delete it and the quality score silently falls back to counting attribute ",[429,1758,1759],{},"files"," instead of resolved ",[429,1762,1763],{},"fields","; ",[50,1766,1767],{},"generate_attribute_stubs"," rebuilds it.",[1053,1770,1771,1776],{},[29,1772,1773],{},[50,1774,1775],{},"template-fields\u002F"," — one manifest per element, recording which fields its current class declared. When an element is reclassified, this is what lets the plugin drop the old class's unanswered fields while preserving values you already enriched.",[18,1778],{},[21,1780,1624],{"id":1781},"controls-and-the-control-library",[14,1783,1784,1785,1788,1789,1791,1792,172],{},"Controls are reusable security controls (e.g., \"Database Encryption Package\", \"SOC Monitoring\") that one or more model elements reference. They live in the platform's library and are mirrored locally as ",[50,1786,1787],{},"controls\u002F\u003Cid>.json"," — one file per Control referenced by your model. References from elements live in ",[50,1790,1611],{}," arrays on components, boundaries, flows, and data items (",[50,1793,887],{},[262,1795,1797],{"id":1796},"why-controls-are-separate-from-attributes","Why Controls are separate from attributes",[14,1799,1800,1801,1804,1805,1807,1808,172],{},"The 6 key security attributes (authentication, encryption in transit, etc.) describe each element's ",[429,1802,1803],{},"intrinsic"," posture. Controls describe ",[429,1806,550],{}," that posture is achieved — and the same Control can apply to many elements across many Models. Editing the control's configuration in one Model affects every other Model that uses it, which is why Controls have their own file per Control and a safety check on push (see ",[168,1809,1811],{"href":1810},"\u002Fdethereal\u002Fsync-and-version-control#shared-ownership-prompts","shared-ownership prompts",[262,1813,1815],{"id":1814},"controlclass-and-per-instance-attributes","ControlClass and per-instance attributes",[14,1817,1818,1819,1822,1823,1826],{},"A Control is an instance of one or more ",[29,1820,1821],{},"ControlClasses"," (e.g., \"Encryption at Rest\", \"Access Control\"). Each ",[50,1824,1825],{},"(Control, ControlClass)"," pair has its own attribute payload describing how that instance is configured (algorithm, key rotation, audit retention, etc.).",[274,1828,1832],{"className":1829,"code":1830,"language":1831,"meta":282,"style":282},"language-json shiki shiki-themes github-light github-dark-dimmed","{\n  \"id\": \"ctrl-encryption-package\",\n  \"name\": \"Database Encryption Package\",\n  \"lifecycle\": \"brownfield\",\n  \"classes\": [\n    {\n      \"classId\": \"class-encryption-at-rest\",\n      \"attributes\":         { \"algorithm\": \"AES-256\", \"keyRotationDays\": 30 },\n      \"platformAttributes\": { \"algorithm\": \"AES-128\", \"keyRotationDays\": 90 }\n    }\n  ]\n}\n","json",[50,1833,1834,1843,1859,1872,1885,1894,1900,1913,1944,1972,1978,1984],{"__ignoreMap":282},[1835,1836,1839],"span",{"class":1837,"line":1838},"line",1,[1835,1840,1842],{"class":1841},"sYgZi","{\n",[1835,1844,1846,1850,1852,1856],{"class":1837,"line":1845},2,[1835,1847,1849],{"class":1848},"snmFh","  \"id\"",[1835,1851,464],{"class":1841},[1835,1853,1855],{"class":1854},"s-HuK","\"ctrl-encryption-package\"",[1835,1857,1858],{"class":1841},",\n",[1835,1860,1862,1865,1867,1870],{"class":1837,"line":1861},3,[1835,1863,1864],{"class":1848},"  \"name\"",[1835,1866,464],{"class":1841},[1835,1868,1869],{"class":1854},"\"Database Encryption Package\"",[1835,1871,1858],{"class":1841},[1835,1873,1875,1878,1880,1883],{"class":1837,"line":1874},4,[1835,1876,1877],{"class":1848},"  \"lifecycle\"",[1835,1879,464],{"class":1841},[1835,1881,1882],{"class":1854},"\"brownfield\"",[1835,1884,1858],{"class":1841},[1835,1886,1888,1891],{"class":1837,"line":1887},5,[1835,1889,1890],{"class":1848},"  \"classes\"",[1835,1892,1893],{"class":1841},": [\n",[1835,1895,1897],{"class":1837,"line":1896},6,[1835,1898,1899],{"class":1841},"    {\n",[1835,1901,1903,1906,1908,1911],{"class":1837,"line":1902},7,[1835,1904,1905],{"class":1848},"      \"classId\"",[1835,1907,464],{"class":1841},[1835,1909,1910],{"class":1854},"\"class-encryption-at-rest\"",[1835,1912,1858],{"class":1841},[1835,1914,1916,1919,1922,1925,1927,1930,1932,1935,1937,1941],{"class":1837,"line":1915},8,[1835,1917,1918],{"class":1848},"      \"attributes\"",[1835,1920,1921],{"class":1841},":         { ",[1835,1923,1924],{"class":1848},"\"algorithm\"",[1835,1926,464],{"class":1841},[1835,1928,1929],{"class":1854},"\"AES-256\"",[1835,1931,99],{"class":1841},[1835,1933,1934],{"class":1848},"\"keyRotationDays\"",[1835,1936,464],{"class":1841},[1835,1938,1940],{"class":1939},"sviXB","30",[1835,1942,1943],{"class":1841}," },\n",[1835,1945,1947,1950,1953,1955,1957,1960,1962,1964,1966,1969],{"class":1837,"line":1946},9,[1835,1948,1949],{"class":1848},"      \"platformAttributes\"",[1835,1951,1952],{"class":1841},": { ",[1835,1954,1924],{"class":1848},[1835,1956,464],{"class":1841},[1835,1958,1959],{"class":1854},"\"AES-128\"",[1835,1961,99],{"class":1841},[1835,1963,1934],{"class":1848},[1835,1965,464],{"class":1841},[1835,1967,1968],{"class":1939},"90",[1835,1970,1971],{"class":1841}," }\n",[1835,1973,1975],{"class":1837,"line":1974},10,[1835,1976,1977],{"class":1841},"    }\n",[1835,1979,1981],{"class":1837,"line":1980},11,[1835,1982,1983],{"class":1841},"  ]\n",[1835,1985,1987],{"class":1837,"line":1986},12,[1835,1988,1989],{"class":1841},"}\n",[14,1991,423,1992,1994,1995,1998],{},[50,1993,1597],{}," block is what the operator edits. The ",[50,1996,1997],{},"platformAttributes"," block is the raw server-side payload as of the last pull. The pair is how the plugin detects local edits and shared-ownership conflicts.",[262,2000,2002],{"id":2001},"lifecycle-states","Lifecycle states",[59,2004,2007],{"className":2005,"tabIndex":63,"role":64,"ariaLabel":2006},[62],"Table: Lifecycle states",[67,2008,2009,2018],{},[70,2010,2011],{},[73,2012,2013,2016],{},[76,2014,2015],{},"State",[76,2017,81],{},[83,2019,2020,2030,2044,2054],{},[73,2021,2022,2027],{},[88,2023,2024],{},[50,2025,2026],{},"greenfield",[88,2028,2029],{},"Created locally; no platform counterpart yet. Push assigns a UUID and rebinds.",[73,2031,2032,2037],{},[88,2033,2034],{},[50,2035,2036],{},"brownfield",[88,2038,2039,2040,2043],{},"Pulled from the platform. Edits queue as ",[50,2041,2042],{},"pendingEdit"," blocks for the next push.",[73,2045,2046,2051],{},[88,2047,2048],{},[50,2049,2050],{},"partially-pushed",[88,2052,2053],{},"Mid-flight state during a push that touched multiple class entries.",[73,2055,2056,2061],{},[88,2057,2058],{},[50,2059,2060],{},"tombstoned",[88,2062,2063],{},"Will not be re-pulled (deleted on platform, or operator-retired locally).",[262,2065,2067],{"id":2066},"the-two-write-rule","The Two-Write Rule",[14,2069,2070,2071,2073,2074,2077,2078,2080,2081,2084,2085,2091],{},"Every edit to ",[50,2072,1597],{}," must (a) bump ",[50,2075,2076],{},"localEditedAt"," and (b) populate ",[50,2079,2042],{},". The plugin enforces this via the ",[50,2082,2083],{},"set-local-edited"," MCP action — ",[29,2086,2087,2088,2090],{},"never edit ",[50,2089,1787],{}," by hand."," Direct edits bypass the safety check and drop your changes silently on the next reconciliation.",[14,2093,2094,2095,2099,2100,107],{},"For the full control workflow, see ",[168,2096,2098],{"href":2097},"\u002Fdethereal\u002Fdiscovery-and-enrichment#part-4-control-enrichment","Discovery and Enrichment Part 4",". For the push-time safety mechanics, see ",[168,2101,2102],{"href":1810},"Sync and Version Control",[18,2104],{},[14,2106,2107,1343,2110,2112],{},[29,2108,2109],{},"Next:",[168,2111,1035],{"href":1392}," — infrastructure scanning, security attributes, MITRE integration",[2114,2115,2116],"style",{},"html pre.shiki code .sYgZi, html code.shiki .sYgZi{--shiki-default:#24292E;--shiki-dark:#ADBAC7}html pre.shiki code .snmFh, html code.shiki .snmFh{--shiki-default:#005CC5;--shiki-dark:#8DDB8C}html pre.shiki code .s-HuK, html code.shiki .s-HuK{--shiki-default:#032F62;--shiki-dark:#96D0FF}html pre.shiki code .sviXB, html code.shiki .sviXB{--shiki-default:#005CC5;--shiki-dark:#6CB6FF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":282,"searchDepth":1861,"depth":1861,"links":2118},[2119,2120,2121,2122,2127,2131,2137,2141,2145,2146,2149,2158,2164],{"id":23,"depth":1845,"text":24},{"id":40,"depth":1845,"text":41},{"id":177,"depth":1845,"text":178},{"id":256,"depth":1845,"text":257,"children":2123},[2124,2125,2126],{"id":264,"depth":1861,"text":265},{"id":304,"depth":1861,"text":305},{"id":384,"depth":1861,"text":385},{"id":591,"depth":1845,"text":592,"children":2128},[2129,2130],{"id":604,"depth":1861,"text":605},{"id":611,"depth":1861,"text":612},{"id":684,"depth":1845,"text":685,"children":2132},[2133,2134,2135,2136],{"id":691,"depth":1861,"text":692},{"id":756,"depth":1861,"text":757},{"id":875,"depth":1861,"text":876},{"id":1009,"depth":1861,"text":1010},{"id":1040,"depth":1845,"text":1041,"children":2138},[2139,2140],{"id":1044,"depth":1861,"text":1045},{"id":1069,"depth":1861,"text":1070},{"id":1108,"depth":1845,"text":1109,"children":2142},[2143,2144],{"id":1112,"depth":1861,"text":1113},{"id":1395,"depth":1861,"text":1396},{"id":1427,"depth":1845,"text":171},{"id":1486,"depth":1845,"text":1487,"children":2147},[2148],{"id":1518,"depth":1861,"text":1519},{"id":1558,"depth":1845,"text":1559,"children":2150},[2151,2152,2153,2154,2155,2156,2157],{"id":1571,"depth":1861,"text":1572},{"id":1578,"depth":1861,"text":395},{"id":1584,"depth":1861,"text":1585},{"id":1591,"depth":1861,"text":887},{"id":1597,"depth":1861,"text":1598},{"id":1604,"depth":1861,"text":1605},{"id":1628,"depth":1861,"text":1629},{"id":1648,"depth":1845,"text":1649,"children":2159},[2160,2162],{"id":1655,"depth":1861,"text":2161},".dethernety\u002F (Project Root)",{"id":1691,"depth":1861,"text":2163},".dethereal\u002F (Per Model)",{"id":1781,"depth":1845,"text":1624,"children":2165},[2166,2167,2168,2169],{"id":1796,"depth":1861,"text":1797},{"id":1814,"depth":1861,"text":1815},{"id":2001,"depth":1861,"text":2002},{"id":2066,"depth":1861,"text":2067},"Components, boundaries, data flows, classes, attributes, and quality scoring","md",{"category":2173,"position":1887,"tags":2174},"documentation",[2175,2176,177,2177,591,2178],"dethereal","concepts","boundaries","quality",true,"\u002Fdethereal\u002Fmodel-concepts",{"title":5,"description":2170},"03.dethereal\u002F04.model-concepts","IO7vqTK2243XPhpXBqJdvxkVblVvX2N8OGiGUNROA6Y",[2185,2236,2271,2318,2352,2396,2411,2481],{"title":2186,"description":2187,"path":2188,"stem":2189,"children":2190,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[2191,2195,2200,2205,2210,2215,2220,2225,2228,2233],{"title":2192,"path":2188,"stem":2193,"description":2194},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":2196,"path":2197,"stem":2198,"description":2199},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":2201,"path":2202,"stem":2203,"description":2204},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":2206,"path":2207,"stem":2208,"description":2209},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":2211,"path":2212,"stem":2213,"description":2214},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":2216,"path":2217,"stem":2218,"description":2219},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":2221,"path":2222,"stem":2223,"description":2224},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":586,"path":585,"stem":2226,"description":2227},"01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":2229,"path":2230,"stem":2231,"description":2232},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":1103,"path":1102,"stem":2234,"description":2235},"01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":2237,"description":2238,"path":2239,"stem":2240,"children":2241,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[2242,2246,2251,2256,2261,2266],{"title":2243,"path":2239,"stem":2244,"description":2245},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":2247,"path":2248,"stem":2249,"description":2250},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":2252,"path":2253,"stem":2254,"description":2255},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":2257,"path":2258,"stem":2259,"description":2260},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":2262,"path":2263,"stem":2264,"description":2265},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":2267,"path":2268,"stem":2269,"description":2270},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":2272,"description":2273,"path":2274,"stem":2275,"children":2276,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[2277,2281,2286,2290,2295,2296,2299,2303,2308,2313],{"title":2278,"path":2274,"stem":2279,"description":2280},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":2282,"path":2283,"stem":2284,"description":2285},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":2287,"path":580,"stem":2288,"description":2289},"The 11-Step Guided Workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":2291,"path":2292,"stem":2293,"description":2294},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":5,"path":2180,"stem":2182,"description":2170},{"title":1035,"path":1392,"stem":2297,"description":2298},"03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":2102,"path":2300,"stem":2301,"description":2302},"\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":2304,"path":2305,"stem":2306,"description":2307},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":2309,"path":2310,"stem":2311,"description":2312},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":2314,"path":2315,"stem":2316,"description":2317},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":2319,"description":2320,"path":2321,"stem":2322,"children":2323,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[2324,2327,2332,2337,2342,2347],{"title":2319,"path":2321,"stem":2325,"description":2326},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":2328,"path":2329,"stem":2330,"description":2331},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":2333,"path":2334,"stem":2335,"description":2336},"Reading the Report","\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":2338,"path":2339,"stem":2340,"description":2341},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":2343,"path":2344,"stem":2345,"description":2346},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":2348,"path":2349,"stem":2350,"description":2351},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":2353,"description":2354,"path":2355,"stem":2356,"children":2357,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[2358,2362,2367,2372,2377,2382,2386,2391],{"title":2359,"path":2355,"stem":2360,"description":2361},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":2363,"path":2364,"stem":2365,"description":2366},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":2368,"path":2369,"stem":2370,"description":2371},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":2373,"path":2374,"stem":2375,"description":2376},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":2378,"path":2379,"stem":2380,"description":2381},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":2333,"path":2383,"stem":2384,"description":2385},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":2387,"path":2388,"stem":2389,"description":2390},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":2392,"path":2393,"stem":2394,"description":2395},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":2397,"description":2398,"path":2399,"stem":2400,"children":2401,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[2402,2406],{"title":2403,"path":2399,"stem":2404,"description":2405},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":2407,"path":2408,"stem":2409,"description":2410},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":2412,"description":2413,"path":2414,"stem":2415,"children":2416,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[2417,2421,2426,2431,2436,2441,2446,2451,2456,2461,2466,2471,2476],{"title":2418,"path":2414,"stem":2419,"description":2420},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":2422,"path":2423,"stem":2424,"description":2425},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":2427,"path":2428,"stem":2429,"description":2430},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":2432,"path":2433,"stem":2434,"description":2435},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":2437,"path":2438,"stem":2439,"description":2440},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":2442,"path":2443,"stem":2444,"description":2445},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":2447,"path":2448,"stem":2449,"description":2450},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":2452,"path":2453,"stem":2454,"description":2455},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":2457,"path":2458,"stem":2459,"description":2460},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":2462,"path":2463,"stem":2464,"description":2465},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":2467,"path":2468,"stem":2469,"description":2470},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":2472,"path":2473,"stem":2474,"description":2475},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":2477,"path":2478,"stem":2479,"description":2480},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":2482,"description":2483,"path":2484,"stem":2485,"children":2486,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[2487,2491,2496],{"title":2488,"path":2484,"stem":2489,"description":2490},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":2492,"path":2493,"stem":2494,"description":2495},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":2497,"path":2498,"stem":2499,"description":2500},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748185191]