[{"data":1,"prerenderedAt":1955},["ShallowReactive",2],{"page-\u002Fplatform\u002Fquick-start":3,"navigation":1647},{"id":4,"title":5,"body":6,"description":1634,"extension":1635,"meta":1636,"navigation":1642,"path":1643,"seo":1644,"stem":1645,"__hash__":1646},"docs\u002F01.platform\u002F01.quick-start.md","Quick Start",{"type":7,"value":8,"toc":1609},"minimark",[9,13,22,25,30,52,58,60,64,172,174,178,181,197,200,385,390,396,412,422,430,432,436,439,469,472,485,487,491,498,569,573,628,632,671,685,705,709,798,801,819,823,830,847,850,854,857,934,936,956,968,971,978,980,984,987,990,1047,1054,1056,1060,1100,1115,1132,1140,1142,1146,1155,1223,1229,1235,1261,1265,1268,1272,1278,1312,1318,1322,1334,1347,1353,1372,1378,1389,1391,1394,1397,1435,1452,1459,1477,1505,1507,1511,1514,1529,1532,1534,1538,1605],[10,11,5],"h1",{"id":12},"quick-start",[14,15,16,17,21],"p",{},"This guide takes you from nothing to your first threat finding. You install the platform on your own machine, open it, draw a small online store, run the ",[18,19,20],"strong",{},"Threat Report",", and read its first finding.",[23,24],"hr",{},[26,27,29],"h2",{"id":28},"what-you-will-do","What you will do",[31,32,33,37,40,43,49],"ol",{},[34,35,36],"li",{},"Install the platform with one command.",[34,38,39],{},"Open it in your browser.",[34,41,42],{},"Draw a store: four elements in one boundary.",[34,44,45,46,48],{},"Run the ",[18,47,20],{},".",[34,50,51],{},"Read the first finding, then see what removes it.",[14,53,54,57],{},[18,55,56],{},"Time to allow."," The first install downloads a few GB: the container images, then an embedding model of about 1.26 GB in the background. Allow 30 minutes to an hour for a first install, most of it unattended download time. Drawing the model and reading its first finding then takes about 10 minutes.",[23,59],{},[26,61,63],{"id":62},"before-you-start","Before you start",[65,66,72],"div",{"className":67,"tabIndex":69,"role":70,"ariaLabel":71},[68],"table-frame",0,"region","Table: Before you start",[73,74,75,88],"table",{},[76,77,78],"thead",{},[79,80,81,85],"tr",{},[82,83,84],"th",{},"You need",[82,86,87],{},"Details",[89,90,91,109,119,138,148,158],"tbody",{},[79,92,93,99],{},[94,95,96],"td",{},[18,97,98],{},"A container engine",[94,100,101,104,105,108],{},[18,102,103],{},"Docker"," with the Compose plugin, or ",[18,106,107],{},"Podman 4.1+"," with a Compose provider. On macOS, the Podman machine must be running.",[79,110,111,116],{},[94,112,113],{},[18,114,115],{},"Linux or macOS",[94,117,118],{},"On Windows, run everything inside WSL.",[79,120,121,126],{},[94,122,123],{},[18,124,125],{},"Node.js 18 or later",[94,127,128,129,137],{},"Only to run the installer with npx. The deployment itself never needs it. Without Node.js, use ",[130,131,133],"a",{"href":132},"#without-nodejs",[134,135,136],"code",{},"get-byodt.sh"," instead.",[79,139,140,145],{},[94,141,142],{},[18,143,144],{},"Memory",[94,146,147],{},"The database runs with a 4 GB memory limit, and the embedding model adds about 0.9 GB. On Docker Desktop or a Podman machine, the virtual machine's memory is what counts. If it is capped at 4 GB or less, raise it first.",[79,149,150,155],{},[94,151,152],{},[18,153,154],{},"Disk",[94,156,157],{},"Several GB free in the folder you install into.",[79,159,160,165],{},[94,161,162],{},[18,163,164],{},"Internet access",[94,166,167,168,48],{},"On the first start, to download the images, modules and model. See ",[130,169,171],{"href":170},"\u002Fbyodt-cloud\u002Finstallation#network-access-for-the-first-start","Network access for the first start",[23,173],{},[26,175,177],{"id":176},"install-the-platform","Install the platform",[14,179,180],{},"Open a terminal in the folder where the deployment should live, such as your home folder. Run:",[182,183,188],"pre",{"className":184,"code":185,"language":186,"meta":187,"style":187},"language-sh shiki shiki-themes github-light github-dark-dimmed","npx @dether.net\u002Fbyodt@0.14.0\n","sh","",[134,189,190],{"__ignoreMap":187},[191,192,195],"span",{"class":193,"line":194},"line",1,[191,196,185],{},[14,198,199],{},"The installer asks a few questions. Answer them like this:",[31,201,202,212,221,256,370],{},[34,203,204,205,208,209,48],{},"npx may ask ",[134,206,207],{},"Ok to proceed?",". Answer ",[134,210,211],{},"y",[34,213,214,215,208,218,220],{},"The installer shows a third-party notice and asks ",[134,216,217],{},"Continue? [y\u002FN]",[134,219,211],{},". Nothing is downloaded before you do.",[34,222,223,224,227,228,236,239,240,246,247,250,251,255],{},"It downloads the release, checks it, and unpacks it into a new folder, ",[134,225,226],{},".\u002Fbyodt",". You see these lines among others:",[182,229,234],{"className":230,"code":232,"language":233},[231],"language-text","==> SHA-256 matches the release (…).\n==> Unpacked release 0.14.0 into .\u002Fbyodt.\n","text",[134,235,232],{"__ignoreMap":187},[237,238],"br",{},"If ",[130,241,245],{"href":242,"rel":243},"https:\u002F\u002Fgithub.com\u002Fsigstore\u002Fcosign",[244],"nofollow","cosign"," is installed, it also verifies the signature and prints ",[134,248,249],{},"==> Signature verified: the release workflow of dether-net\u002Fdethernety-oss at v0.14.0 signed it."," Without cosign, it warns that ",[252,253,254],"em",{},"the bundle's integrity was checked, its authenticity was not"," and goes on; install cosign to check who published it too.",[34,257,258,259,262,263,346],{},"Setup asks for your settings. Press Enter to keep each default, ",[18,260,261],{},"except the last one",":",[65,264,267],{"className":265,"tabIndex":69,"role":70,"ariaLabel":266},[68],"Table: Install the platform",[73,268,269,279],{},[76,270,271],{},[79,272,273,276],{},[82,274,275],{},"Question",[82,277,278],{},"Answer",[89,280,281,291,301,310,319,333],{},[79,282,283,288],{},[94,284,285],{},[134,286,287],{},"Graph database, memgraph or neo4j [memgraph]:",[94,289,290],{},"Enter",[79,292,293,299],{},[94,294,295,298],{},[134,296,297],{},"Keep the database in the engine's named volume? [Y\u002Fn]"," (Docker Desktop or a Podman machine only)",[94,300,290],{},[79,302,303,308],{},[94,304,305],{},[134,306,307],{},"Reach the console and the platform from other machines too (binds 0.0.0.0)? [y\u002FN]",[94,309,290],{},[79,311,312,317],{},[94,313,314],{},[134,315,316],{},"Port [3000]:",[94,318,290],{},[79,320,321,326],{},[94,322,323],{},[134,324,325],{},"Does this machine reach the internet only through an HTTPS proxy? [y\u002FN]",[94,327,328,329,48],{},"Enter. If you are behind a proxy, see ",[130,330,332],{"href":331},"\u002Fbyodt-cloud\u002Finstallation#behind-an-outbound-proxy","Behind an outbound proxy",[79,334,335,340],{},[94,336,337],{},[134,338,339],{},"Start the stack now? [y\u002FN]",[94,341,342],{},[18,343,344],{},[134,345,211],{},[347,348,352],"blockquote",{"className":349},[350,351],"callout","callout-note",[14,353,354,357,358,361,362,365,366,369],{},[18,355,356],{},"Important:"," The default for ",[18,359,360],{},"Start the stack now?"," is No. If you pressed Enter, setup ends with ",[134,363,364],{},"==> Ready. Start with: .\u002Fbyodt\u002Fbyodt up",". Run ",[134,367,368],{},".\u002Fbyodt\u002Fbyodt up"," to start it.",[34,371,372,373,379,381,382,48],{},"When the stack has started, the installer prints:",[182,374,377],{"className":375,"code":376,"language":233},[231],"==> Up. Console: http:\u002F\u002F127.0.0.1:3000\u002Fconsole\u002F\n",[134,378,376],{"__ignoreMap":187},[237,380],{},"That address is the deployment's operator console. The platform itself is at ",[134,383,384],{},"http:\u002F\u002F127.0.0.1:3000",[386,387,389],"h3",{"id":388},"without-nodejs","Without Node.js",[14,391,392,393,395],{},"Run the same install with ",[134,394,136],{}," from the release:",[182,397,399],{"className":184,"code":398,"language":186,"meta":187,"style":187},"VERSION=0.14.0\ncurl --proto '=https' --tlsv1.2 -fsSL \"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Freleases\u002Fdownload\u002Fv${VERSION}\u002Fget-byodt.sh\" | sh\n",[134,400,401,406],{"__ignoreMap":187},[191,402,403],{"class":193,"line":194},[191,404,405],{},"VERSION=0.14.0\n",[191,407,409],{"class":193,"line":408},2,[191,410,411],{},"curl --proto '=https' --tlsv1.2 -fsSL \"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Freleases\u002Fdownload\u002Fv${VERSION}\u002Fget-byodt.sh\" | sh\n",[14,413,414,415,48],{},"It asks the same questions. To check the installer's signature before you run it, and for every other option, see ",[130,416,418,419,421],{"href":417},"\u002Fbyodt-cloud\u002Finstallation#with-get-byodtsh-from-the-release","With ",[134,420,136],{}," from the release",[14,423,424,425,48],{},"These commands use the current release; newer releases are listed on the ",[130,426,429],{"href":427,"rel":428},"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Freleases",[244],"releases page",[23,431],{},[26,433,435],{"id":434},"open-the-platform","Open the platform",[14,437,438],{},"The installer returns before the platform is ready. On the first start, the deployment installs its modules and loads the MITRE reference data first, and only then starts the platform.",[31,440,441,452],{},[34,442,443,444,447,448,48],{},"Browse to ",[130,445,384],{"href":384,"rel":446},[244],". For the first few minutes, the browser may refuse to connect. Wait and reload. To check progress, see ",[130,449,451],{"href":450},"\u002Fbyodt-cloud\u002Finstallation#verify-the-deployment-is-healthy","Verify the deployment is healthy",[34,453,454,455,458,459,458,462,465,466,48],{},"The home page loads, with cards for ",[18,456,457],{},"Data Flow Models",", ",[18,460,461],{},"Control Catalog",[18,463,464],{},"Issues"," and ",[18,467,468],{},"Modules",[14,470,471],{},"There is no sign-in. A fresh install runs in standalone mode: it is reachable only from this machine, and anyone using this machine has full access to it.",[347,473,475],{"className":474},[350,351],[14,476,477,480,481,484],{},[18,478,479],{},"Note:"," The embedding model keeps downloading in the background. Until it is ready, the class picker shows ",[252,482,483],{},"Semantic search is unavailable on this deployment — showing name-based matches."," Typing the class name still finds it. The suggestions get better once the model has downloaded.",[23,486],{},[26,488,490],{"id":489},"draw-the-model","Draw the model",[14,492,493,494,497],{},"You draw ",[18,495,496],{},"Storefront",": a small online store. A customer browses a web app and places orders through an API. The API stores orders in a database. The web app, the API and the database sit inside one company network.",[182,499,503],{"className":500,"code":501,"language":502,"meta":187,"style":187},"language-mermaid shiki shiki-themes github-light github-dark-dimmed","flowchart LR\n  Customer[Customer]\n  subgraph Net[\"Company network\"]\n    Web((Web app))\n    API((Orders API))\n    DB[(Orders DB)]\n  end\n  Customer -- Browse --> Web\n  Customer -- Order --> API\n  Web -- Catalog --> API\n  API -- SQL --> DB\n","mermaid",[134,504,505,510,515,521,527,533,539,545,551,557,563],{"__ignoreMap":187},[191,506,507],{"class":193,"line":194},[191,508,509],{},"flowchart LR\n",[191,511,512],{"class":193,"line":408},[191,513,514],{},"  Customer[Customer]\n",[191,516,518],{"class":193,"line":517},3,[191,519,520],{},"  subgraph Net[\"Company network\"]\n",[191,522,524],{"class":193,"line":523},4,[191,525,526],{},"    Web((Web app))\n",[191,528,530],{"class":193,"line":529},5,[191,531,532],{},"    API((Orders API))\n",[191,534,536],{"class":193,"line":535},6,[191,537,538],{},"    DB[(Orders DB)]\n",[191,540,542],{"class":193,"line":541},7,[191,543,544],{},"  end\n",[191,546,548],{"class":193,"line":547},8,[191,549,550],{},"  Customer -- Browse --> Web\n",[191,552,554],{"class":193,"line":553},9,[191,555,556],{},"  Customer -- Order --> API\n",[191,558,560],{"class":193,"line":559},10,[191,561,562],{},"  Web -- Catalog --> API\n",[191,564,566],{"class":193,"line":565},11,[191,567,568],{},"  API -- SQL --> DB\n",[386,570,572],{"id":571},"create-the-model","Create the model",[31,574,575,581,600,609],{},[34,576,577,578,48],{},"In the left rail, click ",[18,579,580],{},"Browser",[34,582,583,584,587,588,591,592,595,596,599],{},"Click the round ",[18,585,586],{},"+"," button (tooltip ",[18,589,590],{},"Create or import","). In the speed dial, click ",[18,593,594],{},"New model",". The model dialog opens on the ",[18,597,598],{},"General"," tab.",[34,601,602,603,606,607,48],{},"In ",[18,604,605],{},"Name",", type ",[134,608,496],{},[34,610,611,612,615,616,458,619,458,622,465,625,48],{},"Click ",[18,613,614],{},"Open data flow editor",", the unlabelled diagram icon at the far right of the buttons along the bottom of the dialog. It saves the model and opens the empty canvas. The palette on the right lists ",[18,617,618],{},"Process",[18,620,621],{},"Store",[18,623,624],{},"External Entity",[18,626,627],{},"Boundary",[386,629,631],{"id":630},"add-the-boundary","Add the boundary",[31,633,634,642,655,668],{},[34,635,636,637,639,640,599],{},"Drag ",[18,638,627],{}," from the palette onto the canvas. Its properties panel opens on the ",[18,641,598],{},[34,643,644,645,648,649,652,653,48],{},"In the ",[18,646,647],{},"Boundary Class"," field, type ",[134,650,651],{},"Network Segment"," and pick ",[18,654,651],{},[34,656,657,658,660,661,664,665,48],{},"Replace the ",[18,659,605],{}," with ",[134,662,663],{},"Company network",", then click ",[18,666,667],{},"Save",[34,669,670],{},"Drag a corner handle of the boundary to make it big enough for three components.",[347,672,675],{"className":673},[350,674],"callout-tip",[14,676,677,680,681,684],{},[18,678,679],{},"Tip:"," ",[18,682,683],{},"Pick the class first",", then edit the name, then save. If you change the name and then pick a class before saving, the class pick can be lost.",[347,686,688],{"className":687},[350,351],[14,689,690,692,693,696,697,699,700,704],{},[18,691,479],{}," Skip the boundary's ",[18,694,695],{},"Zoning"," tab for this quick start. The report then shows two collapsed zoning advisories for ",[18,698,663],{},": it has no trust zone, and it holds a high-value asset (the crown jewel) whose isolation the model can't show. That's fine. ",[130,701,703],{"href":702},"\u002Fplatform\u002Fboundary-trust-zones","Boundary Trust Zones"," explains zones.",[386,706,708],{"id":707},"add-the-components","Add the components",[65,710,713],{"className":711,"tabIndex":69,"role":70,"ariaLabel":712},[68],"Table: Add the components",[73,714,715,730],{},[76,716,717],{},[79,718,719,721,724,727],{},[82,720,605],{},[82,722,723],{},"Palette type",[82,725,726],{},"Class",[82,728,729],{},"Drop it",[89,731,732,749,766,782],{},[79,733,734,739,741,744],{},[94,735,736],{},[18,737,738],{},"Customer",[94,740,624],{},[94,742,743],{},"End User",[94,745,746,747],{},"On the canvas, outside ",[18,748,663],{},[79,750,751,756,758,761],{},[94,752,753],{},[18,754,755],{},"Web app",[94,757,618],{},[94,759,760],{},"Web Server",[94,762,763,764],{},"Inside ",[18,765,663],{},[79,767,768,773,775,778],{},[94,769,770],{},[18,771,772],{},"Orders API",[94,774,618],{},[94,776,777],{},"Application Service",[94,779,763,780],{},[18,781,663],{},[79,783,784,789,791,794],{},[94,785,786],{},[18,787,788],{},"Orders DB",[94,790,621],{},[94,792,793],{},"Relational Database",[94,795,763,796],{},[18,797,663],{},[14,799,800],{},"For each row:",[31,802,803,806,812],{},[34,804,805],{},"Drag the palette type to where the table says. The properties panel opens.",[34,807,644,808,811],{},[18,809,810],{},"Component Class"," field, type the class name and pick it.",[34,813,814,815,664,817,48],{},"Enter the ",[18,816,605],{},[18,818,667],{},[386,820,822],{"id":821},"mark-the-crown-jewel","Mark the crown jewel",[14,824,825,826,829],{},"A ",[18,827,828],{},"crown jewel"," is an asset an attacker would most want to reach. Here, that's the database.",[31,831,832,837],{},[34,833,834,835,48],{},"Select ",[18,836,788],{},[34,838,839,840,842,843,846],{},"On the ",[18,841,598],{}," tab, click the crown button to the left of the ",[18,844,845],{},"Inherited from a Class"," switch.",[14,848,849],{},"The node gets a gold outline.",[386,851,853],{"id":852},"connect-the-data-flows","Connect the data flows",[14,855,856],{},"A data flow's direction is the direction the data travels in.",[65,858,861],{"className":859,"tabIndex":69,"role":70,"ariaLabel":860},[68],"Table: Connect the data flows",[73,862,863,877],{},[76,864,865],{},[79,866,867,870,873,875],{},[82,868,869],{},"From",[82,871,872],{},"To",[82,874,605],{},[82,876,726],{},[89,878,879,893,907,920],{},[79,880,881,883,885,890],{},[94,882,738],{},[94,884,755],{},[94,886,887],{},[134,888,889],{},"Browse",[94,891,892],{},"HTTP\u002FS Request",[79,894,895,897,899,904],{},[94,896,738],{},[94,898,772],{},[94,900,901],{},[134,902,903],{},"Order",[94,905,906],{},"API Call",[79,908,909,911,913,918],{},[94,910,755],{},[94,912,772],{},[94,914,915],{},[134,916,917],{},"Catalog",[94,919,906],{},[79,921,922,924,926,931],{},[94,923,772],{},[94,925,788],{},[94,927,928],{},[134,929,930],{},"SQL",[94,932,933],{},"Database Query",[14,935,800],{},[31,937,938,941,944,950],{},[34,939,940],{},"Point at the source component. Small round connection handles appear on its edges.",[34,942,943],{},"Drag from a handle on the source to a handle on the target, and release. The flow's properties panel opens.",[34,945,644,946,949],{},[18,947,948],{},"Data Flow Class"," field, pick the class from the table.",[34,951,814,952,664,954,48],{},[18,953,605],{},[18,955,667],{},[347,957,959],{"className":958},[350,674],[14,960,961,963,964,967],{},[18,962,679],{}," Name every flow. A new flow gets a placeholder name such as ",[252,965,966],{},"New Data Flow",", and the report lists flows by name.",[14,969,970],{},"Your model is finished:",[14,972,973],{},[974,975],"img",{"alt":976,"src":977},"The finished Storefront model in the data flow editor. Customer, outside the boundary on the left, sends \"Browse\" to Web app and \"Order\" to Orders API. Inside the Company network boundary, Web app sends \"Catalog\" to Orders API, and Orders API sends \"SQL\" to Orders DB, which has the gold outline of a crown jewel.","\u002Fguides\u002Fplatform\u002Fimages\u002Fquick-start\u002Fmodel-complete.webp",[23,979],{},[26,981,983],{"id":982},"why-the-model-already-has-findings","Why the model already has findings",[14,985,986],{},"You haven't answered any of the classes' questions. That is enough for findings. An unanswered question counts as the protection being absent, so the class's rules fire. This is by design: nothing is assumed safe until you say so.",[14,988,989],{},"Have a look:",[31,991,992,1017,1040],{},[34,993,834,994,996,997,1000,1001,465,1004,1007,1008,458,1011,465,1014,48],{},[18,995,772],{}," and open its ",[18,998,999],{},"Attributes"," tab. The questions are grouped under headings such as ",[18,1002,1003],{},"Authentication & Access",[18,1005,1006],{},"Application Security",". Most are yes-or-no questions that offer ",[18,1009,1010],{},"Yes",[18,1012,1013],{},"No",[18,1015,1016],{},"Not answered",[34,1018,1019,1020,1022,1023,1026,1027,48,1029,1031,1032,1035,1036,1039],{},"Expand ",[18,1021,1006],{},". ",[18,1024,1025],{},"Parameterized Queries Used"," is ",[18,1028,1016],{},[237,1030],{},"The questions are marked as required, and an unanswered one shows ",[252,1033,1034],{},"is a required property"," in red. That is expected: you can save with questions left unanswered. To see the questions in a larger dialog, ",[252,1037,1038],{},"Attributes of Orders API",", with a guide to each one beside it, click the right-hand of the two buttons at the top right of the tab.",[34,1041,1042,1043,1046],{},"Open the ",[18,1044,1045],{},"Exposures"," tab. It shows how many exposures the class derived.",[14,1048,1049,1050,48],{},"Don't answer anything yet. You come back to this in ",[130,1051,1053],{"href":1052},"#try-it-answer-the-questions","Try it: answer the questions",[23,1055],{},[26,1057,1059],{"id":1058},"run-the-threat-report","Run the Threat Report",[31,1061,1062,1073,1081,1091],{},[34,1063,1064,1065,1068,1069,1072],{},"In the editor, click ",[18,1066,1067],{},"Analyses"," (the sparkle icon). A dialog titled ",[252,1070,1071],{},"Analysis: Storefront"," opens.",[34,1074,611,1075,1078,1079,48],{},[18,1076,1077],{},"New Analysis",", then ",[18,1080,20],{},[34,1082,1083,1084,1087,1088,48],{},"A row appears with the status ",[18,1085,1086],{},"Ready",". Click ",[18,1089,1090],{},"Run",[34,1092,1093,1094,1087,1097,48],{},"The status changes to ",[18,1095,1096],{},"Done",[18,1098,1099],{},"View results",[14,1101,1102,1103,1106,1107,1110,1111,1114],{},"The report opens on its ",[18,1104,1105],{},"Posture"," tab. The header reads ",[252,1108,1109],{},"4 components · 2 boundaries",". The boundary count includes the ",[18,1112,1113],{},"Default Boundary",", which is the canvas itself.",[14,1116,1117,1118,1121,1122,458,1125,465,1128,1131],{},"Expect ",[18,1119,1120],{},"73 open findings"," for this model: ",[18,1123,1124],{},"14 Critical",[18,1126,1127],{},"48 High",[18,1129,1130],{},"11 Medium",". Your numbers may differ with the module versions on your deployment.",[14,1133,1134,1135,1139],{},"Each finding's band comes from its score; ",[130,1136,1138],{"href":1137},"\u002Fthreat-report\u002Freading-the-report#severity-bands","Severity bands"," gives the ranges.",[23,1141],{},[26,1143,1145],{"id":1144},"read-the-first-finding","Read the first finding",[14,1147,839,1148,1150,1151,1154],{},[18,1149,1105],{}," tab, ",[18,1152,1153],{},"Top residual risks"," lists the open findings, ranked by band, then score, then name. The first row shows:",[65,1156,1159],{"className":1157,"tabIndex":69,"role":70,"ariaLabel":1158},[68],"Table: Read the first finding",[73,1160,1161,1171],{},[76,1162,1163],{},[79,1164,1165,1168],{},[82,1166,1167],{},"Part",[82,1169,1170],{},"Meaning",[89,1172,1173,1183,1193,1203,1213],{},[79,1174,1175,1180],{},[94,1176,1177],{},[18,1178,1179],{},"Critical",[94,1181,1182],{},"The band.",[79,1184,1185,1190],{},[94,1186,1187],{},[18,1188,1189],{},"Injection (SQLi \u002F NoSQLi \u002F OS command \u002F LDAP)",[94,1191,1192],{},"The finding.",[79,1194,1195,1200],{},[94,1196,1197],{},[18,1198,1199],{},"network",[94,1201,1202],{},"The attack vector: the attacker comes over the network.",[79,1204,1205,1210],{},[94,1206,1207],{},[18,1208,1209],{},"on Orders API",[94,1211,1212],{},"The element it was found on.",[79,1214,1215,1220],{},[94,1216,1217],{},[18,1218,1219],{},"⛉ uncovered",[94,1221,1222],{},"No security control on the element supports it.",[14,1224,1225],{},[974,1226],{"alt":1227,"src":1228},"The Threat Report's Posture tab for Storefront: 73 open and 0 dispositioned findings, 1 of 1 crown jewels reachable from external entry, and Top residual risks led by \"Critical, Injection (SQLi \u002F NoSQLi \u002F OS command \u002F LDAP), network, on Orders API, uncovered\".","\u002Fguides\u002Fplatform\u002Fimages\u002Fquick-start\u002Fthreat-report-top-risks.webp",[14,1230,1231,1232,1234],{},"Click the row. The ",[18,1233,772],{},"'s Component Profile opens, with its findings.",[14,1236,839,1237,1240,1241,1243,1244,1247,1248,465,1251,1254,1255,465,1258,48],{},[18,1238,1239],{},"Residual Risk"," tab, the ",[18,1242,772],{}," group's row for this finding shows its score, ",[18,1245,1246],{},"9.8",", and two MITRE ATT&CK technique chips: ",[18,1249,1250],{},"T1059",[18,1252,1253],{},"T1190",". Hover over a chip for the technique's name: ",[252,1256,1257],{},"Command and Scripting Interpreter",[252,1259,1260],{},"Exploit Public-Facing Application",[386,1262,1264],{"id":1263},"what-it-means","What it means",[14,1266,1267],{},"The application builds queries or shell commands from input it hasn't validated. An attacker can then read or change the stored data, or run commands on the host. Parameterized statements, running commands with an argument array, and server-side allow-list validation defeat it.",[386,1269,1271],{"id":1270},"why-it-fired","Why it fired",[14,1273,1274,1275,1277],{},"The ",[18,1276,777],{}," class raises this finding when any of these is true:",[1279,1280,1281,1286,1291,1296],"ul",{},[34,1282,1283,1285],{},[18,1284,1025],{}," is not Yes.",[34,1287,1288,1285],{},[18,1289,1290],{},"OS Commands Avoided Or Arg-Array Used",[34,1292,1293,1285],{},[18,1294,1295],{},"Server-Side Allowlist Validation Applied",[34,1297,1298,458,1301,458,1304,1307,1308,1311],{},[18,1299,1300],{},"Dynamic Query-String Concatenation Used",[18,1302,1303],{},"User Input In Shell Command String",[18,1305,1306],{},"Validation Is Client-Side Only"," or ",[18,1309,1310],{},"Denylist Filtering Used"," is Yes.",[14,1313,1314,1315,1317],{},"The first three are ",[18,1316,1016],{},", so it fires.",[386,1319,1321],{"id":1320},"how-it-reaches-your-data","How it reaches your data",[14,1323,1042,1324,1327,1328,1331,1332,48],{},[18,1325,1326],{},"Reachability"," tab. It reads ",[252,1329,1330],{},"1 of 1 crown jewels reachable from external entry",". Entry points are the model's external entities: here, ",[18,1333,738],{},[14,1335,1336,1337,1339,1340,1343,1344,48],{},"For ",[18,1338,788],{},", it shows ",[252,1341,1342],{},"reachable · shortest route 2 hops · 1 crossing",", and ",[252,1345,1346],{},"worst on any route: Critical",[14,1348,611,1349,1352],{},[18,1350,1351],{},"view strip"," beside it to see the routes:",[1279,1354,1355,1361,1366],{},[34,1356,1357,1358,48],{},"The shortest route is ",[18,1359,1360],{},"Customer → Orders API → Orders DB",[34,1362,1363,1364,48],{},"A second route goes through ",[18,1365,755],{},[34,1367,1368,1369,1371],{},"Every route passes through ",[18,1370,772],{},", the element with the injection finding.",[14,1373,1374],{},[974,1375],{"alt":1376,"src":1377},"The Reachability tab's route view from Customer to Orders DB. It says every modeled route passes through Orders API and lists two flow routes: Route 1, 2 hops and 1 crossing, from Customer over Order into Company network to Orders API, then over SQL to Orders DB; and Route 2, 3 hops, through Web app.","\u002Fguides\u002Fplatform\u002Fimages\u002Fquick-start\u002Freachability-route.webp",[14,1379,1380,1381,680,1384,1388],{},"The tab says it plainly: ",[252,1382,1383],{},"Flow routes and the threats on them — not attack paths.",[130,1385,1387],{"href":1386},"\u002Fthreat-report\u002Freachability","Reachability and Flow Routes"," explains how to read it.",[23,1390],{},[26,1392,1053],{"id":1393},"try-it-answer-the-questions",[14,1395,1396],{},"Tell the platform that the Orders API is protected against injection.",[31,1398,1399,1402,1430],{},[34,1400,1401],{},"Go back to the editor: click the diagram icon at the top right of the report. A model you reopen opens in view mode, so click the padlock on the left to edit.",[34,1403,834,1404,1406,1407,1409,1410,1412,1413,1415,1416],{},[18,1405,772],{},", open its ",[18,1408,999],{}," tab and expand ",[18,1411,1006],{},". Set exactly these three questions to ",[18,1414,1010],{},":\n",[1279,1417,1418,1422,1426],{},[34,1419,1420],{},[18,1421,1025],{},[34,1423,1424],{},[18,1425,1290],{},[34,1427,1428],{},[18,1429,1295],{},[34,1431,1432,1433,48],{},"Leave every other question as it is, and click ",[18,1434,667],{},[347,1436,1438],{"className":1437},[350,351],[14,1439,1440,1442,1443,1445,1446,1448,1449,1451],{},[18,1441,356],{}," Some questions in ",[18,1444,1006],{}," describe a weakness, such as ",[18,1447,1310],{},". For those, ",[18,1450,1010],{}," makes the finding fire. Answer only the three above.",[14,1453,1454,1455,1458],{},"The platform evaluates the class again and removes the ",[18,1456,1457],{},"Injection"," finding.",[347,1460,1462],{"className":1461},[350,351],[14,1463,1464,1466,1467,1469,1470,1472,1473,48],{},[18,1465,356],{}," Here you only claim the protections, to see how answers drive findings. On a real model, answer ",[18,1468,1010],{}," only for a protection you have checked is in place. A ",[18,1471,1010],{}," that isn't true removes the finding from the report, not the risk. For a finding that doesn't apply, record why instead: see ",[130,1474,1476],{"href":1475},"\u002Fplatform\u002Fmanaging-findings","Managing Findings",[14,1478,1479,1480,1078,1482,1484,1485,1488,1489,1087,1492,1495,1496,1026,1498,1501,1502,1504],{},"The report is a snapshot, so it doesn't change by itself. Open it again (",[18,1481,1067],{},[18,1483,1099],{},"): its marker has turned from ",[18,1486,1487],{},"Fresh"," to ",[18,1490,1491],{},"Stale",[18,1493,1494],{},"Recreate",". The report now counts 72 open findings, and the top row of ",[18,1497,1153],{},[252,1499,1500],{},"Query\u002Fcommand injection enabling bulk exfiltration"," on the ",[18,1503,930],{}," flow, also scored 9.8.",[23,1506],{},[26,1508,1510],{"id":1509},"stop-and-start-the-deployment","Stop and start the deployment",[14,1512,1513],{},"From the folder you ran the installer in:",[182,1515,1517],{"className":184,"code":1516,"language":186,"meta":187,"style":187},".\u002Fbyodt\u002Fbyodt down    # stop; everything on disk is kept\n.\u002Fbyodt\u002Fbyodt up      # start again\n",[134,1518,1519,1524],{"__ignoreMap":187},[191,1520,1521],{"class":193,"line":194},[191,1522,1523],{},".\u002Fbyodt\u002Fbyodt down    # stop; everything on disk is kept\n",[191,1525,1526],{"class":193,"line":408},[191,1527,1528],{},".\u002Fbyodt\u002Fbyodt up      # start again\n",[14,1530,1531],{},"Later starts take well under a minute.",[23,1533],{},[26,1535,1537],{"id":1536},"next-steps","Next steps",[1279,1539,1540,1549,1564,1571,1578,1587,1596],{},[34,1541,1542,1548],{},[18,1543,1544],{},[130,1545,1547],{"href":1546},"\u002Fplatform\u002Fbuilding-your-first-model","Building Your First Model",": a fuller model, with trust zones and issues.",[34,1550,1551,465,1557,1563],{},[18,1552,1553],{},[130,1554,1556],{"href":1555},"\u002Fthreat-report","Threat Report guide",[18,1558,1559],{},[130,1560,1562],{"href":1561},"\u002Fthreat-report\u002Freading-the-report","Reading the Report",": every tab of the report.",[34,1565,1566,1570],{},[18,1567,1568],{},[130,1569,1387],{"href":1386},": routes to your crown jewels.",[34,1572,1573,1577],{},[18,1574,1575],{},[130,1576,1476],{"href":1475},": affirm the findings that are real and dispose of the ones that aren't.",[34,1579,1580,1586],{},[18,1581,1582],{},[130,1583,1585],{"href":1584},"\u002Fplatform\u002Fcomponent-configuration-guide","Component Configuration Guide",": answer attributes and classify the data your components handle.",[34,1588,1589,1595],{},[18,1590,1591],{},[130,1592,1594],{"href":1593},"\u002Fbyodt-cloud\u002Finstallation","Installing the BYODt Deployment",": every install option.",[34,1597,1598,1604],{},[18,1599,1600],{},[130,1601,1603],{"href":1602},"\u002Fdethereal","Dethereal plugin",": build models in conversation with Claude Code.",[1606,1607,1608],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":187,"searchDepth":517,"depth":517,"links":1610},[1611,1612,1613,1616,1617,1624,1625,1626,1631,1632,1633],{"id":28,"depth":408,"text":29},{"id":62,"depth":408,"text":63},{"id":176,"depth":408,"text":177,"children":1614},[1615],{"id":388,"depth":517,"text":389},{"id":434,"depth":408,"text":435},{"id":489,"depth":408,"text":490,"children":1618},[1619,1620,1621,1622,1623],{"id":571,"depth":517,"text":572},{"id":630,"depth":517,"text":631},{"id":707,"depth":517,"text":708},{"id":821,"depth":517,"text":822},{"id":852,"depth":517,"text":853},{"id":982,"depth":408,"text":983},{"id":1058,"depth":408,"text":1059},{"id":1144,"depth":408,"text":1145,"children":1627},[1628,1629,1630],{"id":1263,"depth":517,"text":1264},{"id":1270,"depth":517,"text":1271},{"id":1320,"depth":517,"text":1321},{"id":1393,"depth":408,"text":1053},{"id":1509,"depth":408,"text":1510},{"id":1536,"depth":408,"text":1537},"Install Dethernety on your own machine, draw a four-element model and read its first threat finding.","md",{"category":1637,"position":408,"tags":1638},"getting-started",[1637,12,1639,1640,1641],"installation","tutorial","threat-report",true,"\u002Fplatform\u002Fquick-start",{"title":5,"description":1634},"01.platform\u002F01.quick-start","EECM3FmaKwOMxG67GrhY9MzDuGvJgVk0IohkYGJIG-o",[1648,1691,1724,1778,1806,1850,1865,1935],{"title":1649,"description":1650,"path":1651,"stem":1652,"children":1653,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[1654,1658,1659,1662,1667,1670,1675,1680,1683,1688],{"title":1655,"path":1651,"stem":1656,"description":1657},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":5,"path":1643,"stem":1645,"description":1634},{"title":1547,"path":1546,"stem":1660,"description":1661},"01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":1663,"path":1664,"stem":1665,"description":1666},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":1476,"path":1475,"stem":1668,"description":1669},"01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":1671,"path":1672,"stem":1673,"description":1674},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":1676,"path":1677,"stem":1678,"description":1679},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":703,"path":702,"stem":1681,"description":1682},"01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":1684,"path":1685,"stem":1686,"description":1687},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":1585,"path":1584,"stem":1689,"description":1690},"01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":1692,"description":1693,"path":1694,"stem":1695,"children":1696,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[1697,1701,1704,1709,1714,1719],{"title":1698,"path":1694,"stem":1699,"description":1700},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":1594,"path":1593,"stem":1702,"description":1703},"02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":1705,"path":1706,"stem":1707,"description":1708},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":1710,"path":1711,"stem":1712,"description":1713},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":1715,"path":1716,"stem":1717,"description":1718},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":1720,"path":1721,"stem":1722,"description":1723},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":1725,"description":1726,"path":1602,"stem":1727,"children":1728,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","03.dethereal",[1729,1733,1738,1743,1748,1753,1758,1763,1768,1773],{"title":1730,"path":1602,"stem":1731,"description":1732},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":1734,"path":1735,"stem":1736,"description":1737},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":1739,"path":1740,"stem":1741,"description":1742},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":1744,"path":1745,"stem":1746,"description":1747},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":1749,"path":1750,"stem":1751,"description":1752},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":1754,"path":1755,"stem":1756,"description":1757},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":1759,"path":1760,"stem":1761,"description":1762},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":1764,"path":1765,"stem":1766,"description":1767},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":1769,"path":1770,"stem":1771,"description":1772},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":1774,"path":1775,"stem":1776,"description":1777},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":20,"description":1779,"path":1555,"stem":1780,"children":1781,"page":-1},"The residual-risk report over a threat model: reading it, filtering it and exporting it.","04.threat-report",[1782,1785,1790,1793,1798,1801],{"title":20,"path":1555,"stem":1783,"description":1784},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":1786,"path":1787,"stem":1788,"description":1789},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":1562,"path":1561,"stem":1791,"description":1792},"04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":1794,"path":1795,"stem":1796,"description":1797},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":1387,"path":1386,"stem":1799,"description":1800},"04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":1802,"path":1803,"stem":1804,"description":1805},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":1807,"description":1808,"path":1809,"stem":1810,"children":1811,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[1812,1816,1821,1826,1831,1836,1840,1845],{"title":1813,"path":1809,"stem":1814,"description":1815},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":1817,"path":1818,"stem":1819,"description":1820},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":1822,"path":1823,"stem":1824,"description":1825},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":1827,"path":1828,"stem":1829,"description":1830},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":1832,"path":1833,"stem":1834,"description":1835},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":1562,"path":1837,"stem":1838,"description":1839},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":1841,"path":1842,"stem":1843,"description":1844},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":1846,"path":1847,"stem":1848,"description":1849},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":1851,"description":1852,"path":1853,"stem":1854,"children":1855,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[1856,1860],{"title":1857,"path":1853,"stem":1858,"description":1859},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":1861,"path":1862,"stem":1863,"description":1864},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":1866,"description":1867,"path":1868,"stem":1869,"children":1870,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[1871,1875,1880,1885,1890,1895,1900,1905,1910,1915,1920,1925,1930],{"title":1872,"path":1868,"stem":1873,"description":1874},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":1876,"path":1877,"stem":1878,"description":1879},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":1881,"path":1882,"stem":1883,"description":1884},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":1886,"path":1887,"stem":1888,"description":1889},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":1891,"path":1892,"stem":1893,"description":1894},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":1896,"path":1897,"stem":1898,"description":1899},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":1901,"path":1902,"stem":1903,"description":1904},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":1906,"path":1907,"stem":1908,"description":1909},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":1911,"path":1912,"stem":1913,"description":1914},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":1916,"path":1917,"stem":1918,"description":1919},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":1921,"path":1922,"stem":1923,"description":1924},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":1926,"path":1927,"stem":1928,"description":1929},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":1931,"path":1932,"stem":1933,"description":1934},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":1936,"description":1937,"path":1938,"stem":1939,"children":1940,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[1941,1945,1950],{"title":1942,"path":1938,"stem":1943,"description":1944},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":1946,"path":1947,"stem":1948,"description":1949},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":1951,"path":1952,"stem":1953,"description":1954},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748184213]