[{"data":1,"prerenderedAt":1341},["ShallowReactive",2],{"page-\u002Fplatform\u002Fmanaging-findings":3,"navigation":1022},{"id":4,"title":5,"body":6,"description":1005,"extension":1006,"meta":1007,"navigation":1017,"path":1018,"seo":1019,"stem":1020,"__hash__":1021},"docs\u002F01.platform\u002F04.managing-findings.md","Managing Findings",{"type":7,"value":8,"toc":983},"minimark",[9,13,20,25,28,45,58,69,98,103,175,187,191,194,321,336,350,354,357,387,394,398,405,437,448,452,458,467,481,497,501,516,540,543,546,610,624,634,637,644,703,706,716,730,743,750,764,767,777,789,795,823,829,832,835,866,869,883,887,893,918,931,938,944,948,956,960],[10,11,5],"h1",{"id":12},"managing-findings",[14,15,16],"p",{},[17,18,19],"em",{},"Record decisions on system-generated findings instead of deleting them.",[21,22,24],"h2",{"id":23},"overview","Overview",[14,26,27],{},"Modules generate findings for you automatically:",[29,30,31,39],"ul",{},[32,33,34,38],"li",{},[35,36,37],"strong",{},"Exposures"," — security weaknesses detected on a component, security boundary, data flow, or data item.",[32,40,41,44],{},[35,42,43],{},"Countermeasures"," — defensive controls derived from a control's class.",[14,46,47,48,51,52,57],{},"These are ",[17,49,50],{},"system-generated",": the platform re-derives them whenever the element's class or attributes change, and after a module update that changes the class's rules (see ",[53,54,56],"a",{"href":55},"#after-a-module-update","After a module update","). Often you'll disagree with a specific finding for a specific situation — an exposure that doesn't apply to an internal-only tool, a control you've consciously decided not to implement, a finding the template raised by mistake. Deleting it doesn't help: the next time the model changes, the platform recreates it.",[14,59,60,61,64,65,68],{},"A ",[35,62,63],{},"disposition"," records your decision ",[17,66,67],{},"on"," the finding — a kind plus a written reason — so the finding stays visible but clearly marked, the decision survives re-derivation, and your reasoning is captured for the next reviewer.",[14,70,71,72,75,76,79,80,83,84,87,88,92,93,97],{},"A disposition does one of two things. Most kinds ",[35,73,74],{},"mute"," the finding: they record that it doesn't apply, isn't real, or has been waived, and the finding drops out of your live risk. One kind — ",[35,77,78],{},"Affirm"," — does the opposite: it records that the finding ",[17,81,82],{},"is"," real and you've confirmed it, and the finding ",[35,85,86],{},"stays live",". See ",[53,89,91],{"href":90},"#affirming-a-finding-confirmed-live-risk","Affirming a finding"," and ",[53,94,96],{"href":95},"#the-finding-lifecycle","The finding lifecycle",".",[99,100,102],"h3",{"id":101},"system-generated-vs-your-own-findings","System-generated vs. your own findings",[104,105,111],"div",{"className":106,"tabIndex":108,"role":109,"ariaLabel":110},[107],"table-frame",0,"region","Table: System-generated vs. your own findings",[112,113,114,129],"table",{},[115,116,117],"thead",{},[118,119,120,123,126],"tr",{},[121,122],"th",{},[121,124,125],{},"System-generated",[121,127,128],{},"Your own (user-authored)",[130,131,132,144,155,166],"tbody",{},[118,133,134,138,141],{},[135,136,137],"td",{},"Created by",[135,139,140],{},"A module, automatically",[135,142,143],{},"You",[118,145,146,149,152],{},[135,147,148],{},"Edit \u002F delete directly",[135,150,151],{},"No",[135,153,154],{},"Yes",[118,156,157,160,163],{},[135,158,159],{},"Disposition",[135,161,162],{},"Yes — record a decision",[135,164,165],{},"No — just edit or delete it",[118,167,168,171,173],{},[135,169,170],{},"Survives re-derivation",[135,172,154],{},[135,174,154],{},[14,176,177,178,181,182,186],{},"To take over a system-generated finding and edit it freely, ",[35,179,180],{},"Customize"," it (see ",[53,183,185],{"href":184},"#customizing-a-finding-editable-copy","Customizing a finding",").",[21,188,190],{"id":189},"disposition-kinds","Disposition kinds",[14,192,193],{},"Pick the kind that matches your reasoning. Every disposition requires a reason.",[104,195,198],{"className":196,"tabIndex":108,"role":109,"ariaLabel":197},[107],"Table: Disposition kinds",[112,199,200,217],{},[115,201,202],{},[118,203,204,207,210,214],{},[121,205,206],{},"Kind",[121,208,209],{},"Applies to",[121,211,213],{"align":212},"center","Keeps finding live?",[121,215,216],{},"Meaning",[130,218,219,236,250,264,278,292,306],{},[118,220,221,226,229,233],{},[135,222,223],{},[35,224,225],{},"Affirmed",[135,227,228],{},"Exposures, Countermeasures",[135,230,231],{"align":212},[35,232,154],{},[135,234,235],{},"You reviewed the finding and confirmed it: a real, live risk (Exposure) \u002F a control that is confirmed in place (Countermeasure).",[118,237,238,243,245,247],{},[135,239,240],{},[35,241,242],{},"Not Applicable",[135,244,228],{},[135,246,151],{"align":212},[135,248,249],{},"The finding cannot or does not apply to this instantiation.",[118,251,252,257,259,261],{},[135,253,254],{},[35,255,256],{},"False Positive",[135,258,228],{},[135,260,151],{"align":212},[135,262,263],{},"The template raised this finding incorrectly for this kind of element.",[118,265,266,271,273,275],{},[135,267,268],{},[35,269,270],{},"Compensating Control",[135,272,37],{},[135,274,151],{"align":212},[135,276,277],{},"Another control — not formally linked — already mitigates this.",[118,279,280,285,287,289],{},[135,281,282],{},[35,283,284],{},"Risk Accepted",[135,286,37],{},[135,288,151],{"align":212},[135,290,291],{},"The threat is real and unmitigated, and you accept the residual risk.",[118,293,294,299,301,303],{},[135,295,296],{},[35,297,298],{},"Waived",[135,300,43],{},[135,302,151],{"align":212},[135,304,305],{},"You have decided not to implement this control.",[118,307,308,313,316,318],{},[135,309,310],{},[35,311,312],{},"Superseded",[135,314,315],{},"Both (set automatically)",[135,317,151],{"align":212},[135,319,320],{},"The finding was replaced by your own copy via Customize.",[14,322,323,325,326,329,330,333,334,97],{},[35,324,225],{}," is the exception. Every other kind ",[35,327,328],{},"mutes"," the finding — it stops counting toward your live, residual risk. Affirming a finding keeps it ",[35,331,332],{},"live"," while still marking it as triaged: it's the difference between \"this doesn't apply\" (mute) and \"yes, this is real, and I've confirmed it\" (keep live, now clearly reviewed). See ",[53,335,91],{"href":90},[14,337,338,339,341,342,345,346,97],{},"Dispositions carry no severity colour-coding — the kind and the reason carry the meaning, and a disposed row keeps the quiet outlined chip whatever kind it holds. The ",[35,340,78],{}," action button is info-blue for both finding types. What it ",[17,343,344],{},"produces"," is colour-coded, and deliberately not the same for both — see ",[53,347,349],{"href":348},"#reading-the-lifecycle-badges","Reading the lifecycle badges",[21,351,353],{"id":352},"disposing-an-exposure","Disposing an exposure",[14,355,356],{},"Exposures live on the element they were detected on — a component, a security boundary, a data flow, or a data item.",[358,359,360,374,381],"ol",{},[32,361,362,363,366,367,369,370,373],{},"Select the element and open its ",[35,364,365],{},"settings panel",", then the ",[35,368,37],{}," tab. For a data item, open the ",[35,371,372],{},"Data"," dialog instead; it hosts the same panel.",[32,375,376,377,380],{},"On a system-generated exposure, click the ",[35,378,379],{},"dispose"," action (the shield icon) in the row.",[32,382,383,384,97],{},"Choose a kind, enter a reason explaining the decision, and ",[35,385,386],{},"Save",[14,388,389,390,393],{},"The row now shows a disposition chip under the exposure name and sorts to the bottom of the list. To change the decision, open the dispose dialog again; to remove it, use ",[35,391,392],{},"Remove disposition"," in the dialog.",[21,395,397],{"id":396},"disposing-a-countermeasure","Disposing a countermeasure",[14,399,400,401,404],{},"Countermeasures live on the ",[35,402,403],{},"control"," they were derived from.",[358,406,407,417,423],{},[32,408,409,410,413,414,416],{},"Open the ",[35,411,412],{},"Control"," dialog and select the ",[35,415,43],{}," tab.",[32,418,419,420,422],{},"On a system-generated countermeasure, click the ",[35,421,379],{}," action (the shield icon).",[32,424,425,426,428,429,431,432,434,435,97],{},"Choose a kind (",[35,427,242],{},", ",[35,430,256],{},", or ",[35,433,298],{},"), enter a reason, and ",[35,436,386],{},[14,438,439,440,442,443,447],{},"The countermeasure shows a disposition chip under its name. The ",[35,441,43],{}," tab shows a count badge — ",[444,445,446],"code",{},"Countermeasures (N)"," — when one or more of its countermeasures need review (see below).",[21,449,451],{"id":450},"affirming-a-finding-confirmed-live-risk","Affirming a finding (confirmed live risk)",[14,453,454,455,457],{},"Sometimes the right answer isn't to mute a finding — it's to confirm it. You've looked at the exposure, agree it's a real risk for this element, and want that decision on the record without making the finding disappear. ",[35,456,78],{}," is the one-click action for exactly that.",[14,459,460,461,463,464,466],{},"Affirm appears alongside the other finding actions (in the ",[35,462,37],{}," tab, the Data panel, and the ",[35,465,412],{}," dialog). Click it on a system-generated finding to record it as:",[29,468,469,475],{},[32,470,471,474],{},[35,472,473],{},"Confirmed live risk"," — for an exposure you've reviewed and accept as a genuine, unmitigated risk, or",[32,476,477,480],{},[35,478,479],{},"Confirmed in place"," — for a countermeasure you've verified is actually implemented.",[14,482,483,484,486,487,490,491,494,495,97],{},"An affirmed finding ",[35,485,86],{},". Unlike the muting kinds, it still counts toward your residual risk — it's just now clearly triaged rather than unreviewed. You'll see a lifecycle cue on the row: a filled ",[35,488,489],{},"Confirmed risk"," badge on affirmed exposures, or a filled ",[35,492,493],{},"In place"," badge on affirmed countermeasures. They are toned differently on purpose — see ",[53,496,349],{"href":348},[99,498,500],{"id":499},"add-a-note-or-review-an-affirmation","Add a note or review an affirmation",[14,502,503,504,507,508,511,512,515],{},"To revisit an affirmation — to refine the reason you recorded, or simply re-read it — open its ",[35,505,506],{},"Add note"," \u002F ",[35,509,510],{},"Review"," action. This opens the affirm-edit dialog, where ",[35,513,514],{},"only the reason is editable",". Editing the note never converts the finding into a muting disposition; an affirmed finding stays affirmed and live until you explicitly choose a different kind through the dispose action.",[517,518,519],"blockquote",{},[14,520,521,524,525,527,528,531,532,535,536,97],{},[35,522,523],{},"Affirm is not \"re-affirm.\""," ",[17,526,78],{}," is a decision kind that confirms a finding as a live risk. ",[17,529,530],{},"Re-affirm"," is a separate action that re-stamps an ",[35,533,534],{},"existing"," disposition of any kind to clear a stale flag. They are different — see ",[53,537,539],{"href":538},"#when-a-disposition-goes-stale","When a disposition goes stale",[21,541,96],{"id":542},"the-finding-lifecycle",[14,544,545],{},"Every finding sits in one of three lifecycle states. You don't set this state directly — the platform derives it from the finding's disposition and who recorded it, so the same rules apply everywhere a finding is shown.",[104,547,550],{"className":548,"tabIndex":108,"role":109,"ariaLabel":549},[107],"Table: The finding lifecycle",[112,551,552,565],{},[115,553,554],{},[118,555,556,559,562],{},[121,557,558],{},"State",[121,560,561],{},"What it means",[121,563,564],{},"How a finding gets here",[130,566,567,580,597],{},[118,568,569,574,577],{},[135,570,571],{},[35,572,573],{},"Pending",[135,575,576],{},"A system-generated finding awaiting your review.",[135,578,579],{},"A module derived it and no one has acted on it yet.",[118,581,582,587,590],{},[135,583,584],{},[35,585,586],{},"Confirmed",[135,588,589],{},"A reviewed, live finding.",[135,591,592,593,596],{},"You ",[35,594,595],{},"affirmed"," it, or you authored it yourself.",[118,598,599,604,607],{},[135,600,601],{},[35,602,603],{},"Disposed",[135,605,606],{},"A muted finding that no longer counts as live risk.",[135,608,609],{},"You gave it any muting kind (Not Applicable, False Positive, Compensating Control, Risk Accepted, Waived, or Superseded).",[14,611,612,613,92,616,619,620,623],{},"Both ",[35,614,615],{},"pending",[35,617,618],{},"confirmed"," findings are live — they count toward your residual risk. The difference is review status: pending means \"nobody has looked at this yet,\" confirmed means \"someone reviewed it and stands behind it.\" Only ",[35,621,622],{},"disposed"," findings drop out of your live risk.",[14,625,626,627,630,631,633],{},"Each tab shows a ",[35,628,629],{},"pending count"," — for example ",[444,632,446],{}," — so you can see at a glance how many findings still need a first look.",[99,635,349],{"id":636},"reading-the-lifecycle-badges",[14,638,639,640,643],{},"The lifecycle state is shown on the row as a badge. There are three cases, and the middle one is deliberately ",[17,641,642],{},"not"," the same for the two finding types:",[104,645,648],{"className":646,"tabIndex":108,"role":109,"ariaLabel":647},[107],"Table: Reading the lifecycle badges",[112,649,650,662],{},[115,651,652],{},[118,653,654,656,659],{},[121,655,558],{},[121,657,658],{},"Exposure",[121,660,661],{},"Countermeasure",[130,663,664,675,692],{},[118,665,666,670,673],{},[135,667,668],{},[35,669,573],{},[135,671,672],{},"No badge",[135,674,672],{},[118,676,677,681,687],{},[135,678,679],{},[35,680,586],{},[135,682,683,684,686],{},"Filled ",[35,685,489],{}," badge, in the error\u002Fred tone",[135,688,683,689,691],{},[35,690,493],{}," badge, in the success\u002Fgreen tone",[118,693,694,698,701],{},[135,695,696],{},[35,697,603],{},[135,699,700],{},"Quiet outlined badge naming the kind",[135,702,700],{},[14,704,705],{},"Three things are worth understanding here.",[14,707,708,711,712,715],{},[35,709,710],{},"Pending shows no badge on purpose."," A model that has just been analyzed is ",[17,713,714],{},"all"," pending. Badging every row would make an untouched model look alarming when nothing is wrong yet. The backlog is surfaced once, as the per-tab pending count, rather than on every row.",[14,717,718,721,722,725,726,729],{},[35,719,720],{},"Confirmed is green for countermeasures and red for exposures",", and this asymmetry is the point. Both mean \"reviewed and confirmed\", but they confirm opposite things: a countermeasure you've verified is in place is ",[17,723,724],{},"good news",", and an exposure you've confirmed as a live risk is ",[17,727,728],{},"bad news",". A single neutral colour would flatten that distinction — the one place green is right in this UI is a control you have confirmed exists.",[14,731,732,735,736,742],{},[35,733,734],{},"A confirmed exposure is red, not yellow."," Yellow is reserved for the ",[53,737,738,739,741],{"href":538},"stale marker and the ",[35,740,510],{}," button",", so a confirmed risk never reads as \"this needs your attention again.\"",[14,744,745,746,749],{},"Disposed rows keep the quiet outlined chip whatever kind they carry — that is where the \"no severity colour-coding\" rule holds. It applies to ",[17,747,748],{},"dispositions",", not to the lifecycle badge.",[517,751,752],{},[14,753,754,757,758,760,761,763],{},[35,755,756],{},"Subtlety:"," an affirmation only counts as ",[35,759,618],{}," when it carries an attributed author. An affirmation with no recorded author is treated as ",[35,762,615],{},", not confirmed — a safeguard so that an unattributed affirmation is never mistaken for a reviewed decision.",[21,765,539],{"id":766},"when-a-disposition-goes-stale",[14,768,769,770,773,774,776],{},"A disposition reflects the model as it was when you set it. The platform flags it as ",[35,771,772],{},"stale"," when the model changes underneath it: the row gets a yellow marker and the dispose action becomes a ",[35,775,510],{}," button. Two changes do this:",[29,778,779,786],{},[32,780,781,782,785],{},"You change an ",[35,783,784],{},"instantiation attribute"," of the element — the kind of change that drives what findings the module derives.",[32,787,788],{},"A save of the element changes the MITRE techniques or other references linked to a system-generated finding: the class's policy now emits different ones, or the save removes a link someone added to the finding by hand. The platform's own re-evaluation after a module update counts as a save here.",[14,790,791,792,794],{},"Stale means \"the model changed underneath this decision — confirm it still holds.\" Click ",[35,793,510],{}," to:",[29,796,797,811,817],{},[32,798,799,801,802,804,805,807,808,810],{},[35,800,530],{}," the disposition (the reason and decision still apply) — this clears the stale flag and re-stamps the ",[17,803,534],{}," decision, whatever kind it is. (This is ",[35,806,642],{}," the same as ",[53,809,78],{"href":90},", which records a finding as a confirmed live risk; re-affirm only refreshes a disposition you already set.) Or",[32,812,813,816],{},[35,814,815],{},"Change"," the kind or reason, or",[32,818,819,822],{},[35,820,821],{},"Remove"," the disposition entirely.",[14,824,825,826,828],{},"Adding or removing a MITRE technique on a user-authored finding, such as your customized copy, does ",[17,827,642],{}," make any disposition stale.",[21,830,56],{"id":831},"after-a-module-update",[14,833,834],{},"When a module is updated, the rules that derive an element's findings may change. The platform then re-evaluates, in the background, every element whose class rules changed, as if the element were saved with no changes. You don't need to do anything, and the element's attribute values stay as they are. Once it has run:",[29,836,837,843,849,860],{},[32,838,839,842],{},[35,840,841],{},"New findings"," the module now derives appear, awaiting review.",[32,844,845,848],{},[35,846,847],{},"Findings the module no longer derives are removed, with their dispositions."," An affirmation, a mute and its reason are removed with the finding.",[32,850,851,854,855,857,858,186],{},[35,852,853],{},"A dispositioned finding whose techniques or references changed is flagged stale."," Click ",[35,856,510],{}," on it (see ",[53,859,539],{"href":538},[32,861,862,865],{},[35,863,864],{},"Your own findings are not touched",", including customized copies, even when the original a copy came from is removed.",[14,867,868],{},"The first start after an upgrade to a release with this behaviour re-evaluates every element once, so expect these changes then too. Elements of some modules, such as modules served from a remote service, are not re-evaluated; their findings change when you next save the element.",[517,870,874],{"className":871},[872,873],"callout","callout-tip",[14,875,876,879,880,882],{},[35,877,878],{},"Tip:"," to keep your own version of a live finding whatever a module update does to it, ",[35,881,180],{}," it (below). Your copy stays when the original is removed.",[21,884,886],{"id":885},"customizing-a-finding-editable-copy","Customizing a finding (editable copy)",[14,888,889,890,892],{},"When you want your own editable version of a system-generated finding — to adjust its content, references, or techniques — ",[35,891,180],{}," it. Change techniques and references on the copy: the next save of the element resets a system-generated finding's techniques and references to what the class's policy emits.",[358,894,895,905,915],{},[32,896,897,898,900,901,904],{},"On any ",[35,899,332],{}," system-generated finding, click the ",[35,902,903],{},"Customize as an editable copy"," action (the duplicate icon).",[32,906,907,908,911,912,914],{},"The platform creates a user-authored copy (named ",[444,909,910],{},"… (custom)",") attached to the same element, and marks the original as ",[35,913,312],{}," with a reason that references your copy.",[32,916,917],{},"Edit the copy freely. The original stays visible, marked Superseded, as a record of where the copy came from.",[14,919,920,923,924,927,928,930],{},[35,921,922],{},"Live"," means pending ",[17,925,926],{},"or"," affirmed. An affirmed finding carries a disposition and still offers Customize — confirming a finding as real is exactly the moment you may want your own version of it. Only ",[35,929,622],{}," findings hide the action: a muted finding has already been ruled out, so there is nothing to supersede.",[14,932,933,934,937],{},"If creating the copy succeeds but marking the original as superseded fails, you'll see a notice with a ",[35,935,936],{},"Retry"," option — your copy is already saved; retry only re-attempts the disposition.",[14,939,940,941,943],{},"Deleting your customized copy later flags the superseded original as ",[35,942,772],{},", prompting you to decide what to do with it now that the copy is gone.",[21,945,947],{"id":946},"what-you-cant-do","What you can't do",[29,949,950,953],{},[32,951,952],{},"You can't delete or edit a system-generated finding directly from the UI — dispose it, or Customize it and edit the copy.",[32,954,955],{},"You can't dispose a user-authored finding — edit or delete it directly instead.",[21,957,959],{"id":958},"see-also","See also",[29,961,962,969,976],{},[32,963,964,968],{},[53,965,967],{"href":966},"\u002Fplatform\u002Fsecurity-analysis-workflow","Security Analysis Workflow"," — running analysis and interpreting findings.",[32,970,971,975],{},[53,972,974],{"href":973},"\u002Fplatform\u002Fworking-with-security-controls","Working with Security Controls"," — creating controls and attaching MITRE techniques.",[32,977,978,982],{},[53,979,981],{"href":980},"\u002Fplatform\u002Fissue-management-guide","Issue Management Guide"," — turning findings into tracked work.",{"title":984,"searchDepth":985,"depth":985,"links":986},"",3,[987,991,992,993,994,997,1000,1001,1002,1003,1004],{"id":23,"depth":988,"text":24,"children":989},2,[990],{"id":101,"depth":985,"text":102},{"id":189,"depth":988,"text":190},{"id":352,"depth":988,"text":353},{"id":396,"depth":988,"text":397},{"id":450,"depth":988,"text":451,"children":995},[996],{"id":499,"depth":985,"text":500},{"id":542,"depth":988,"text":96,"children":998},[999],{"id":636,"depth":985,"text":349},{"id":766,"depth":988,"text":539},{"id":831,"depth":988,"text":56},{"id":885,"depth":988,"text":886},{"id":946,"depth":988,"text":947},{"id":958,"depth":988,"text":959},"Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.","md",{"category":1008,"position":1009,"tags":1010},"analysis",7,[1011,1012,1013,1014,1015,63,1016],"intermediate","guide","findings","exposures","countermeasures","workflow",true,"\u002Fplatform\u002Fmanaging-findings",{"title":5,"description":1005},"01.platform\u002F04.managing-findings","kb1wiR322ZgSKJdu1zTYKQrLHVJeOZvgqCYWAmw2yMU",[1023,1068,1103,1158,1192,1236,1251,1321],{"title":1024,"description":1025,"path":1026,"stem":1027,"children":1028,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[1029,1033,1038,1043,1046,1047,1050,1053,1058,1063],{"title":1030,"path":1026,"stem":1031,"description":1032},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":1034,"path":1035,"stem":1036,"description":1037},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":1039,"path":1040,"stem":1041,"description":1042},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":967,"path":966,"stem":1044,"description":1045},"01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":5,"path":1018,"stem":1020,"description":1005},{"title":974,"path":973,"stem":1048,"description":1049},"01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":981,"path":980,"stem":1051,"description":1052},"01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":1054,"path":1055,"stem":1056,"description":1057},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":1059,"path":1060,"stem":1061,"description":1062},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":1064,"path":1065,"stem":1066,"description":1067},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":1069,"description":1070,"path":1071,"stem":1072,"children":1073,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[1074,1078,1083,1088,1093,1098],{"title":1075,"path":1071,"stem":1076,"description":1077},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":1079,"path":1080,"stem":1081,"description":1082},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":1084,"path":1085,"stem":1086,"description":1087},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":1089,"path":1090,"stem":1091,"description":1092},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":1094,"path":1095,"stem":1096,"description":1097},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":1099,"path":1100,"stem":1101,"description":1102},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":1104,"description":1105,"path":1106,"stem":1107,"children":1108,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[1109,1113,1118,1123,1128,1133,1138,1143,1148,1153],{"title":1110,"path":1106,"stem":1111,"description":1112},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":1114,"path":1115,"stem":1116,"description":1117},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":1119,"path":1120,"stem":1121,"description":1122},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":1124,"path":1125,"stem":1126,"description":1127},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":1129,"path":1130,"stem":1131,"description":1132},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":1134,"path":1135,"stem":1136,"description":1137},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":1139,"path":1140,"stem":1141,"description":1142},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":1144,"path":1145,"stem":1146,"description":1147},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":1149,"path":1150,"stem":1151,"description":1152},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":1154,"path":1155,"stem":1156,"description":1157},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":1159,"description":1160,"path":1161,"stem":1162,"children":1163,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[1164,1167,1172,1177,1182,1187],{"title":1159,"path":1161,"stem":1165,"description":1166},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":1168,"path":1169,"stem":1170,"description":1171},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":1173,"path":1174,"stem":1175,"description":1176},"Reading the Report","\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":1178,"path":1179,"stem":1180,"description":1181},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":1183,"path":1184,"stem":1185,"description":1186},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":1188,"path":1189,"stem":1190,"description":1191},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":1193,"description":1194,"path":1195,"stem":1196,"children":1197,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[1198,1202,1207,1212,1217,1222,1226,1231],{"title":1199,"path":1195,"stem":1200,"description":1201},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":1203,"path":1204,"stem":1205,"description":1206},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":1208,"path":1209,"stem":1210,"description":1211},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":1213,"path":1214,"stem":1215,"description":1216},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":1218,"path":1219,"stem":1220,"description":1221},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":1173,"path":1223,"stem":1224,"description":1225},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":1227,"path":1228,"stem":1229,"description":1230},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":1232,"path":1233,"stem":1234,"description":1235},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":1237,"description":1238,"path":1239,"stem":1240,"children":1241,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[1242,1246],{"title":1243,"path":1239,"stem":1244,"description":1245},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":1247,"path":1248,"stem":1249,"description":1250},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":1252,"description":1253,"path":1254,"stem":1255,"children":1256,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[1257,1261,1266,1271,1276,1281,1286,1291,1296,1301,1306,1311,1316],{"title":1258,"path":1254,"stem":1259,"description":1260},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":1262,"path":1263,"stem":1264,"description":1265},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":1267,"path":1268,"stem":1269,"description":1270},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":1272,"path":1273,"stem":1274,"description":1275},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":1277,"path":1278,"stem":1279,"description":1280},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":1282,"path":1283,"stem":1284,"description":1285},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":1287,"path":1288,"stem":1289,"description":1290},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":1292,"path":1293,"stem":1294,"description":1295},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":1297,"path":1298,"stem":1299,"description":1300},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":1302,"path":1303,"stem":1304,"description":1305},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":1307,"path":1308,"stem":1309,"description":1310},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":1312,"path":1313,"stem":1314,"description":1315},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":1317,"path":1318,"stem":1319,"description":1320},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":1322,"description":1323,"path":1324,"stem":1325,"children":1326,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[1327,1331,1336],{"title":1328,"path":1324,"stem":1329,"description":1330},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":1332,"path":1333,"stem":1334,"description":1335},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":1337,"path":1338,"stem":1339,"description":1340},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748184840]