[{"data":1,"prerenderedAt":4213},["ShallowReactive",2],{"page-\u002Fplatform\u002Fcomponent-configuration-guide":3,"navigation":3900},{"id":4,"title":5,"body":6,"description":19,"extension":3886,"meta":3887,"navigation":1695,"path":3896,"seo":3897,"stem":3898,"__hash__":3899},"docs\u002F01.platform\u002F09.component-configuration-guide.md","Component Configuration Guide",{"type":7,"value":8,"toc":3797},"minimark",[9,13,20,25,34,39,46,75,87,91,97,123,127,134,138,153,160,164,204,207,211,218,228,232,256,259,264,286,296,300,305,315,403,417,422,425,433,520,546,549,569,574,578,587,591,651,666,672,676,775,779,818,822,825,835,850,854,873,877,891,912,921,925,938,941,952,956,966,986,989,993,1007,1094,1098,1105,1109,1123,1135,1139,1156,1163,1178,1181,1189,1193,1196,1200,1220,1224,1244,1248,1268,1271,1274,1277,1282,1287,1301,1307,1312,1325,1343,1348,1388,1397,1401,1411,1416,1426,1431,1457,1462,1468,1473,1479,1483,1489,1521,1526,1546,1550,1555,1565,1570,1602,1607,1610,1616,1621,1748,1753,1756,1824,1829,1834,1877,1882,1885,1891,1896,1899,2112,2117,2120,2146,2151,2183,2187,2190,2193,2198,2224,2228,2233,2239,2244,2278,2283,2289,2294,2300,2303,2306,2309,2312,2316,2328,2333,2343,2348,2373,2376,2381,2387,2392,2417,2422,2428,2433,2439,2443,2448,2487,2492,2522,2525,2528,2531,2536,2562,2565,2569,2575,2580,2586,2590,2593,2596,2601,2627,2630,2634,2640,2645,2651,2655,2659,2662,2666,2671,2695,2700,2722,2727,2749,2754,2776,2780,2783,2787,2792,2818,2823,2829,2834,2859,2863,2866,2898,2901,2933,2937,2968,2972,3004,3007,3039,3043,3047,3050,3053,3084,3087,3091,3140,3145,3171,3176,3186,3192,3200,3204,3214,3220,3233,3431,3434,3438,3443,3516,3526,3532,3580,3584,3602,3608,3611,3653,3658,3662,3679,3683,3688,3710,3715,3738,3743,3760,3763,3768,3793],[10,11,5],"h1",{"id":12},"component-configuration-guide",[14,15,16],"p",{},[17,18,19],"em",{},"Detailed guide on configuring different types of components and their security implications.",[21,22,24],"h2",{"id":23},"understanding-modules-and-classes","Understanding Modules and Classes",[14,26,27,28,33],{},"Before configuring components, it's important to understand how Dethernety's ",[29,30,32],"a",{"href":31},"\u002Fplatform\u002Funderstanding-modules","module system"," works:",[35,36,38],"h3",{"id":37},"where-classes-come-from","Where classes come from",[14,40,41,45],{},[42,43,44],"strong",{},"Modules"," provide the component classes, data flow classes, boundary classes, data classes, and security analysis logic you configure against:",[47,48,49,56,69],"ul",{},[50,51,52,55],"li",{},[42,53,54],{},"Installed, not assigned",": the class catalogue is deployment-wide — every class from every module installed on your Dethernety instance is offered to every model",[50,57,58,61,62,65,66],{},[42,59,60],{},"Scoped by the element",": what you are actually offered is narrowed by the element you are classifying — a component class written for a ",[42,63,64],{},"Store"," is never offered to a ",[42,67,68],{},"Process",[50,70,71,74],{},[42,72,73],{},"Security logic travels with the class",": each module carries the policies that turn a class's configured attributes into exposures",[14,76,77,78,82,83,86],{},"The OSS distribution ships four modules, but only one of them — ",[79,80,81],"code",{},"dethernety-general"," — contributes classes to the picker; the other three supply framework data, reporting, and coverage facts. Specialized modules add technology-, compliance-, or industry-specific classes. See ",[29,84,85],{"href":31},"Understanding Modules"," for what each shipped module contributes and how one is built.",[35,88,90],{"id":89},"class-inheritance","Class Inheritance",[14,92,93,96],{},[42,94,95],{},"Component Classes"," define:",[47,98,99,105,111,117],{},[50,100,101,104],{},[42,102,103],{},"Available Attributes",": What configuration options are available",[50,106,107,110],{},[42,108,109],{},"Default Values",": Sensible defaults for common configurations",[50,112,113,116],{},[42,114,115],{},"Security Rules",": How the module calculates exposures",[50,118,119,122],{},[42,120,121],{},"Validation Logic",": What combinations of settings are valid",[21,124,126],{"id":125},"marking-crown-jewels","Marking Crown Jewels",[14,128,129,130,133],{},"A ",[42,131,132],{},"crown jewel"," is a high-value asset — a component holding the data or capability an attacker would most want to reach. Marking a component as a crown jewel tells the analysis to prioritize it: a crown jewel without adequate security controls is surfaced as a highest-priority gap.",[35,135,137],{"id":136},"where-to-find-the-crown-button","Where to find the crown button",[14,139,140,141,144,145,148,149,152],{},"The crown toggle lives on the ",[42,142,143],{},"General"," tab of a component's settings dialog. It is the ",[42,146,147],{},"crown icon button"," at the left of the row that holds the ",[42,150,151],{},"\"Inherited from a Class\" \u002F \"Represents a Model\""," switch.",[14,154,155,156,159],{},"The button appears ",[42,157,158],{},"only for components"," — Process, Data Store, and External Entity. It does not appear for security boundaries, data flows, or data items, which have no crown-jewel field.",[35,161,163],{"id":162},"marking-and-unmarking-a-component","Marking and unmarking a component",[165,166,167,173,180,197],"ol",{},[50,168,169,170,172],{},"Open the component's settings dialog and stay on the ",[42,171,143],{}," tab",[50,174,175,176,179],{},"Locate the ",[42,177,178],{},"crown button"," to the left of the inheritance switch",[50,181,182,183],{},"Click it to toggle the crown-jewel state:\n",[47,184,185,191],{},[50,186,187,190],{},[42,188,189],{},"Off",": an outlined crown",[50,192,193,196],{},[42,194,195],{},"On",": a filled gold crown",[50,198,199,200,203],{},"The change ",[42,201,202],{},"persists immediately"," — there is no separate Save step",[14,205,206],{},"Clicking the crown again clears the flag and removes the visual treatment.",[35,208,210],{"id":209},"what-the-gold-treatment-means","What the gold treatment means",[14,212,213,214,217],{},"When a component is marked as a crown jewel, its node on the canvas receives a ",[42,215,216],{},"discrete gold treatment"," — a soft gold cast and a thin gold edge — so crown jewels stand out at a glance among ordinary components. Toggling the flag off restores the node's normal appearance.",[14,219,220,223,224,227],{},[42,221,222],{},"Note",": The crown toggle and the AI\u002Fclassify workflow set the ",[42,225,226],{},"same"," underlying field on a component. Whether a crown jewel is declared during AI scope definition or toggled here by hand, it is the one crown-jewel mark on that component.",[21,229,231],{"id":230},"classifying-data-items","Classifying Data Items",[14,233,234,235,238,239,238,242,245,246,249,250,252,253,255],{},"A data item can carry four pieces of classification context — ",[42,236,237],{},"sensitivity",", ",[42,240,241],{},"regulatory flags",[42,243,244],{},"origin",", and the ",[42,247,248],{},"credential"," flag — set on the ",[42,251,143],{}," tab of the Data dialog (open a data item's settings and stay on the ",[42,254,143],{}," tab). Sensitivity and regulatory flags feed security and compliance analysis; origin and the credential flag record who can write the content and whether it is a credential.",[35,257,258],{"id":237},"Sensitivity",[14,260,261,263],{},[42,262,258],{}," is your own assertion of how confidential the data is, on a four-level scale from lowest to highest:",[47,265,266,271,276,281],{},[50,267,268],{},[42,269,270],{},"Public",[50,272,273],{},[42,274,275],{},"Internal",[50,277,278],{},[42,279,280],{},"Confidential",[50,282,283],{},[42,284,285],{},"Restricted",[14,287,288,289,291,292,295],{},"Pick a level from the ",[42,290,258],{}," dropdown. Leaving it blank marks the data item ",[42,293,294],{},"Unclassified"," — which is not the same as Public.",[35,297,299],{"id":298},"regulatory-flags","Regulatory flags",[14,301,302,304],{},[42,303,299],{}," record which compliance regimes the data falls under — for example, cardholder data under PCI-DSS or health records under HIPAA. They are kept separate from sensitivity, and a data item can carry several at once.",[14,306,307,308,310,311,314],{},"The ",[42,309,299],{}," field is a free-text tag input: type any label and press Enter to add it, and click a chip's close icon to remove it. The field also ",[42,312,313],{},"suggests"," a recommended set of flags, each shown with the framework it maps to:",[316,317,323],"div",{"className":318,"tabIndex":320,"role":321,"ariaLabel":322},[319],"table-frame",0,"region","Table: Regulatory flags",[324,325,326,339],"table",{},[327,328,329],"thead",{},[330,331,332,336],"tr",{},[333,334,335],"th",{},"Flag",[333,337,338],{},"Framework",[340,341,342,353,363,373,383,393],"tbody",{},[330,343,344,350],{},[345,346,347],"td",{},[79,348,349],{},"PCI cardholder",[345,351,352],{},"PCI-DSS",[330,354,355,360],{},[345,356,357],{},[79,358,359],{},"PHI",[345,361,362],{},"HIPAA",[330,364,365,370],{},[345,366,367],{},[79,368,369],{},"GDPR personal",[345,371,372],{},"GDPR",[330,374,375,380],{},[345,376,377],{},[79,378,379],{},"PII",[345,381,382],{},"general",[330,384,385,390],{},[345,386,387],{},[79,388,389],{},"SOX financial",[345,391,392],{},"SOX",[330,394,395,400],{},[345,396,397],{},[79,398,399],{},"CCPA personal",[345,401,402],{},"CCPA",[14,404,405,406,409,410,413,414,416],{},"These are ",[42,407,408],{},"suggestions, not a closed list"," — you can type your own labels for any regime the suggestions don't cover. When you do match a recommended regime, prefer the suggested label exactly as written: flags are matched case-sensitively, so a custom variant like ",[79,411,412],{},"pci cardholder"," will not be picked up by compliance queries that look for ",[79,415,349],{},".",[14,418,419,421],{},[42,420,222],{},": Sensitivity and regulatory flags are the same fields the AI enrichment path populates. Whether you set them here by hand or let the AI workflow classify the data item, they read from one shared list of recommended flags, so the GUI suggestions and the AI output stay aligned.",[35,423,424],{"id":244},"Origin",[14,426,427,429,430,432],{},[42,428,424],{}," is your own assertion of who can write the data item's content. Pick it from the ",[42,431,424],{}," dropdown, which lists the levels from most to least trusted, each with a one-line meaning:",[316,434,437],{"className":435,"tabIndex":320,"role":321,"ariaLabel":436},[319],"Table: Origin",[324,438,439,448],{},[327,440,441],{},[330,442,443,445],{},[333,444,424],{},[333,446,447],{},"Meaning",[340,449,450,460,470,480,490,500,510],{},[330,451,452,457],{},[345,453,454],{},[42,455,456],{},"Authenticated first party",[345,458,459],{},"Written only by the operator's own authenticated users or systems",[330,461,462,467],{},[345,463,464],{},[42,465,466],{},"Curated internal",[345,468,469],{},"Internal content that passed a review or curation step",[330,471,472,477],{},[345,473,474],{},[42,475,476],{},"Agent relayed",[345,478,479],{},"Produced or forwarded by another agent; at most this trusted",[330,481,482,487],{},[345,483,484],{},[42,485,486],{},"Model generated",[345,488,489],{},"Written by a model and later read as input; at most this trusted",[330,491,492,497],{},[345,493,494],{},[42,495,496],{},"Third party",[345,498,499],{},"Written by a known external party under an agreement",[330,501,502,507],{},[345,503,504],{},[42,505,506],{},"Arbitrary public",[345,508,509],{},"Anyone can write it",[330,511,512,517],{},[345,513,514],{},[42,515,516],{},"Not assessed",[345,518,519],{},"Answered as not established; treated as untrusted",[14,521,522,523,526,527,530,531,533,534,536,537,539,540,416],{},"The last three carry an ",[42,524,525],{},"untrusted"," chip in the list. Choose the ",[42,528,529],{},"least-trusted"," source of what the item holds: if any part of it comes from somewhere anyone can write, the item is ",[42,532,506],{},". Leaving the field blank shows ",[42,535,294],{}," — nobody has answered yet, which is not the same as ",[42,538,516],{},". To clear a value, use the field's clear icon. For the full vocabulary, see the ",[29,541,545],{"href":542,"rel":543},"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Fblob\u002Fmain\u002Fdocs\u002Farchitecture\u002Fdethereal\u002FTHREAT_MODELING_WORKFLOW.md#canonical-data-origin-and-credential-vocabulary",[544],"nofollow","canonical data-origin and credential vocabulary",[35,547,548],{"id":248},"Credential",[14,550,307,551,553,554,557,558,561,562,565,566,568],{},[42,552,548],{}," dropdown records whether the data item is a credential — a password, token, key, secret, or certificate. Pick ",[42,555,556],{},"Yes — a credential"," or ",[42,559,560],{},"No","; leaving it blank shows ",[42,563,564],{},"Unknown",". ",[42,567,560],{}," is a real answer and is kept as such.",[14,570,571,573],{},[42,572,222],{},": Origin and the credential flag are the same fields the AI enrichment path asks about. The AI workflow proposes them for you to confirm and never sets either on its own.",[21,575,577],{"id":576},"how-an-element-gets-its-class","How an Element Gets Its Class",[14,579,580,581,584,585,416],{},"Every element in a model — component, data flow, security boundary, and data item — is classified the same way: you ",[42,582,583],{},"pick a class"," from the catalogue your installed modules provide. You do not author classes in the model editor. If nothing in the catalogue fits, the answer is a module that supplies a class that does — see ",[29,586,85],{"href":31},[35,588,590],{"id":589},"where-the-class-picker-lives","Where the class picker lives",[316,592,595],{"className":593,"tabIndex":320,"role":321,"ariaLabel":594},[319],"Table: Where the class picker lives",[324,596,597,607],{},[327,598,599],{},[330,600,601,604],{},[333,602,603],{},"Element",[333,605,606],{},"Where the picker appears",[340,608,609,619,628,637],{},[330,610,611,614],{},[345,612,613],{},"Component (Process, Store, External Entity)",[345,615,616,618],{},[42,617,143],{}," tab of the settings panel, right-hand column",[330,620,621,624],{},[345,622,623],{},"Security boundary",[345,625,626,618],{},[42,627,143],{},[330,629,630,633],{},[345,631,632],{},"Data flow",[345,634,635,618],{},[42,636,143],{},[330,638,639,642],{},[345,640,641],{},"Data item",[345,643,644,646,647,650],{},[42,645,143],{}," tab of the ",[42,648,649],{},"Data"," dialog, right-hand column",[14,652,653,654,657,658,661,662,665],{},"Open a component, boundary, or data flow's settings panel by double-clicking the node or the flow arrow on the canvas. For components and boundaries the picker is shown only while the inheritance switch reads ",[42,655,656],{},"\"Inherited from a Class\"","; flipping it to ",[42,659,660],{},"\"Represents a Model\""," replaces the picker with the ",[42,663,664],{},"Represented Model"," field.",[14,667,668,669],{},"A node with no class carries a warning marker on the canvas — hover it for ",[17,670,671],{},"No class assigned. Open Settings to assign one.",[35,673,675],{"id":674},"picking-a-class","Picking a class",[165,677,678,699,713,738,759],{},[50,679,680,683,684,238,687,690,691,694,695,698],{},[42,681,682],{},"Click the class field."," It is labelled ",[42,685,686],{},"Component Class",[42,688,689],{},"Boundary Class",", or ",[42,692,693],{},"Data Flow Class"," on the settings panel, and ",[42,696,697],{},"Class"," on the Data dialog. A dropdown opens.",[50,700,701,704,705,708,709,712],{},[42,702,703],{},"Take a suggestion, or search."," With the field empty the dropdown offers ",[42,706,707],{},"Recently used in this model"," and ",[42,710,711],{},"Suggested for this element",". Type into the field to search the catalogue by name — results update as you type.",[50,714,715,718,719,722,723,726,727,708,730,733,734,737],{},[42,716,717],{},"Or browse the whole catalogue."," Click ",[42,720,721],{},"Browse all classes →"," at the foot of the dropdown to open the ",[42,724,725],{},"Browse classes"," drawer. Narrow the list with the ",[42,728,729],{},"Category",[42,731,732],{},"Module"," facet chips, click a row to read its full description in the preview pane, then click ",[42,735,736],{},"Select"," — or double-click the row.",[50,739,740,743,744,747,748,708,751,754,755,758],{},[42,741,742],{},"Confirm the change."," If the element already has a class (or represents a model), a confirmation appears first: ",[17,745,746],{},"Changing the class will clear this element's attributes. Threats and exposures will be recomputed on the next analysis run."," When you also have unsaved name or description edits, it offers ",[42,749,750],{},"Commit & change",[42,752,753],{},"Discard & change"," alongside ",[42,756,757],{},"Cancel",". An element with no class yet is bound immediately, with no confirmation.",[50,760,761,764,765,767,768,770,771,774],{},[42,762,763],{},"Check the result."," The bound class appears in a preview card below the field, showing its ",[42,766,729],{},", source ",[42,769,732],{},", and description. The ",[42,772,773],{},"Attributes"," tab now loads that class's configuration form, and the class's policies start evaluating what you enter there.",[35,776,778],{"id":777},"what-the-picker-offers-you","What the picker offers you",[47,780,781,792,802,812],{},[50,782,783,786,787,65,789,791],{},[42,784,785],{},"Component classes are type-scoped."," Every component class is written for exactly one type, so a class written for a ",[42,788,64],{},[42,790,68],{}," — not in the suggestions, not in the search results, not in the browse drawer. If a class you expect is missing, check the component's type first.",[50,793,794,797,798,801],{},[42,795,796],{},"Suggestions read the element's name and description."," Write a real description before opening the picker. With the description empty the dropdown says ",[17,799,800],{},"Add a description above to get semantic suggestions"," and matches on the name alone.",[50,803,804,807,808,811],{},[42,805,806],{},"Semantic matching needs an embedding backend."," On a deployment without one the picker says ",[17,809,810],{},"Semantic search is unavailable on this deployment — showing name-based matches"," and keeps working on names and descriptions.",[50,813,814,817],{},[42,815,816],{},"Every row names its source."," Results and browse rows are subtitled with the class's category and the module that provides it, so you can always tell where a class came from.",[35,819,821],{"id":820},"replacing-and-removing-a-class","Replacing and removing a class",[14,823,824],{},"Pick a different class at any time — the new pick replaces the old one, through the same confirmation as above.",[14,826,827,828,831,832],{},"To leave a component, boundary, or data flow unclassified, click the ",[42,829,830],{},"Remove class"," button — the broken-link icon at the right of the inheritance-switch row. It confirms first: ",[17,833,834],{},"Removing the class will delete its auto-generated exposures and clear this element's attributes. Exposures you created yourself are kept.",[14,836,837,838,841,842,845,846,849],{},"If a module upgrade withdraws a class that is still in use, the element keeps pointing at it and the picker flags the break: the field shows ",[42,839,840],{},"Unknown class"," with a ",[42,843,844],{},"retired"," chip and the prompt ",[17,847,848],{},"Pick a replacement."," Choose a live class to repair the binding.",[35,851,853],{"id":852},"one-class-per-element-several-per-control","One class per element, several per control",[14,855,856,857,860,861,864,865,868,869,416],{},"An element carries ",[42,858,859],{},"one"," class at a time, which is why a pick is always a replacement and the browse drawer closes as soon as you select. Controls work differently: a control binds ",[42,862,863],{},"several"," control classes at once, so the same drawer stays open for repeat picks and marks classes already bound with an ",[42,866,867],{},"Added"," chip. See ",[29,870,872],{"href":871},"\u002Fplatform\u002Fworking-with-security-controls","Working with Security Controls",[21,874,876],{"id":875},"answering-yes-or-no-attributes","Answering Yes-or-No Attributes",[14,878,879,880,882,883,238,886,690,888,416],{},"On an ",[42,881,773],{}," form — of a component, boundary, data flow, data item, control class, or issue — a yes\u002Fno attribute is a three-way choice: ",[42,884,885],{},"Yes",[42,887,560],{},[42,889,890],{},"Not answered",[47,892,893,901,909],{},[50,894,895,896,557,898,900],{},"Click ",[42,897,885],{},[42,899,560],{}," to answer.",[50,902,903,904,906,907,416],{},"To take an answer back, click ",[42,905,890],{},". Saving then removes the stored answer; it is not kept as ",[42,908,560],{},[50,910,911],{},"The same goes for other attributes: emptying a text field, clearing a choice, or removing an item from a list removes it when you save.",[14,913,914,917,918,920],{},[42,915,916],{},"Not answered is not the same as No."," Some policies treat a missing answer as a reason to raise a finding, so setting an attribute back to ",[42,919,890],{}," can change the analysis — just as an attribute you never answered always could.",[21,922,924],{"id":923},"operation-version","Operation & version",[14,926,927,928,930,931,933,934,937],{},"Once a component or a security boundary has a class, its ",[42,929,773],{}," tab ends with one more panel, whichever module the class comes from: ",[42,932,924],{}," on a component, ",[42,935,936],{},"Operation"," on a boundary. It records who runs the element and which software it is. Click the panel's information icon for guidance on each field.",[14,939,940],{},"The panel is missing where the tab shows no form split into panels, for example a read-only notice in place of the class's attributes.",[47,942,943,946,949],{},[50,944,945],{},"Every field is optional. Clearing a field removes its value when you save, as with any attribute.",[50,947,948],{},"The values belong to the element's class binding: replacing or removing the class clears them, together with the class's other attributes.",[50,950,951],{},"The class's policies do not read these fields, so filling them in does not change the exposures the class raises.",[35,953,955],{"id":954},"operated-by","Operated by",[14,957,958,959,557,962,965],{},"Choose ",[42,960,961],{},"You (your organisation)",[42,963,964],{},"A vendor",". Nothing is preselected.",[47,967,968,980],{},[50,969,970,973,974,976,977,979],{},[42,971,972],{},"On a component",", it says who builds or runs the element's own software. Choose ",[42,975,964],{}," when a vendor builds and runs it and you hold only the settings it offers you, as with a hosted service you configure. Choose ",[42,978,961],{}," when you build or run it, including when you build it on a vendor's platform.",[50,981,982,985],{},[42,983,984],{},"On a security boundary",", it says who runs the execution environment — the hosts, the hypervisors or the platform runtime — of what is drawn directly inside it.",[14,987,988],{},"The two answers are separate: a boundary's answer is about the environment, a component's about its own software. Set each one on its own element.",[35,990,992],{"id":991},"drawing-elements-in-the-boundary-that-runs-them","Drawing elements in the boundary that runs them",[14,994,995,996,999,1000,1002,1003,1006],{},"Draw each element ",[42,997,998],{},"directly"," inside the boundary that runs its execution environment, and set that boundary's ",[42,1001,955],{},". Only the boundary an element is drawn directly in speaks for its environment. The canvas itself, the ",[42,1004,1005],{},"Default Boundary",", does not: an element drawn straight on the canvas has no boundary that says who runs its environment.",[316,1008,1011],{"className":1009,"tabIndex":320,"role":321,"ariaLabel":1010},[319],"Table: Drawing elements in the boundary that runs them",[324,1012,1013,1028],{},[327,1014,1015],{},[330,1016,1017,1020,1025],{},[333,1018,1019],{},"What you model",[333,1021,1022,1023],{},"The element's ",[42,1024,955],{},[333,1026,1027],{},"The boundary it is drawn in",[340,1029,1030,1047,1063,1078],{},[330,1031,1032,1035,1039],{},[345,1033,1034],{},"Your own application, running in your account at a cloud provider",[345,1036,1037],{},[42,1038,961],{},[345,1040,1041,1042,1044,1045],{},"A boundary for the provider's account, ",[42,1043,955],{}," set to ",[42,1046,964],{},[330,1048,1049,1052,1056],{},[345,1050,1051],{},"A managed database service you configure",[345,1053,1054],{},[42,1055,964],{},[345,1057,1058,1059,1044,1061],{},"The vendor's boundary, ",[42,1060,955],{},[42,1062,964],{},[330,1064,1065,1068,1072],{},[345,1066,1067],{},"A function or app you build on a vendor's platform",[345,1069,1070],{},[42,1071,961],{},[345,1073,1058,1074,1044,1076],{},[42,1075,955],{},[42,1077,964],{},[330,1079,1080,1083,1087],{},[345,1081,1082],{},"An application you run on your own servers",[345,1084,1085],{},[42,1086,961],{},[345,1088,1089,1090,1044,1092],{},"A boundary for your data centre, ",[42,1091,955],{},[42,1093,961],{},[35,1095,1097],{"id":1096},"product","Product",[14,1099,1100,1101,1104],{},"The vendor and product name of the element's software or service, for example ",[17,1102,1103],{},"PostgreSQL"," or the name of the hosted service you use. Free text, up to 200 characters. Read it from the container image or package name, the deployment manifest, or the contract.",[35,1106,1108],{"id":1107},"version","Version",[14,1110,1111,1114,1115,1118,1119,1122],{},[42,1112,1113],{},"Components only."," The version of the software you run, up to 64 characters. Read the exact version from the image tag, the lockfile or package manifest, the Helm chart's ",[79,1116,1117],{},"appVersion",", or the Terraform lock file. A floating tag such as ",[79,1120,1121],{},"latest",", or a version range, is not a version: record the version it resolves to.",[14,1124,1125,1126,1128,1129,1131,1132,1134],{},"The version is not asked for an element a vendor operates: while ",[42,1127,955],{}," is ",[42,1130,964],{},", the ",[42,1133,1108],{}," field is hidden.",[21,1136,1138],{"id":1137},"issue-class-integration","Issue Class Integration",[1140,1141,1142],"blockquote",{},[14,1143,1144,1147,1148,1151,1152,416],{},[42,1145,1146],{},"No integration module ships with Dethernety."," The platform provides the ",[17,1149,1150],{},"seam"," described below; a module has to implement it before an issue in Dethernety is connected to anything outside it. Out of the box, issues are created and tracked entirely within the platform — see the ",[29,1153,1155],{"href":1154},"\u002Fplatform\u002Fissue-management-guide","Issue Management Guide",[14,1157,1158,1159,1162],{},"The module that provides an issue class may also implement a ",[42,1160,1161],{},"synchronization hook",". Where it does:",[47,1164,1165,1168,1175],{},[50,1166,1167],{},"The module reads the issue's attributes from the external system and returns them to the platform.",[50,1169,1170,1171,1174],{},"Those values surface as the issue's ",[42,1172,1173],{},"synced attributes"," — searchable alongside the issue's own fields, and the source of the severity shown on issue rows.",[50,1176,1177],{},"The platform records the time of the last successful sync on the issue, and enforces a timeout so a slow or unreachable external system cannot stall the request.",[14,1179,1180],{},"The hook is a pull: the external system remains the source of truth for the attributes it owns, and the platform does not write back to it. Anything richer — pushing new issues outward, mirroring status changes both ways, escalation on a timer — is up to the module and is not something the platform provides.",[14,1182,1183,1184,416],{},"Writing such a module is covered in the ",[29,1185,1188],{"href":1186,"rel":1187},"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Fblob\u002Fmain\u002Fdocs\u002Farchitecture\u002Fmodules\u002FDEVELOPMENT_GUIDE.md",[544],"Module Development Guide",[21,1190,1192],{"id":1191},"component-types-overview","Component Types Overview",[14,1194,1195],{},"Dethernety supports several component types, each with specific configuration options and security considerations:",[35,1197,1199],{"id":1198},"process-components","Process Components",[47,1201,1202,1208,1214],{},[50,1203,1204,1207],{},[42,1205,1206],{},"Web Applications",": Frontend interfaces, APIs, microservices",[50,1209,1210,1213],{},[42,1211,1212],{},"Application Servers",": Business logic, middleware, backend services",[50,1215,1216,1219],{},[42,1217,1218],{},"System Services",": Operating system services, background processes",[35,1221,1223],{"id":1222},"data-store-components","Data Store Components",[47,1225,1226,1232,1238],{},[50,1227,1228,1231],{},[42,1229,1230],{},"Databases",": SQL, NoSQL, graph databases",[50,1233,1234,1237],{},[42,1235,1236],{},"File Systems",": Local storage, network shares, cloud storage",[50,1239,1240,1243],{},[42,1241,1242],{},"Caches",": In-memory stores, distributed caches",[35,1245,1247],{"id":1246},"external-entities","External Entities",[47,1249,1250,1256,1262],{},[50,1251,1252,1255],{},[42,1253,1254],{},"Users",": End users, administrators, service accounts",[50,1257,1258,1261],{},[42,1259,1260],{},"Third-party Services",": APIs, SaaS platforms, partners",[50,1263,1264,1267],{},[42,1265,1266],{},"Systems",": External applications, legacy systems",[21,1269,1199],{"id":1270},"process-components-1",[35,1272,1206],{"id":1273},"web-applications",[14,1275,1276],{},"Web applications are the most common entry points into systems and require careful configuration.",[1278,1279,1281],"h4",{"id":1280},"basic-configuration","Basic Configuration",[14,1283,1284],{},[42,1285,1286],{},"Component Properties (before class assignment):",[47,1288,1289,1295],{},[50,1290,1291,1294],{},[42,1292,1293],{},"Name",": Descriptive name (e.g., \"Customer Portal Web App\")",[50,1296,1297,1300],{},[42,1298,1299],{},"Description",": Brief explanation of component purpose",[14,1302,1303,1306],{},[42,1304,1305],{},"Configuration Type Selection:","\nComponents can be configured in two ways:",[14,1308,1309],{},[42,1310,1311],{},"Option 1: Class Assignment",[165,1313,1314,1319],{},[50,1315,1316,1317],{},"In the component's settings panel, leave the switch on ",[42,1318,656],{},[50,1320,1321,1322],{},"Pick a component class from the catalogue your installed modules provide (e.g., \"Web Server\", \"Relational Database\") — the full workflow is in ",[29,1323,577],{"href":1324},"#how-an-element-gets-its-class",[14,1326,1327,1329,1330,65,1332,1334,1335,238,1337,690,1339,1342],{},[42,1328,222],{},": The classes offered for a component are narrowed by the component's own type. Every component class is written for exactly one type, so a class written for a ",[42,1331,64],{},[42,1333,68],{}," component: not in the suggestions, not in the search results, not in the browse drawer, and not in the recently used list. If you don't see a class you expect, check whether it was written for this component's type (",[42,1336,68],{},[42,1338,64],{},[42,1340,1341],{},"External Entity","), then whether the module that provides it is installed on your instance. A class written for a different type cannot be used on this component — choose one that matches its type instead.",[14,1344,1345],{},[42,1346,1347],{},"Option 2: Model Reference",[165,1349,1350,1355,1362,1379,1382],{},[50,1351,1352,1353],{},"In the component settings dialog, toggle to ",[42,1354,660],{},[50,1356,1357,1358,1361],{},"Click the ",[42,1359,1360],{},"magnifier button"," next to the \"Represented Model\" field",[50,1363,1364,1365],{},"Browse the model selection dialog:\n",[47,1366,1367,1373],{},[50,1368,1369,1372],{},[42,1370,1371],{},"Left panel",": Folder structure for organizing models",[50,1374,1375,1378],{},[42,1376,1377],{},"Right panel",": Available models in the selected folder",[50,1380,1381],{},"Select the model you want this component to represent",[50,1383,895,1384,1387],{},[42,1385,1386],{},"\"Select\""," to establish the reference",[14,1389,1390,1393,1394,416],{},[42,1391,1392],{},"Important",": Switching between class assignment and model reference will ",[42,1395,1396],{},"clear all existing settings, attributes, and exposures",[1278,1398,1400],{"id":1399},"security-configuration-after-class-assignment-or-model-reference","Security Configuration (after class assignment or model reference)",[14,1402,1403,1406,1407,1410],{},[42,1404,1405],{},"Class Assignment",": The component inherits the class's configuration template and available attributes\n",[42,1408,1409],{},"Model Reference",": The component inherits properties and security characteristics from the referenced model",[14,1412,1413],{},[42,1414,1415],{},"Authentication Settings:",[1417,1418,1423],"pre",{"className":1419,"code":1421,"language":1422},[1420],"language-text","Authentication Type: [Session-based | JWT | OAuth 2.0 | SAML]\nMulti-Factor Authentication: [Enabled | Disabled]\nPassword Policy: [Strong | Medium | Weak | Custom]\nSession Management: [Secure | Standard | Custom]\n","text",[79,1424,1421],{"__ignoreMap":1425},"",[14,1427,1428],{},[42,1429,1430],{},"Example - E-commerce Web App:",[47,1432,1433,1439,1445,1451],{},[50,1434,1435,1438],{},[42,1436,1437],{},"Authentication",": Session-based with MFA for admin accounts",[50,1440,1441,1444],{},[42,1442,1443],{},"Password Policy",": Minimum 12 characters, complexity requirements",[50,1446,1447,1450],{},[42,1448,1449],{},"Session Timeout",": 30 minutes for regular users, 15 minutes for admins",[50,1452,1453,1456],{},[42,1454,1455],{},"Cookie Settings",": Secure, HttpOnly, SameSite=Strict",[14,1458,1459],{},[42,1460,1461],{},"Network Security:",[1417,1463,1466],{"className":1464,"code":1465,"language":1422},[1420],"Protocol: [HTTP | HTTPS | Both]\nTLS Version: [1.2 | 1.3 | Both]\nCORS Policy: [Restrictive | Permissive | Custom]\nRate Limiting: [Enabled | Disabled]\n",[79,1467,1465],{"__ignoreMap":1425},[14,1469,1470],{},[42,1471,1472],{},"Input Handling:",[1417,1474,1477],{"className":1475,"code":1476,"language":1422},[1420],"Input Validation: [Enabled | Partial | Disabled]\nSanitization: [Automatic | Manual | None]\nFile Upload Security: [Restricted | Standard | Permissive]\nContent Security Policy: [Strict | Moderate | Disabled]\n",[79,1478,1476],{"__ignoreMap":1425},[1278,1480,1482],{"id":1481},"advanced-configuration","Advanced Configuration",[14,1484,1485,1488],{},[42,1486,1487],{},"Security Headers:","\nEnable these security headers for web applications:",[47,1490,1491,1497,1503,1509,1515],{},[50,1492,1493,1496],{},[42,1494,1495],{},"HSTS",": Force HTTPS connections",[50,1498,1499,1502],{},[42,1500,1501],{},"X-Frame-Options",": Prevent clickjacking",[50,1504,1505,1508],{},[42,1506,1507],{},"X-Content-Type-Options",": Prevent MIME sniffing",[50,1510,1511,1514],{},[42,1512,1513],{},"Referrer-Policy",": Control referrer information",[50,1516,1517,1520],{},[42,1518,1519],{},"Permissions-Policy",": Restrict browser features",[14,1522,1523],{},[42,1524,1525],{},"Error Handling:",[47,1527,1528,1534,1540],{},[50,1529,1530,1533],{},[42,1531,1532],{},"Error Messages",": Generic (recommended) vs. Detailed",[50,1535,1536,1539],{},[42,1537,1538],{},"Stack Traces",": Hidden in production",[50,1541,1542,1545],{},[42,1543,1544],{},"Logging Level",": ERROR and above in production",[1278,1547,1549],{"id":1548},"understanding-security-exposures","Understanding Security Exposures",[14,1551,1552],{},[42,1553,1554],{},"How Dethernety Determines Security Exposures",[14,1556,1557,1558,1561,1562,1564],{},"After configuring component attributes, the ",[42,1559,1560],{},"Dethernety General"," module (",[79,1563,81],{},") uses OPA\u002FRego policies to analyze your configuration and identify potential security exposures.",[14,1566,1567],{},[42,1568,1569],{},"Exposure Calculation Process:",[165,1571,1572,1578,1584,1590,1596],{},[50,1573,1574,1577],{},[42,1575,1576],{},"Policy Evaluation",": The module evaluates component attributes against OPA\u002FRego policies",[50,1579,1580,1583],{},[42,1581,1582],{},"Exposure Generation",": Applicable exposures are identified based on configuration weaknesses",[50,1585,1586,1589],{},[42,1587,1588],{},"MITRE ATT&CK Mapping",": Each exposure includes direct links to attack techniques",[50,1591,1592,1595],{},[42,1593,1594],{},"Real-Time Updates",": Exposures recalculate immediately when attributes change",[50,1597,1598,1601],{},[42,1599,1600],{},"Display in UI",": Results appear in the \"Exposures\" section of the settings dialog",[14,1603,1604],{},[42,1605,1606],{},"Example: Web Application Exposure Analysis",[14,1608,1609],{},"Consider a web application with these attributes:",[1417,1611,1614],{"className":1612,"code":1613,"language":1422},[1420],"Protocol: HTTP\nAuthentication: Basic\nInput_Validation: Disabled\nSession_Timeout: 3600 (1 hour)\nTLS_Version: None\n",[79,1615,1613],{"__ignoreMap":1425},[14,1617,1618],{},[42,1619,1620],{},"Generated Exposures:",[1417,1622,1626],{"className":1623,"code":1624,"language":1625,"meta":1425,"style":1425},"language-rego shiki shiki-themes github-light github-dark-dimmed","# Module policy evaluates attributes and generates exposures\nunencrypted_web_traffic_def := {\n    \"name\": \"unencrypted_web_traffic\",\n    \"description\": \"HTTP traffic allows attackers to intercept sensitive data including credentials and session tokens\",\n    \"criticality\": \"high\",\n    \"exploited_by\": [\n        {\"label\": \"MitreAttackTechnique\", \"property\": \"attack_id\", \"value\": \"T1040\"},  # Network Sniffing\n        {\"label\": \"MitreAttackTechnique\", \"property\": \"attack_id\", \"value\": \"T1557\"}   # Adversary-in-the-Middle\n    ]\n}\n\nweak_authentication_def := {\n    \"name\": \"weak_authentication\",\n    \"description\": \"Basic authentication without MFA allows credential-based attacks\",\n    \"criticality\": \"medium\",\n    \"exploited_by\": [\n        {\"label\": \"MitreAttackTechnique\", \"property\": \"attack_id\", \"value\": \"T1110\"},  # Brute Force\n        {\"label\": \"MitreAttackTechnique\", \"property\": \"attack_id\", \"value\": \"T1078\"}   # Valid Accounts\n    ]\n}\n","rego",[79,1627,1628,1636,1642,1648,1654,1660,1666,1672,1678,1684,1690,1697,1703,1709,1715,1721,1726,1732,1738,1743],{"__ignoreMap":1425},[1629,1630,1633],"span",{"class":1631,"line":1632},"line",1,[1629,1634,1635],{},"# Module policy evaluates attributes and generates exposures\n",[1629,1637,1639],{"class":1631,"line":1638},2,[1629,1640,1641],{},"unencrypted_web_traffic_def := {\n",[1629,1643,1645],{"class":1631,"line":1644},3,[1629,1646,1647],{},"    \"name\": \"unencrypted_web_traffic\",\n",[1629,1649,1651],{"class":1631,"line":1650},4,[1629,1652,1653],{},"    \"description\": \"HTTP traffic allows attackers to intercept sensitive data including credentials and session tokens\",\n",[1629,1655,1657],{"class":1631,"line":1656},5,[1629,1658,1659],{},"    \"criticality\": \"high\",\n",[1629,1661,1663],{"class":1631,"line":1662},6,[1629,1664,1665],{},"    \"exploited_by\": [\n",[1629,1667,1669],{"class":1631,"line":1668},7,[1629,1670,1671],{},"        {\"label\": \"MitreAttackTechnique\", \"property\": \"attack_id\", \"value\": \"T1040\"},  # Network Sniffing\n",[1629,1673,1675],{"class":1631,"line":1674},8,[1629,1676,1677],{},"        {\"label\": \"MitreAttackTechnique\", \"property\": \"attack_id\", \"value\": \"T1557\"}   # Adversary-in-the-Middle\n",[1629,1679,1681],{"class":1631,"line":1680},9,[1629,1682,1683],{},"    ]\n",[1629,1685,1687],{"class":1631,"line":1686},10,[1629,1688,1689],{},"}\n",[1629,1691,1693],{"class":1631,"line":1692},11,[1629,1694,1696],{"emptyLinePlaceholder":1695},true,"\n",[1629,1698,1700],{"class":1631,"line":1699},12,[1629,1701,1702],{},"weak_authentication_def := {\n",[1629,1704,1706],{"class":1631,"line":1705},13,[1629,1707,1708],{},"    \"name\": \"weak_authentication\",\n",[1629,1710,1712],{"class":1631,"line":1711},14,[1629,1713,1714],{},"    \"description\": \"Basic authentication without MFA allows credential-based attacks\",\n",[1629,1716,1718],{"class":1631,"line":1717},15,[1629,1719,1720],{},"    \"criticality\": \"medium\",\n",[1629,1722,1724],{"class":1631,"line":1723},16,[1629,1725,1665],{},[1629,1727,1729],{"class":1631,"line":1728},17,[1629,1730,1731],{},"        {\"label\": \"MitreAttackTechnique\", \"property\": \"attack_id\", \"value\": \"T1110\"},  # Brute Force\n",[1629,1733,1735],{"class":1631,"line":1734},18,[1629,1736,1737],{},"        {\"label\": \"MitreAttackTechnique\", \"property\": \"attack_id\", \"value\": \"T1078\"}   # Valid Accounts\n",[1629,1739,1741],{"class":1631,"line":1740},19,[1629,1742,1683],{},[1629,1744,1746],{"class":1631,"line":1745},20,[1629,1747,1689],{},[14,1749,1750],{},[42,1751,1752],{},"Multi-Condition Exposure Logic:",[14,1754,1755],{},"The same exposure can be triggered by different attribute combinations:",[1417,1757,1759],{"className":1623,"code":1758,"language":1625,"meta":1425,"style":1425},"# Missing input validation exposure can be triggered multiple ways\nmissing_input_validation[_missing_input_validation_def] if {\n    input.input_validation == \"disabled\"\n}\n\nmissing_input_validation[_missing_input_validation_def] if {\n    input.input_validation == \"partial\"\n    count(input.validated_inputs) == 0\n}\n\nmissing_input_validation[_missing_input_validation_def] if {\n    input.file_upload_validation == false\n    input.allow_file_uploads == true\n}\n",[79,1760,1761,1766,1771,1776,1780,1784,1788,1793,1798,1802,1806,1810,1815,1820],{"__ignoreMap":1425},[1629,1762,1763],{"class":1631,"line":1632},[1629,1764,1765],{},"# Missing input validation exposure can be triggered multiple ways\n",[1629,1767,1768],{"class":1631,"line":1638},[1629,1769,1770],{},"missing_input_validation[_missing_input_validation_def] if {\n",[1629,1772,1773],{"class":1631,"line":1644},[1629,1774,1775],{},"    input.input_validation == \"disabled\"\n",[1629,1777,1778],{"class":1631,"line":1650},[1629,1779,1689],{},[1629,1781,1782],{"class":1631,"line":1656},[1629,1783,1696],{"emptyLinePlaceholder":1695},[1629,1785,1786],{"class":1631,"line":1662},[1629,1787,1770],{},[1629,1789,1790],{"class":1631,"line":1668},[1629,1791,1792],{},"    input.input_validation == \"partial\"\n",[1629,1794,1795],{"class":1631,"line":1674},[1629,1796,1797],{},"    count(input.validated_inputs) == 0\n",[1629,1799,1800],{"class":1631,"line":1680},[1629,1801,1689],{},[1629,1803,1804],{"class":1631,"line":1686},[1629,1805,1696],{"emptyLinePlaceholder":1695},[1629,1807,1808],{"class":1631,"line":1692},[1629,1809,1770],{},[1629,1811,1812],{"class":1631,"line":1699},[1629,1813,1814],{},"    input.file_upload_validation == false\n",[1629,1816,1817],{"class":1631,"line":1705},[1629,1818,1819],{},"    input.allow_file_uploads == true\n",[1629,1821,1822],{"class":1631,"line":1711},[1629,1823,1689],{},[14,1825,1826],{},[42,1827,1828],{},"Viewing and Understanding Exposures:",[14,1830,1831],{},[42,1832,1833],{},"In the Component Settings Dialog:",[165,1835,1836,1839,1845,1848],{},[50,1837,1838],{},"Configure your component attributes",[50,1840,1841,1842,172],{},"Navigate to the ",[42,1843,1844],{},"\"Exposures\"",[50,1846,1847],{},"Review automatically calculated exposures",[50,1849,1850,1851],{},"Each exposure shows:\n",[47,1852,1853,1859,1865,1871],{},[50,1854,1855,1858],{},[42,1856,1857],{},"Name and Description",": What the security issue is",[50,1860,1861,1864],{},[42,1862,1863],{},"Criticality Level",": Risk assessment (high, medium, low)",[50,1866,1867,1870],{},[42,1868,1869],{},"Attack Techniques",": MITRE ATT&CK techniques that can exploit this exposure",[50,1872,1873,1876],{},[42,1874,1875],{},"Recommendations",": Suggested configuration changes",[14,1878,1879],{},[42,1880,1881],{},"Dynamic Exposure Updates:",[14,1883,1884],{},"Exposures update in real-time as you modify attributes:",[1417,1886,1889],{"className":1887,"code":1888,"language":1422},[1420],"Example Improvement Sequence:\n1. Change Protocol: HTTP → HTTPS\n   └── Removes \"unencrypted_web_traffic\" exposure\n\n2. Enable MFA: Basic Auth → Basic Auth + MFA\n   └── Reduces \"weak_authentication\" criticality\n\n3. Enable Input Validation: Disabled → Enabled\n   └── Removes \"missing_input_validation\" exposure\n",[79,1890,1888],{"__ignoreMap":1425},[14,1892,1893],{},[42,1894,1895],{},"Exposure-to-Graph Integration:",[14,1897,1898],{},"Each calculated exposure is stored in the graph database with complete MITRE ATT&CK relationships:",[1417,1900,1904],{"className":1901,"code":1902,"language":1903,"meta":1425,"style":1425},"language-cypher shiki shiki-themes github-light github-dark-dimmed","\u002F\u002F Component exposures in the graph\n(WebApp:Component {\n  protocol: \"HTTP\",\n  authentication: \"basic\"\n})-[:HAS_EXPOSURE]->(UnencryptedTraffic:Exposure {\n  name: \"unencrypted_web_traffic\",\n  criticality: \"high\"\n})\n\n\u002F\u002F Direct links to attack techniques\n(UnencryptedTraffic)-[:EXPLOITED_BY]->(T1040:MitreAttackTechnique {\n  attack_id: \"T1040\",\n  name: \"Network Sniffing\"\n})\n\n(UnencryptedTraffic)-[:EXPLOITED_BY]->(T1557:MitreAttackTechnique {\n  attack_id: \"T1557\",\n  name: \"Adversary-in-the-Middle\"\n})\n","cypher",[79,1905,1906,1912,1922,1937,1947,1977,1989,1999,2006,2010,2015,2036,2048,2057,2063,2067,2086,2097,2106],{"__ignoreMap":1425},[1629,1907,1908],{"class":1631,"line":1632},[1629,1909,1911],{"class":1910},"sDN9O","\u002F\u002F Component exposures in the graph\n",[1629,1913,1914,1918],{"class":1631,"line":1638},[1629,1915,1917],{"class":1916},"sYgZi","(WebApp:Component ",[1629,1919,1921],{"class":1920},"s7YZ4","{\n",[1629,1923,1924,1927,1930,1934],{"class":1631,"line":1644},[1629,1925,1926],{"class":1916},"  protocol",[1629,1928,1929],{"class":1920},":",[1629,1931,1933],{"class":1932},"s-HuK"," \"HTTP\"",[1629,1935,1936],{"class":1920},",\n",[1629,1938,1939,1942,1944],{"class":1631,"line":1650},[1629,1940,1941],{"class":1916},"  authentication",[1629,1943,1929],{"class":1920},[1629,1945,1946],{"class":1932}," \"basic\"\n",[1629,1948,1949,1952,1955,1959,1962,1966,1969,1972,1975],{"class":1631,"line":1656},[1629,1950,1951],{"class":1920},"}",[1629,1953,1954],{"class":1916},")",[1629,1956,1958],{"class":1957},"sviXB","-",[1629,1960,1961],{"class":1920},"[:",[1629,1963,1965],{"class":1964},"sOLd2","HAS_EXPOSURE",[1629,1967,1968],{"class":1920},"]",[1629,1970,1971],{"class":1957},"->",[1629,1973,1974],{"class":1916},"(UnencryptedTraffic:Exposure ",[1629,1976,1921],{"class":1920},[1629,1978,1979,1982,1984,1987],{"class":1631,"line":1662},[1629,1980,1981],{"class":1916},"  name",[1629,1983,1929],{"class":1920},[1629,1985,1986],{"class":1932}," \"unencrypted_web_traffic\"",[1629,1988,1936],{"class":1920},[1629,1990,1991,1994,1996],{"class":1631,"line":1668},[1629,1992,1993],{"class":1916},"  criticality",[1629,1995,1929],{"class":1920},[1629,1997,1998],{"class":1932}," \"high\"\n",[1629,2000,2001,2003],{"class":1631,"line":1674},[1629,2002,1951],{"class":1920},[1629,2004,2005],{"class":1916},")\n",[1629,2007,2008],{"class":1631,"line":1680},[1629,2009,1696],{"emptyLinePlaceholder":1695},[1629,2011,2012],{"class":1631,"line":1686},[1629,2013,2014],{"class":1910},"\u002F\u002F Direct links to attack techniques\n",[1629,2016,2017,2020,2022,2024,2027,2029,2031,2034],{"class":1631,"line":1692},[1629,2018,2019],{"class":1916},"(UnencryptedTraffic)",[1629,2021,1958],{"class":1957},[1629,2023,1961],{"class":1920},[1629,2025,2026],{"class":1964},"EXPLOITED_BY",[1629,2028,1968],{"class":1920},[1629,2030,1971],{"class":1957},[1629,2032,2033],{"class":1916},"(T1040:MitreAttackTechnique ",[1629,2035,1921],{"class":1920},[1629,2037,2038,2041,2043,2046],{"class":1631,"line":1699},[1629,2039,2040],{"class":1916},"  attack_id",[1629,2042,1929],{"class":1920},[1629,2044,2045],{"class":1932}," \"T1040\"",[1629,2047,1936],{"class":1920},[1629,2049,2050,2052,2054],{"class":1631,"line":1705},[1629,2051,1981],{"class":1916},[1629,2053,1929],{"class":1920},[1629,2055,2056],{"class":1932}," \"Network Sniffing\"\n",[1629,2058,2059,2061],{"class":1631,"line":1711},[1629,2060,1951],{"class":1920},[1629,2062,2005],{"class":1916},[1629,2064,2065],{"class":1631,"line":1717},[1629,2066,1696],{"emptyLinePlaceholder":1695},[1629,2068,2069,2071,2073,2075,2077,2079,2081,2084],{"class":1631,"line":1723},[1629,2070,2019],{"class":1916},[1629,2072,1958],{"class":1957},[1629,2074,1961],{"class":1920},[1629,2076,2026],{"class":1964},[1629,2078,1968],{"class":1920},[1629,2080,1971],{"class":1957},[1629,2082,2083],{"class":1916},"(T1557:MitreAttackTechnique ",[1629,2085,1921],{"class":1920},[1629,2087,2088,2090,2092,2095],{"class":1631,"line":1728},[1629,2089,2040],{"class":1916},[1629,2091,1929],{"class":1920},[1629,2093,2094],{"class":1932}," \"T1557\"",[1629,2096,1936],{"class":1920},[1629,2098,2099,2101,2103],{"class":1631,"line":1734},[1629,2100,1981],{"class":1916},[1629,2102,1929],{"class":1920},[1629,2104,2105],{"class":1932}," \"Adversary-in-the-Middle\"\n",[1629,2107,2108,2110],{"class":1631,"line":1740},[1629,2109,1951],{"class":1920},[1629,2111,2005],{"class":1916},[14,2113,2114],{},[42,2115,2116],{},"Module-Specific Exposure Types:",[14,2118,2119],{},"Different modules generate different types of exposures:",[47,2121,2122,2128,2134,2140],{},[50,2123,2124,2127],{},[42,2125,2126],{},"Web Application Modules",": Focus on web-specific vulnerabilities (XSS, CSRF, injection)",[50,2129,2130,2133],{},[42,2131,2132],{},"Database Modules",": Emphasize data protection and access control exposures",[50,2135,2136,2139],{},[42,2137,2138],{},"Network Modules",": Highlight network security and segmentation issues",[50,2141,2142,2145],{},[42,2143,2144],{},"Cloud Modules",": Address cloud-specific misconfigurations and service exposures",[14,2147,2148],{},[42,2149,2150],{},"Best Practices for Configuration:",[165,2152,2153,2159,2165,2171,2177],{},[50,2154,2155,2158],{},[42,2156,2157],{},"Start with Secure Defaults",": Choose secure configuration options initially",[50,2160,2161,2164],{},[42,2162,2163],{},"Monitor Exposure Changes",": Watch how different settings affect exposures",[50,2166,2167,2170],{},[42,2168,2169],{},"Address High-Criticality First",": Focus on high and critical exposures immediately",[50,2172,2173,2176],{},[42,2174,2175],{},"Understand MITRE Mappings",": Learn what attack techniques your exposures enable",[50,2178,2179,2182],{},[42,2180,2181],{},"Iterative Improvement",": Make incremental configuration improvements and observe exposure changes",[35,2184,2186],{"id":2185},"apis-and-services","APIs and Services",[14,2188,2189],{},"API components handle business logic and data processing between different system layers.",[1278,2191,1281],{"id":2192},"basic-configuration-1",[14,2194,2195],{},[42,2196,2197],{},"API Properties:",[47,2199,2200,2206,2212,2218],{},[50,2201,2202,2205],{},[42,2203,2204],{},"API Type",": REST, GraphQL, gRPC, SOAP",[50,2207,2208,2211],{},[42,2209,2210],{},"Protocol",": HTTP, HTTPS, TCP",[50,2213,2214,2217],{},[42,2215,2216],{},"Documentation",": OpenAPI, schema definitions",[50,2219,2220,2223],{},[42,2221,2222],{},"Versioning Strategy",": URL path, header, query parameter",[1278,2225,2227],{"id":2226},"security-configuration","Security Configuration",[14,2229,2230],{},[42,2231,2232],{},"Authentication and Authorization:",[1417,2234,2237],{"className":2235,"code":2236,"language":1422},[1420],"Authentication Method: [API Keys | JWT | OAuth 2.0 | mTLS]\nAuthorization Model: [RBAC | ABAC | Custom]\nToken Validation: [Local | Remote | Cached]\nScope Management: [Granular | Coarse | None]\n",[79,2238,2236],{"__ignoreMap":1425},[14,2240,2241],{},[42,2242,2243],{},"Example - Payment API:",[47,2245,2246,2251,2257,2272],{},[50,2247,2248,2250],{},[42,2249,1437],{},": OAuth 2.0 with client credentials",[50,2252,2253,2256],{},[42,2254,2255],{},"Authorization",": Role-based access control (RBAC)",[50,2258,2259,2262,2263,238,2266,238,2269],{},[42,2260,2261],{},"Scopes",": ",[79,2264,2265],{},"payment:read",[79,2267,2268],{},"payment:write",[79,2270,2271],{},"payment:refund",[50,2273,2274,2277],{},[42,2275,2276],{},"Token Lifetime",": 1 hour with refresh capability",[14,2279,2280],{},[42,2281,2282],{},"API Security:",[1417,2284,2287],{"className":2285,"code":2286,"language":1422},[1420],"Rate Limiting: [Per IP | Per User | Per API Key]\nRequest Size Limits: [MB]\nResponse Filtering: [Enabled | Disabled]\nCORS Configuration: [Specific origins | Wildcard | Disabled]\n",[79,2288,2286],{"__ignoreMap":1425},[14,2290,2291],{},[42,2292,2293],{},"Data Validation:",[1417,2295,2298],{"className":2296,"code":2297,"language":1422},[1420],"Input Schema Validation: [Strict | Permissive | Disabled]\nOutput Schema Validation: [Enabled | Disabled]\nParameter Sanitization: [Automatic | Manual]\nSQL Injection Protection: [Enabled | Disabled]\n",[79,2299,2297],{"__ignoreMap":1425},[21,2301,1223],{"id":2302},"data-store-components-1",[35,2304,1230],{"id":2305},"databases",[14,2307,2308],{},"Database components store and process sensitive information, making them critical security targets.",[1278,2310,1281],{"id":2311},"basic-configuration-2",[14,2313,2314],{},[42,2315,1286],{},[47,2317,2318,2323],{},[50,2319,2320,2322],{},[42,2321,1293],{},": Descriptive database name (e.g., \"User Database\")",[50,2324,2325,2327],{},[42,2326,1299],{},": Purpose and data types stored",[14,2329,2330],{},[42,2331,2332],{},"Class Assignment:",[165,2334,2335,2340],{},[50,2336,2337,2338],{},"Pick a store class from the catalogue your installed modules provide (e.g., \"Relational Database\", \"Object Storage\") — the full workflow is in ",[29,2339,577],{"href":1324},[50,2341,2342],{},"The class determines available configuration attributes",[14,2344,2345],{},[42,2346,2347],{},"Database Properties (after class assignment):",[47,2349,2350,2356,2361,2367],{},[50,2351,2352,2355],{},[42,2353,2354],{},"Database Type",": Inherited from class (PostgreSQL, MySQL, MongoDB, etc.)",[50,2357,2358,2360],{},[42,2359,1108],{},": Specific version number",[50,2362,2363,2366],{},[42,2364,2365],{},"Deployment Mode",": Standalone, cluster, managed service",[50,2368,2369,2372],{},[42,2370,2371],{},"Data Classification",": Public, Internal, Confidential, Restricted",[1278,2374,2227],{"id":2375},"security-configuration-1",[14,2377,2378],{},[42,2379,2380],{},"Access Control:",[1417,2382,2385],{"className":2383,"code":2384,"language":1422},[1420],"Authentication Method: [Username\u002FPassword | Certificate | IAM | LDAP]\nConnection Encryption: [TLS 1.2+ | Native | None]\nNetwork Access: [Local only | Private network | Public with restrictions]\nConnection Pooling: [Enabled | Disabled]\nMaximum Connections: [Number]\n",[79,2386,2384],{"__ignoreMap":1425},[14,2388,2389],{},[42,2390,2391],{},"Example - User Database:",[47,2393,2394,2399,2405,2411],{},[50,2395,2396,2398],{},[42,2397,1437],{},": Username\u002Fpassword with rotation policy",[50,2400,2401,2404],{},[42,2402,2403],{},"Encryption",": TLS 1.3 for connections, AES-256 for data at rest",[50,2406,2407,2410],{},[42,2408,2409],{},"Network",": Private network only, no public access",[50,2412,2413,2416],{},[42,2414,2415],{},"Connection Pool",": Maximum 20 connections, 5-minute timeout",[14,2418,2419],{},[42,2420,2421],{},"Data Protection:",[1417,2423,2426],{"className":2424,"code":2425,"language":1422},[1420],"Encryption at Rest: [Enabled | Disabled]\nEncryption Algorithm: [AES-256 | AES-128 | Custom]\nKey Management: [Cloud KMS | HSM | File-based | Application-managed]\nBackup Encryption: [Enabled | Disabled]\n",[79,2427,2425],{"__ignoreMap":1425},[14,2429,2430],{},[42,2431,2432],{},"Audit and Monitoring:",[1417,2434,2437],{"className":2435,"code":2436,"language":1422},[1420],"Query Logging: [All | DDL only | Failed attempts | Disabled]\nAccess Logging: [Enabled | Disabled]\nPerformance Monitoring: [Enabled | Disabled]\nAlert Thresholds: [Custom settings]\n",[79,2438,2436],{"__ignoreMap":1425},[1278,2440,2442],{"id":2441},"database-specific-configurations","Database-Specific Configurations",[14,2444,2445],{},[42,2446,2447],{},"PostgreSQL Security:",[47,2449,2450,2461,2467,2477],{},[50,2451,2452,2262,2455,557,2458],{},[42,2453,2454],{},"SSL Mode",[79,2456,2457],{},"require",[79,2459,2460],{},"verify-full",[50,2462,2463,2466],{},[42,2464,2465],{},"Row Level Security",": Enable for multi-tenant applications",[50,2468,2469,2472,2473,2476],{},[42,2470,2471],{},"Connection Limits",": Set ",[79,2474,2475],{},"max_connections"," appropriately",[50,2478,2479,2482,2483,2486],{},[42,2480,2481],{},"Logging",": Enable ",[79,2484,2485],{},"log_statement = 'all'"," for audit requirements",[14,2488,2489],{},[42,2490,2491],{},"MongoDB Security:",[47,2493,2494,2502,2507,2516],{},[50,2495,2496,2482,2498,2501],{},[42,2497,1437],{},[79,2499,2500],{},"--auth"," flag",[50,2503,2504,2506],{},[42,2505,2255],{},": Use role-based access control",[50,2508,2509,2512,2513],{},[42,2510,2511],{},"Network Binding",": Bind to specific interfaces, not ",[79,2514,2515],{},"0.0.0.0",[50,2517,2518,2521],{},[42,2519,2520],{},"Journaling",": Enable for data durability",[35,2523,1236],{"id":2524},"file-systems",[14,2526,2527],{},"File system components handle document storage, uploads, and file processing.",[1278,2529,1281],{"id":2530},"basic-configuration-3",[14,2532,2533],{},[42,2534,2535],{},"Storage Properties:",[47,2537,2538,2544,2550,2556],{},[50,2539,2540,2543],{},[42,2541,2542],{},"Storage Type",": Local file system, NFS, cloud storage",[50,2545,2546,2549],{},[42,2547,2548],{},"Access Method",": Direct access, API-based, mounted",[50,2551,2552,2555],{},[42,2553,2554],{},"Capacity",": Storage limits and quotas",[50,2557,2558,2561],{},[42,2559,2560],{},"Retention Policy",": Data lifecycle management",[1278,2563,2227],{"id":2564},"security-configuration-2",[14,2566,2567],{},[42,2568,2380],{},[1417,2570,2573],{"className":2571,"code":2572,"language":1422},[1420],"File Permissions: [Restrictive (644\u002F755) | Standard (664\u002F775) | Permissive]\nDirectory Structure: [Controlled | Open]\nUser Access: [Service account only | Multiple users | Public]\nEncryption: [File-level | Directory-level | Volume-level | None]\n",[79,2574,2572],{"__ignoreMap":1425},[14,2576,2577],{},[42,2578,2579],{},"File Upload Security:",[1417,2581,2584],{"className":2582,"code":2583,"language":1422},[1420],"File Type Restrictions: [Whitelist | Blacklist | None]\nFile Size Limits: [MB per file]\nVirus Scanning: [Enabled | Disabled]\nContent Inspection: [Deep scan | Basic | None]\nUpload Quarantine: [Enabled | Disabled]\n",[79,2585,2583],{"__ignoreMap":1425},[35,2587,2589],{"id":2588},"caches-and-session-stores","Caches and Session Stores",[14,2591,2592],{},"Cache components improve performance but can expose sensitive data if misconfigured.",[1278,2594,1281],{"id":2595},"basic-configuration-4",[14,2597,2598],{},[42,2599,2600],{},"Cache Properties:",[47,2602,2603,2609,2615,2621],{},[50,2604,2605,2608],{},[42,2606,2607],{},"Cache Type",": Redis, Memcached, in-memory, distributed",[50,2610,2611,2614],{},[42,2612,2613],{},"Cache Size",": Memory allocation limits",[50,2616,2617,2620],{},[42,2618,2619],{},"Eviction Policy",": LRU, LFU, TTL-based",[50,2622,2623,2626],{},[42,2624,2625],{},"Persistence",": Disk backup, cluster replication",[1278,2628,2227],{"id":2629},"security-configuration-3",[14,2631,2632],{},[42,2633,2421],{},[1417,2635,2638],{"className":2636,"code":2637,"language":1422},[1420],"Encryption in Transit: [TLS | None]\nEncryption at Rest: [Enabled | Disabled]\nAuthentication: [Password | Certificate | None]\nNetwork Binding: [Localhost | Private network | Public]\n",[79,2639,2637],{"__ignoreMap":1425},[14,2641,2642],{},[42,2643,2644],{},"Cache Security:",[1417,2646,2649],{"className":2647,"code":2648,"language":1422},[1420],"Data Classification: [Sensitive | Non-sensitive | Mixed]\nTTL Settings: [Short-lived | Standard | Long-lived]\nKey Naming Strategy: [Predictable | Random | Hashed]\nAccess Patterns: [Read-heavy | Write-heavy | Balanced]\n",[79,2650,2648],{"__ignoreMap":1425},[21,2652,2654],{"id":2653},"external-entity-configuration","External Entity Configuration",[35,2656,2658],{"id":2657},"user-entities","User Entities",[14,2660,2661],{},"User entities represent different types of users accessing your system.",[1278,2663,2665],{"id":2664},"user-types","User Types",[14,2667,2668],{},[42,2669,2670],{},"End Users (Customers):",[47,2672,2673,2679,2684,2689],{},[50,2674,2675,2678],{},[42,2676,2677],{},"Trust Level",": Untrusted",[50,2680,2681,2683],{},[42,2682,2548],{},": Web interface, mobile app",[50,2685,2686,2688],{},[42,2687,1437],{},": Standard login, social login, guest access",[50,2690,2691,2694],{},[42,2692,2693],{},"Data Access",": Personal data only",[14,2696,2697],{},[42,2698,2699],{},"Internal Users (Employees):",[47,2701,2702,2707,2712,2717],{},[50,2703,2704,2706],{},[42,2705,2677],{},": Trusted (with verification)",[50,2708,2709,2711],{},[42,2710,2548],{},": Internal systems, VPN",[50,2713,2714,2716],{},[42,2715,1437],{},": Corporate SSO, multi-factor authentication",[50,2718,2719,2721],{},[42,2720,2693],{},": Role-based access to business data",[14,2723,2724],{},[42,2725,2726],{},"Administrators:",[47,2728,2729,2734,2739,2744],{},[50,2730,2731,2733],{},[42,2732,2677],{},": Highly trusted",[50,2735,2736,2738],{},[42,2737,2548],{},": Secure administrative interfaces",[50,2740,2741,2743],{},[42,2742,1437],{},": Strong MFA, privileged access management",[50,2745,2746,2748],{},[42,2747,2693],{},": System-wide access with audit logging",[14,2750,2751],{},[42,2752,2753],{},"Service Accounts:",[47,2755,2756,2761,2766,2771],{},[50,2757,2758,2760],{},[42,2759,2677],{},": System-level trust",[50,2762,2763,2765],{},[42,2764,2548],{},": API keys, certificates",[50,2767,2768,2770],{},[42,2769,1437],{},": Non-interactive authentication",[50,2772,2773,2775],{},[42,2774,2693],{},": Specific service permissions",[35,2777,2779],{"id":2778},"third-party-services","Third-Party Services",[14,2781,2782],{},"External service entities represent integrations with external systems.",[1278,2784,2786],{"id":2785},"service-configuration","Service Configuration",[14,2788,2789],{},[42,2790,2791],{},"Service Properties:",[47,2793,2794,2800,2806,2812],{},[50,2795,2796,2799],{},[42,2797,2798],{},"Provider",": Company\u002Forganization name",[50,2801,2802,2805],{},[42,2803,2804],{},"Service Type",": SaaS, API, data feed, infrastructure",[50,2807,2808,2811],{},[42,2809,2810],{},"Contract Type",": Paid subscription, free tier, partnership",[50,2813,2814,2817],{},[42,2815,2816],{},"Data Sharing Agreement",": Specific terms and conditions",[14,2819,2820],{},[42,2821,2822],{},"Security Assessment:",[1417,2824,2827],{"className":2825,"code":2826,"language":1422},[1420],"Security Certification: [SOC 2 | ISO 27001 | PCI DSS | Custom]\nData Location: [US | EU | Global | Unknown]\nEncryption Standards: [Industry standard | Basic | Unknown]\nIncident Response: [24\u002F7 | Business hours | Limited]\n",[79,2828,2826],{"__ignoreMap":1425},[14,2830,2831],{},[42,2832,2833],{},"Example - Payment Gateway:",[47,2835,2836,2841,2847,2853],{},[50,2837,2838,2840],{},[42,2839,2798],{},": Stripe, PayPal, Square",[50,2842,2843,2846],{},[42,2844,2845],{},"Certification",": PCI DSS Level 1",[50,2848,2849,2852],{},[42,2850,2851],{},"Data Location",": US and EU (data residency compliance)",[50,2854,2855,2858],{},[42,2856,2857],{},"SLA",": 99.9% uptime, 24\u002F7 support",[21,2860,2862],{"id":2861},"best-practices-by-component-type","Best Practices by Component Type",[35,2864,1206],{"id":2865},"web-applications-1",[165,2867,2868,2874,2880,2886,2892],{},[50,2869,2870,2873],{},[42,2871,2872],{},"Always use HTTPS"," in production environments",[50,2875,2876,2879],{},[42,2877,2878],{},"Implement input validation"," for all user inputs",[50,2881,2882,2885],{},[42,2883,2884],{},"Use security headers"," to prevent common web attacks",[50,2887,2888,2891],{},[42,2889,2890],{},"Enable proper session management"," with secure cookies",[50,2893,2894,2897],{},[42,2895,2896],{},"Implement rate limiting"," to prevent abuse",[35,2899,1230],{"id":2900},"databases-1",[165,2902,2903,2909,2915,2921,2927],{},[50,2904,2905,2908],{},[42,2906,2907],{},"Use encrypted connections"," (TLS 1.2+) for all database communications",[50,2910,2911,2914],{},[42,2912,2913],{},"Enable encryption at rest"," for sensitive data",[50,2916,2917,2920],{},[42,2918,2919],{},"Implement proper backup encryption"," and secure storage",[50,2922,2923,2926],{},[42,2924,2925],{},"Use connection pooling"," to manage database resources",[50,2928,2929,2932],{},[42,2930,2931],{},"Enable audit logging"," for compliance requirements",[35,2934,2936],{"id":2935},"apis","APIs",[165,2938,2939,2945,2951,2957,2962],{},[50,2940,2941,2944],{},[42,2942,2943],{},"Implement proper authentication and authorization"," for all endpoints",[50,2946,2947,2950],{},[42,2948,2949],{},"Use API gateways"," for centralized security controls",[50,2952,2953,2956],{},[42,2954,2955],{},"Validate all input data"," against defined schemas",[50,2958,2959,2961],{},[42,2960,2896],{}," per client\u002Fuser",[50,2963,2964,2967],{},[42,2965,2966],{},"Log all API access"," for monitoring and auditing",[35,2969,2971],{"id":2970},"file-storage","File Storage",[165,2973,2974,2980,2986,2992,2998],{},[50,2975,2976,2979],{},[42,2977,2978],{},"Restrict file types"," to only necessary formats",[50,2981,2982,2985],{},[42,2983,2984],{},"Implement virus scanning"," for all uploads",[50,2987,2988,2991],{},[42,2989,2990],{},"Use appropriate file permissions"," (principle of least privilege)",[50,2993,2994,2997],{},[42,2995,2996],{},"Enable file integrity monitoring"," for critical files",[50,2999,3000,3003],{},[42,3001,3002],{},"Implement secure deletion"," for sensitive files",[35,3005,1242],{"id":3006},"caches",[165,3008,3009,3015,3021,3027,3033],{},[50,3010,3011,3014],{},[42,3012,3013],{},"Encrypt sensitive cached data"," in transit and at rest",[50,3016,3017,3020],{},[42,3018,3019],{},"Use appropriate TTL values"," to minimize data exposure",[50,3022,3023,3026],{},[42,3024,3025],{},"Implement cache invalidation"," strategies",[50,3028,3029,3032],{},[42,3030,3031],{},"Monitor cache hit rates"," and performance",[50,3034,3035,3038],{},[42,3036,3037],{},"Secure cache network access"," (private networks only)",[21,3040,3042],{"id":3041},"data-item-management","Data Item Management",[35,3044,3046],{"id":3045},"understanding-data-items","Understanding Data Items",[14,3048,3049],{},"Data items represent the specific types of data that flow through, are processed by, or are stored within your system. Unlike components, which represent system elements, data items represent the information assets that need protection.",[14,3051,3052],{},"A data item belongs to the model, and you attach it to any element that handles it:",[47,3054,3055,3061,3066,3072,3078],{},[50,3056,3057,3060],{},[42,3058,3059],{},"Processes",": Data processed, transformed, or validated",[50,3062,3063,3065],{},[42,3064,1247],{},": Data sent to or received from external parties",[50,3067,3068,3071],{},[42,3069,3070],{},"Data Stores",": Data persisted, cached, or archived",[50,3073,3074,3077],{},[42,3075,3076],{},"Security Boundaries",": Data associated with the boundary as a whole",[50,3079,3080,3083],{},[42,3081,3082],{},"Data Flows",": Data transmitted between components",[14,3085,3086],{},"Because a data item is one object in the model, the same item can be attached to many elements, and an edit to it shows everywhere it is attached.",[35,3088,3090],{"id":3089},"creating-a-data-item","Creating a Data Item",[165,3092,3093,3099,3108,3117],{},[50,3094,3095,3098],{},[42,3096,3097],{},"Open the element's settings",": Double-click a component, boundary, or data flow on the canvas",[50,3100,3101,3104,3105,3107],{},[42,3102,3103],{},"Open the Data tab",": Click the ",[42,3106,649],{}," tab in the settings panel",[50,3109,3110,3104,3113,3116],{},[42,3111,3112],{},"Add a data item",[42,3114,3115],{},"+"," button to the right of the search bar",[50,3118,3119,3122,3123,238,3125,3127,3128,3131,3132,3135,3136],{},[42,3120,3121],{},"Fill in the Data dialog",": It opens with three tabs — ",[42,3124,143],{},[42,3126,773],{},", and ",[42,3129,3130],{},"Exposures",". A fourth, ",[42,3133,3134],{},"Controls",", appears once the data item is saved — see ",[29,3137,3139],{"href":3138},"#editing-and-deleting-data-items","Editing and Deleting Data Items",[14,3141,3142],{},[42,3143,3144],{},"General tab:",[47,3146,3147,3152,3157,3166],{},[50,3148,3149,3151],{},[42,3150,1293],{},": Descriptive name for the data type (e.g., \"Customer Payment Information\", \"User Authentication Tokens\")",[50,3153,3154,3156],{},[42,3155,1299],{},": What the data is and what it is used for",[50,3158,3159,3162,3163],{},[42,3160,3161],{},"Sensitivity, Regulatory flags, Origin, Credential",": Classification context — see ",[29,3164,231],{"href":3165},"#classifying-data-items",[50,3167,3168,3170],{},[42,3169,697],{},": The data class this item is an instance of, picked with the class picker in the right-hand column",[14,3172,3173],{},[42,3174,3175],{},"Choosing the class:",[14,3177,3178,3179,3182,3183,3185],{},"A data item takes a single ",[42,3180,3181],{},"data class",", picked from the catalogue your installed modules provide. The shipped ",[42,3184,1560],{}," module provides these:",[1417,3187,3190],{"className":3188,"code":3189,"language":1422},[1420],"Available Classes:\n├── Authentication Tokens\n├── Customer & Personal Data\n├── Security Logs\n├── System Configuration\n├── User Credentials\n└── User Input\n",[79,3191,3189],{"__ignoreMap":1425},[14,3193,3194,3195,3197,3198,416],{},"Search, browse, and confirmation work the same as for every other element — see ",[29,3196,577],{"href":1324},". If none of the available classes describes your data, the class you need has to come from a module: see ",[29,3199,85],{"href":31},[35,3201,3203],{"id":3202},"configuring-data-attributes-and-exposures","Configuring Data Attributes and Exposures",[14,3205,3206,3207,3209,3210,3213],{},"Once the data item has a class, the ",[42,3208,773],{}," tab shows that class's configuration form. The attributes come from the class, so they differ from class to class. For example, the ",[42,3211,3212],{},"Customer & Personal Data"," class asks, among others:",[1417,3215,3218],{"className":3216,"code":3217,"language":1422},[1420],"Encrypted At Rest: [Yes | No | Not answered]\nAt-Rest Encryption Strength: [none | weak | strong]\nBackups Encrypted: [Yes | No | Not answered]\nField-Level Protection Method: [none | truncation | one_way_hash | tokenization | field_level_encryption | pseudonymization]\nRetention Schedule Enforced: [Yes | No | Not answered]\nSecure Deletion Or Crypto-Shred: [Yes | No | Not answered]\n",[79,3219,3217],{"__ignoreMap":1425},[14,3221,3222,3223,3225,3226,3229,3230,3232],{},"When you save the attributes, the class's OPA\u002FRego policies evaluate them, and the resulting exposures appear on the dialog's ",[42,3224,3130],{}," tab — the same mechanism as for components (see ",[29,3227,1549],{"href":3228},"#understanding-security-exposures","). Two policies from the ",[42,3231,3212],{}," class, shortened:",[1417,3234,3236],{"className":1623,"code":3235,"language":1625,"meta":1425,"style":1425},"# Unencrypted PII at rest\n_unencrypted_pii_at_rest_def := {\n    \"name\": \"Unencrypted PII at rest\",\n    \"criticality\": \"high\",\n    \"exploited_by\": [\n        {\"label\": \"MitreAttackTechnique\", \"property\": \"attack_id\", \"value\": \"T1005\"}  # Data from Local System\n    ]\n}\n\nunencrypted_pii_at_rest[_unencrypted_pii_at_rest_def] if {\n    not input.encrypted_at_rest\n}\n\nunencrypted_pii_at_rest[_unencrypted_pii_at_rest_def] if {\n    input.at_rest_encryption_strength in [\"none\", \"weak\"]\n}\n\nexposures contains _unencrypted_pii_at_rest_def if {\n    count(unencrypted_pii_at_rest) > 0\n}\n\n# Indefinite retention and unsafe deletion\n_indefinite_retention_and_unsafe_deletion_def := {\n    \"name\": \"Indefinite retention and unsafe deletion\",\n    \"criticality\": \"medium\",\n    \"exploited_by\": []\n}\n\nindefinite_retention_and_unsafe_deletion[_indefinite_retention_and_unsafe_deletion_def] if {\n    not input.retention_schedule_enforced\n}\n\nindefinite_retention_and_unsafe_deletion[_indefinite_retention_and_unsafe_deletion_def] if {\n    input.soft_delete_leaves_recoverable_pii == true\n}\n\nexposures contains _indefinite_retention_and_unsafe_deletion_def if {\n    count(indefinite_retention_and_unsafe_deletion) > 0\n}\n",[79,3237,3238,3243,3248,3253,3257,3261,3266,3270,3274,3278,3283,3288,3292,3296,3300,3305,3309,3313,3318,3323,3327,3332,3338,3344,3350,3355,3361,3366,3371,3377,3383,3388,3393,3398,3404,3409,3414,3420,3426],{"__ignoreMap":1425},[1629,3239,3240],{"class":1631,"line":1632},[1629,3241,3242],{},"# Unencrypted PII at rest\n",[1629,3244,3245],{"class":1631,"line":1638},[1629,3246,3247],{},"_unencrypted_pii_at_rest_def := {\n",[1629,3249,3250],{"class":1631,"line":1644},[1629,3251,3252],{},"    \"name\": \"Unencrypted PII at rest\",\n",[1629,3254,3255],{"class":1631,"line":1650},[1629,3256,1659],{},[1629,3258,3259],{"class":1631,"line":1656},[1629,3260,1665],{},[1629,3262,3263],{"class":1631,"line":1662},[1629,3264,3265],{},"        {\"label\": \"MitreAttackTechnique\", \"property\": \"attack_id\", \"value\": \"T1005\"}  # Data from Local System\n",[1629,3267,3268],{"class":1631,"line":1668},[1629,3269,1683],{},[1629,3271,3272],{"class":1631,"line":1674},[1629,3273,1689],{},[1629,3275,3276],{"class":1631,"line":1680},[1629,3277,1696],{"emptyLinePlaceholder":1695},[1629,3279,3280],{"class":1631,"line":1686},[1629,3281,3282],{},"unencrypted_pii_at_rest[_unencrypted_pii_at_rest_def] if {\n",[1629,3284,3285],{"class":1631,"line":1692},[1629,3286,3287],{},"    not input.encrypted_at_rest\n",[1629,3289,3290],{"class":1631,"line":1699},[1629,3291,1689],{},[1629,3293,3294],{"class":1631,"line":1705},[1629,3295,1696],{"emptyLinePlaceholder":1695},[1629,3297,3298],{"class":1631,"line":1711},[1629,3299,3282],{},[1629,3301,3302],{"class":1631,"line":1717},[1629,3303,3304],{},"    input.at_rest_encryption_strength in [\"none\", \"weak\"]\n",[1629,3306,3307],{"class":1631,"line":1723},[1629,3308,1689],{},[1629,3310,3311],{"class":1631,"line":1728},[1629,3312,1696],{"emptyLinePlaceholder":1695},[1629,3314,3315],{"class":1631,"line":1734},[1629,3316,3317],{},"exposures contains _unencrypted_pii_at_rest_def if {\n",[1629,3319,3320],{"class":1631,"line":1740},[1629,3321,3322],{},"    count(unencrypted_pii_at_rest) > 0\n",[1629,3324,3325],{"class":1631,"line":1745},[1629,3326,1689],{},[1629,3328,3330],{"class":1631,"line":3329},21,[1629,3331,1696],{"emptyLinePlaceholder":1695},[1629,3333,3335],{"class":1631,"line":3334},22,[1629,3336,3337],{},"# Indefinite retention and unsafe deletion\n",[1629,3339,3341],{"class":1631,"line":3340},23,[1629,3342,3343],{},"_indefinite_retention_and_unsafe_deletion_def := {\n",[1629,3345,3347],{"class":1631,"line":3346},24,[1629,3348,3349],{},"    \"name\": \"Indefinite retention and unsafe deletion\",\n",[1629,3351,3353],{"class":1631,"line":3352},25,[1629,3354,1720],{},[1629,3356,3358],{"class":1631,"line":3357},26,[1629,3359,3360],{},"    \"exploited_by\": []\n",[1629,3362,3364],{"class":1631,"line":3363},27,[1629,3365,1689],{},[1629,3367,3369],{"class":1631,"line":3368},28,[1629,3370,1696],{"emptyLinePlaceholder":1695},[1629,3372,3374],{"class":1631,"line":3373},29,[1629,3375,3376],{},"indefinite_retention_and_unsafe_deletion[_indefinite_retention_and_unsafe_deletion_def] if {\n",[1629,3378,3380],{"class":1631,"line":3379},30,[1629,3381,3382],{},"    not input.retention_schedule_enforced\n",[1629,3384,3386],{"class":1631,"line":3385},31,[1629,3387,1689],{},[1629,3389,3391],{"class":1631,"line":3390},32,[1629,3392,1696],{"emptyLinePlaceholder":1695},[1629,3394,3396],{"class":1631,"line":3395},33,[1629,3397,3376],{},[1629,3399,3401],{"class":1631,"line":3400},34,[1629,3402,3403],{},"    input.soft_delete_leaves_recoverable_pii == true\n",[1629,3405,3407],{"class":1631,"line":3406},35,[1629,3408,1689],{},[1629,3410,3412],{"class":1631,"line":3411},36,[1629,3413,1696],{"emptyLinePlaceholder":1695},[1629,3415,3417],{"class":1631,"line":3416},37,[1629,3418,3419],{},"exposures contains _indefinite_retention_and_unsafe_deletion_def if {\n",[1629,3421,3423],{"class":1631,"line":3422},38,[1629,3424,3425],{},"    count(indefinite_retention_and_unsafe_deletion) > 0\n",[1629,3427,3429],{"class":1631,"line":3428},39,[1629,3430,1689],{},[14,3432,3433],{},"A policy reads only the attributes of the data item it belongs to. Attaching the item to an element does not change that element's exposures, and the element's policies do not read the data item's attributes.",[35,3435,3437],{"id":3436},"the-data-tab","The Data Tab",[14,3439,307,3440,3442],{},[42,3441,649],{}," tab lists the model's data items in a table:",[316,3444,3447],{"className":3445,"tabIndex":320,"role":321,"ariaLabel":3446},[319],"Table: The Data Tab",[324,3448,3449,3459],{},[327,3450,3451],{},[330,3452,3453,3456],{},[333,3454,3455],{},"Column",[333,3457,3458],{},"What it shows",[340,3460,3461,3471,3480,3489,3498],{},[330,3462,3463,3468],{},[345,3464,3465],{},[42,3466,3467],{},"Checkbox",[345,3469,3470],{},"Whether the data item is attached to the current element",[330,3472,3473,3477],{},[345,3474,3475],{},[42,3476,1293],{},[345,3478,3479],{},"The data item's name",[330,3481,3482,3486],{},[345,3483,3484],{},[42,3485,1299],{},[345,3487,3488],{},"The data item's description",[330,3490,3491,3495],{},[345,3492,3493],{},[42,3494,697],{},[345,3496,3497],{},"The assigned data class, as a chip",[330,3499,3500,3505],{},[345,3501,3502],{},[17,3503,3504],{},"(actions)",[345,3506,3507,3508,3511,3512,3515],{},"An issue button, ",[42,3509,3510],{},"Edit"," (pencil), and ",[42,3513,3514],{},"Delete"," (trash can)",[14,3517,3518,3521,3522,3525],{},[42,3519,3520],{},"Searching:"," Type in the ",[42,3523,3524],{},"Search"," field to filter the table. It matches the data item's name, description, and class name, ignoring case, and updates as you type.",[14,3527,3528,3531],{},[42,3529,3530],{},"Choosing which data items to list:"," The toggle next to the search field switches between three views:",[316,3533,3535],{"className":3534,"tabIndex":320,"role":321,"ariaLabel":3446},[319],[324,3536,3537,3547],{},[327,3538,3539],{},[330,3540,3541,3544],{},[333,3542,3543],{},"View",[333,3545,3546],{},"Shows",[340,3548,3549,3559,3570],{},[330,3550,3551,3556],{},[345,3552,3553],{},[42,3554,3555],{},"All",[345,3557,3558],{},"Every data item in the model",[330,3560,3561,3567],{},[345,3562,3563,3566],{},[42,3564,3565],{},"Related"," (default)",[345,3568,3569],{},"Data items attached to this element, plus those on the elements directly connected to it — for a component, the data flows that arrive at or leave it; for a data flow, its source and target",[330,3571,3572,3577],{},[345,3573,3574],{},[42,3575,3576],{},"Own",[345,3578,3579],{},"Only the data items attached to this element",[35,3581,3583],{"id":3582},"attaching-and-detaching-data-items","Attaching and Detaching Data Items",[47,3585,3586,3592],{},[50,3587,3588,3591],{},[42,3589,3590],{},"Attach",": Check a data item's box. The attachment is saved immediately.",[50,3593,3594,3597,3598,3601],{},[42,3595,3596],{},"Detach",": Clear the box. A confirmation asks ",[17,3599,3600],{},"Remove data item '…' from this element?"," — confirm, and the data item stays in the model but is no longer attached to this element.",[14,3603,3604,3605,3607],{},"Switch the view to ",[42,3606,3555],{}," to attach a data item that is not yet on this element or its neighbours.",[35,3609,3139],{"id":3610},"editing-and-deleting-data-items",[47,3612,3613,3618,3644],{},[50,3614,3615,3617],{},[42,3616,3510],{},": Click the pencil icon in the data item's row to reopen the Data dialog. Changes to name, description, class, or attributes apply everywhere the data item is attached.",[50,3619,3620,3622,3623,3625,3626,3629,3630,3633,3634,3637,3638,3640,3641,416],{},[42,3621,3134],{},": The reopened Data dialog has a ",[42,3624,3134],{}," tab listing the controls assigned to the data item. Click the ",[42,3627,3628],{},"shield-plus"," button to add one with the same picker as on an element; a control you pick is saved at once. Untick a control to remove it — a confirmation asks ",[17,3631,3632],{},"Remove control '…' from this data entity?"," first. While a save of the data item is still running, a pick or an untick is refused with a warning, and so is the dialog's own save (the ",[42,3635,3636],{},"content-save"," button at the bottom), including the save that runs on its own after you pick a class on the ",[42,3639,143],{}," tab. A refused save keeps your edits in the form, so you can press the button again. Try again when the save is done; the warning suggests reloading the page if it does not finish. A control on a data item covers that data item's own exposures, not the elements it is attached to — see ",[29,3642,872],{"href":3643},"\u002Fplatform\u002Fworking-with-security-controls#universal-control-assignment",[50,3645,3646,3648,3649,3652],{},[42,3647,3514],{},": Click the trash-can icon. A confirmation asks ",[17,3650,3651],{},"Are you sure you want to delete this Data Item: …?"," — confirm, and the data item is removed from the model and from every element it was attached to.",[14,3654,3655,3657],{},[42,3656,1392],{},": Deleting a data item affects every element that uses it. If you only want it off the current element, detach it instead.",[35,3659,3661],{"id":3660},"where-data-items-show-up-in-analysis","Where Data Items Show Up in Analysis",[14,3663,3664,3665,3669,3670,3673,3674,3678],{},"Attaching data items records which elements handle which data. The ",[29,3666,3668],{"href":3667},"\u002Fthreat-report","Threat Report"," reads this: an element's profile lists the ",[42,3671,3672],{},"data handled"," by that element, with each item's sensitivity and its own exposure counts — see ",[29,3675,3677],{"href":3676},"\u002Fthreat-report\u002Fworking-with-findings","Working with Findings",". Keep attachments accurate so that view reflects how your system actually handles its data.",[35,3680,3682],{"id":3681},"best-practices-for-data-item-management","Best Practices for Data Item Management",[14,3684,3685],{},[42,3686,3687],{},"Classification:",[165,3689,3690,3698,3704],{},[50,3691,3692,3695,3696],{},[42,3693,3694],{},"Set sensitivity and regulatory flags"," on every data item — see ",[29,3697,231],{"href":3165},[50,3699,3700,3703],{},[42,3701,3702],{},"Use consistent terminology",": Keep one classification scheme across your models, and prefer the suggested regulatory flag labels",[50,3705,3706,3709],{},[42,3707,3708],{},"Review periodically",": Reassess classifications as the system changes",[14,3711,3712],{},[42,3713,3714],{},"Attachment:",[165,3716,3717,3723,3729],{},[50,3718,3719,3722],{},[42,3720,3721],{},"Full coverage",": Attach every relevant data item to the elements that handle it",[50,3724,3725,3728],{},[42,3726,3727],{},"Accuracy",": Attachments should reflect how data is actually handled",[50,3730,3731,3734,3735,3737],{},[42,3732,3733],{},"Flow consistency",": Data on a component should match the data on the flows that reach it — the ",[42,3736,3565],{}," view helps you check",[14,3739,3740],{},[42,3741,3742],{},"Attributes:",[165,3744,3745,3754],{},[50,3746,3747,3750,3751],{},[42,3748,3749],{},"Answer the class's attributes",": Unanswered attributes can raise exposures, so fill in what you know — see ",[29,3752,876],{"href":3753},"#answering-yes-or-no-attributes",[50,3755,3756,3759],{},[42,3757,3758],{},"Least privilege and defence in depth",": Record the access restrictions and layered protections that actually apply to sensitive data",[3761,3762],"hr",{},[14,3764,3765],{},[42,3766,3767],{},"Next Steps:",[47,3769,3770,3779,3786],{},[50,3771,3772,3778],{},[42,3773,3774],{},[29,3775,3777],{"href":3776},"\u002Fplatform\u002Fsecurity-analysis-workflow","Security Analysis Workflow",": Analyze your configured components",[50,3780,3781,3785],{},[42,3782,3783],{},[29,3784,872],{"href":871},": Implement protective measures",[50,3787,3788,3792],{},[42,3789,3790],{},[29,3791,85],{"href":31},": Learn about Data Classes and policy evaluation",[3794,3795,3796],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sDN9O, html code.shiki .sDN9O{--shiki-default:#6A737D;--shiki-dark:#768390}html pre.shiki code .sYgZi, html code.shiki .sYgZi{--shiki-default:#24292E;--shiki-dark:#ADBAC7}html pre.shiki code .s7YZ4, html code.shiki .s7YZ4{--shiki-default:#D73A49;--shiki-dark:#F47067}html pre.shiki code .s-HuK, html code.shiki .s-HuK{--shiki-default:#032F62;--shiki-dark:#96D0FF}html pre.shiki code .sviXB, html code.shiki .sviXB{--shiki-default:#005CC5;--shiki-dark:#6CB6FF}html pre.shiki code .sOLd2, html code.shiki .sOLd2{--shiki-default:#6F42C1;--shiki-dark:#F69D50}",{"title":1425,"searchDepth":1644,"depth":1644,"links":3798},[3799,3803,3808,3814,3821,3822,3828,3829,3834,3846,3861,3869,3876],{"id":23,"depth":1638,"text":24,"children":3800},[3801,3802],{"id":37,"depth":1644,"text":38},{"id":89,"depth":1644,"text":90},{"id":125,"depth":1638,"text":126,"children":3804},[3805,3806,3807],{"id":136,"depth":1644,"text":137},{"id":162,"depth":1644,"text":163},{"id":209,"depth":1644,"text":210},{"id":230,"depth":1638,"text":231,"children":3809},[3810,3811,3812,3813],{"id":237,"depth":1644,"text":258},{"id":298,"depth":1644,"text":299},{"id":244,"depth":1644,"text":424},{"id":248,"depth":1644,"text":548},{"id":576,"depth":1638,"text":577,"children":3815},[3816,3817,3818,3819,3820],{"id":589,"depth":1644,"text":590},{"id":674,"depth":1644,"text":675},{"id":777,"depth":1644,"text":778},{"id":820,"depth":1644,"text":821},{"id":852,"depth":1644,"text":853},{"id":875,"depth":1638,"text":876},{"id":923,"depth":1638,"text":924,"children":3823},[3824,3825,3826,3827],{"id":954,"depth":1644,"text":955},{"id":991,"depth":1644,"text":992},{"id":1096,"depth":1644,"text":1097},{"id":1107,"depth":1644,"text":1108},{"id":1137,"depth":1638,"text":1138},{"id":1191,"depth":1638,"text":1192,"children":3830},[3831,3832,3833],{"id":1198,"depth":1644,"text":1199},{"id":1222,"depth":1644,"text":1223},{"id":1246,"depth":1644,"text":1247},{"id":1270,"depth":1638,"text":1199,"children":3835},[3836,3842],{"id":1273,"depth":1644,"text":1206,"children":3837},[3838,3839,3840,3841],{"id":1280,"depth":1650,"text":1281},{"id":1399,"depth":1650,"text":1400},{"id":1481,"depth":1650,"text":1482},{"id":1548,"depth":1650,"text":1549},{"id":2185,"depth":1644,"text":2186,"children":3843},[3844,3845],{"id":2192,"depth":1650,"text":1281},{"id":2226,"depth":1650,"text":2227},{"id":2302,"depth":1638,"text":1223,"children":3847},[3848,3853,3857],{"id":2305,"depth":1644,"text":1230,"children":3849},[3850,3851,3852],{"id":2311,"depth":1650,"text":1281},{"id":2375,"depth":1650,"text":2227},{"id":2441,"depth":1650,"text":2442},{"id":2524,"depth":1644,"text":1236,"children":3854},[3855,3856],{"id":2530,"depth":1650,"text":1281},{"id":2564,"depth":1650,"text":2227},{"id":2588,"depth":1644,"text":2589,"children":3858},[3859,3860],{"id":2595,"depth":1650,"text":1281},{"id":2629,"depth":1650,"text":2227},{"id":2653,"depth":1638,"text":2654,"children":3862},[3863,3866],{"id":2657,"depth":1644,"text":2658,"children":3864},[3865],{"id":2664,"depth":1650,"text":2665},{"id":2778,"depth":1644,"text":2779,"children":3867},[3868],{"id":2785,"depth":1650,"text":2786},{"id":2861,"depth":1638,"text":2862,"children":3870},[3871,3872,3873,3874,3875],{"id":2865,"depth":1644,"text":1206},{"id":2900,"depth":1644,"text":1230},{"id":2935,"depth":1644,"text":2936},{"id":2970,"depth":1644,"text":2971},{"id":3006,"depth":1644,"text":1242},{"id":3041,"depth":1638,"text":3042,"children":3877},[3878,3879,3880,3881,3882,3883,3884,3885],{"id":3045,"depth":1644,"text":3046},{"id":3089,"depth":1644,"text":3090},{"id":3202,"depth":1644,"text":3203},{"id":3436,"depth":1644,"text":3437},{"id":3582,"depth":1644,"text":3583},{"id":3610,"depth":1644,"text":3139},{"id":3660,"depth":1644,"text":3661},{"id":3681,"depth":1644,"text":3682},"md",{"category":3888,"position":1705,"tags":3889},"advanced",[3888,3890,3891,3892,3893,3894,3895],"reference","detailed","components","configuration","technical","modules","\u002Fplatform\u002Fcomponent-configuration-guide",{"title":5,"description":19},"01.platform\u002F09.component-configuration-guide","mmFiHARHJoaaTmdupi2MGuXRyDsCBye2U_4DD6JyZJ0",[3901,3944,3979,4034,4064,4108,4123,4193],{"title":3902,"description":3903,"path":3904,"stem":3905,"children":3906,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[3907,3911,3916,3921,3924,3929,3932,3935,3940,3943],{"title":3908,"path":3904,"stem":3909,"description":3910},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":3912,"path":3913,"stem":3914,"description":3915},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":3917,"path":3918,"stem":3919,"description":3920},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":3777,"path":3776,"stem":3922,"description":3923},"01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":3925,"path":3926,"stem":3927,"description":3928},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":872,"path":871,"stem":3930,"description":3931},"01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":1155,"path":1154,"stem":3933,"description":3934},"01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":3936,"path":3937,"stem":3938,"description":3939},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":85,"path":31,"stem":3941,"description":3942},"01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":5,"path":3896,"stem":3898,"description":19},{"title":3945,"description":3946,"path":3947,"stem":3948,"children":3949,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[3950,3954,3959,3964,3969,3974],{"title":3951,"path":3947,"stem":3952,"description":3953},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":3955,"path":3956,"stem":3957,"description":3958},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":3960,"path":3961,"stem":3962,"description":3963},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":3965,"path":3966,"stem":3967,"description":3968},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":3970,"path":3971,"stem":3972,"description":3973},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":3975,"path":3976,"stem":3977,"description":3978},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":3980,"description":3981,"path":3982,"stem":3983,"children":3984,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[3985,3989,3994,3999,4004,4009,4014,4019,4024,4029],{"title":3986,"path":3982,"stem":3987,"description":3988},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":3990,"path":3991,"stem":3992,"description":3993},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":3995,"path":3996,"stem":3997,"description":3998},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":4000,"path":4001,"stem":4002,"description":4003},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":4005,"path":4006,"stem":4007,"description":4008},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":4010,"path":4011,"stem":4012,"description":4013},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":4015,"path":4016,"stem":4017,"description":4018},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":4020,"path":4021,"stem":4022,"description":4023},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":4025,"path":4026,"stem":4027,"description":4028},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":4030,"path":4031,"stem":4032,"description":4033},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":3668,"description":4035,"path":3667,"stem":4036,"children":4037,"page":-1},"The residual-risk report over a threat model: reading it, filtering it and exporting it.","04.threat-report",[4038,4041,4046,4051,4056,4061],{"title":3668,"path":3667,"stem":4039,"description":4040},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":4042,"path":4043,"stem":4044,"description":4045},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":4047,"path":4048,"stem":4049,"description":4050},"Reading the Report","\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":4052,"path":4053,"stem":4054,"description":4055},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":4057,"path":4058,"stem":4059,"description":4060},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":3677,"path":3676,"stem":4062,"description":4063},"04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":4065,"description":4066,"path":4067,"stem":4068,"children":4069,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[4070,4074,4079,4084,4089,4094,4098,4103],{"title":4071,"path":4067,"stem":4072,"description":4073},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":4075,"path":4076,"stem":4077,"description":4078},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":4080,"path":4081,"stem":4082,"description":4083},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":4085,"path":4086,"stem":4087,"description":4088},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":4090,"path":4091,"stem":4092,"description":4093},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":4047,"path":4095,"stem":4096,"description":4097},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":4099,"path":4100,"stem":4101,"description":4102},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":4104,"path":4105,"stem":4106,"description":4107},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":4109,"description":4110,"path":4111,"stem":4112,"children":4113,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[4114,4118],{"title":4115,"path":4111,"stem":4116,"description":4117},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":4119,"path":4120,"stem":4121,"description":4122},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":4124,"description":4125,"path":4126,"stem":4127,"children":4128,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[4129,4133,4138,4143,4148,4153,4158,4163,4168,4173,4178,4183,4188],{"title":4130,"path":4126,"stem":4131,"description":4132},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":4134,"path":4135,"stem":4136,"description":4137},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":4139,"path":4140,"stem":4141,"description":4142},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":4144,"path":4145,"stem":4146,"description":4147},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":4149,"path":4150,"stem":4151,"description":4152},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":4154,"path":4155,"stem":4156,"description":4157},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":4159,"path":4160,"stem":4161,"description":4162},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":4164,"path":4165,"stem":4166,"description":4167},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":4169,"path":4170,"stem":4171,"description":4172},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":4174,"path":4175,"stem":4176,"description":4177},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":4179,"path":4180,"stem":4181,"description":4182},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":4184,"path":4185,"stem":4186,"description":4187},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":4189,"path":4190,"stem":4191,"description":4192},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":4194,"description":4195,"path":4196,"stem":4197,"children":4198,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[4199,4203,4208],{"title":4200,"path":4196,"stem":4201,"description":4202},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":4204,"path":4205,"stem":4206,"description":4207},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":4209,"path":4210,"stem":4211,"description":4212},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748184840]