[{"data":1,"prerenderedAt":1261},["ShallowReactive",2],{"page-\u002Fplatform\u002Fsecurity-analysis-workflow":3,"navigation":946},{"id":4,"title":5,"body":6,"description":19,"extension":930,"meta":931,"navigation":941,"path":942,"seo":943,"stem":944,"__hash__":945},"docs\u002F01.platform\u002F03.security-analysis-workflow.md","Security Analysis Workflow",{"type":7,"value":8,"toc":900},"minimark",[9,13,20,25,28,44,49,67,89,95,100,114,118,122,171,180,203,212,216,223,330,353,373,379,383,389,403,407,411,414,419,445,451,471,474,478,483,515,520,534,538,541,545,582,596,603,608,628,635,639,646,672,682,686,690,695,706,711,719,723,728,748,753,773,777,782,793,798,809,813,817,827,831,837,841,847,850,855],[10,11,5],"h1",{"id":12},"security-analysis-workflow",[14,15,16],"p",{},[17,18,19],"em",{},"How to run security analysis and interpret results to improve your threat models.",[21,22,24],"h2",{"id":23},"analysis-overview","Analysis Overview",[14,26,27],{},"Security analysis in Dethernety is provided entirely by modules. The core platform does not ship with built-in analysis logic — instead, modules define what analysis types are available, how they evaluate your model, and what kind of results they produce. This means:",[29,30,31,35,38,41],"ul",{},[32,33,34],"li",{},"The analysis types you see depend on which modules are loaded for your model",[32,36,37],{},"Different modules may use different approaches: rule-based (OPA\u002FRego policies), AI-assisted, or a combination",[32,39,40],{},"Results, severity scales, and recommendation formats vary by module",[32,42,43],{},"You can have multiple analysis types available at once if several modules are loaded",[45,46,48],"h3",{"id":47},"what-the-oss-distribution-ships","What the OSS distribution ships",[14,50,51,55,56,60,61,66],{},[52,53,54],"strong",{},"One analysis type: Threat Report."," It comes from the ",[57,58,59],"code",{},"dethernety-threat-report"," module and is a read-only posture snapshot over an existing model — a set of graph queries, not an AI run. It asks no questions, streams no reasoning, and adds nothing to your model. Its output is the interactive report documented in ",[62,63,65],"a",{"href":64},"\u002Fthreat-report","Threat Report",".",[14,68,69,76,77,80,81,84,85,66],{},[52,70,71,72,75],{},"The ",[57,73,74],{},"dethernety-general"," module contributes no analysis type at all."," Its Rego policies do evaluate your model — that is what derives exposures and countermeasures — but they run against an element's attributes as you configure them, continuously, and surface on the element's ",[52,78,79],{},"Exposures"," tab. That is a different mechanism from an analysis run, and it never appears in the ",[52,82,83],{},"New Analysis"," menu. See ",[62,86,88],{"href":87},"\u002Fplatform\u002Fcomponent-configuration-guide#understanding-security-exposures","Understanding Security Exposures",[14,90,91,92,94],{},"So on a stock OSS install, the ",[52,93,83],{}," menu offers exactly one entry. Additional modules add specialized analysis types — compliance checks, framework-specific assessments, AI-assisted evaluation — and everything below that describes AI behaviour applies only when such a module is installed.",[14,96,97],{},[52,98,99],{},"What analysis gives you:",[29,101,102,105,108,111],{},[32,103,104],{},"Find security issues you might miss in manual review",[32,106,107],{},"Get findings mapped to industry frameworks (MITRE ATT&CK, D3FEND) when the module supports it",[32,109,110],{},"Specific recommendations for addressing findings",[32,112,113],{},"Findings that can be converted into trackable issues",[21,115,117],{"id":116},"running-analysis","Running Analysis",[45,119,121],{"id":120},"creating-an-analysis","Creating an analysis",[123,124,125,131,145,159,165],"ol",{},[32,126,127,130],{},[52,128,129],{},"Open your model"," in the data flow editor (click its tile in the Browser).",[32,132,133,136,137,140,141,144],{},[52,134,135],{},"Click the sparkle button"," on the canvas toolbar — its tooltip reads ",[52,138,139],{},"Analyses",". The Analyses dialog opens, listing this model's analyses. (The same list is the ",[52,142,143],{},"Analysis"," tab of the Model dialog.)",[32,146,147,150,151,154,155,158],{},[52,148,149],{},"Click \"New Analysis\"",". This button ",[17,152,153],{},"is"," the type menu — it opens a list with ",[52,156,157],{},"one entry per analysis type"," your installed modules provide.",[32,160,161,164],{},[52,162,163],{},"Click the type you want."," The analysis is created immediately and appears as a new row.",[32,166,167,170],{},[52,168,169],{},"Click \"Run\""," in that row to start it.",[14,172,173,176,177,179],{},[52,174,175],{},"You are never asked for a name or a description."," The new analysis takes the analysis type's own name for both — a Threat Report analysis is called ",[17,178,65],{},". Renaming is a separate, later step:",[29,181,182,189],{},[32,183,184,185,188],{},"Click the ",[52,186,187],{},"Name"," cell in the row and type over it; press Enter or click away to save.",[32,190,191,192,195,196,199,200,66],{},"Or open the row's ",[52,193,194],{},"overflow menu"," (⋮) and choose ",[52,197,198],{},"Rename"," or ",[52,201,202],{},"Edit description",[14,204,205,206,209,210,66],{},"Do it early. Give the run a name that says what it was for — ",[17,207,208],{},"Pre-release review, March"," — before you accumulate five rows all called ",[17,211,65],{},[45,213,215],{"id":214},"watching-a-run","Watching a run",[14,217,218,219,222],{},"Each row shows a ",[52,220,221],{},"phase",", not a raw status, and the row's single primary button follows that phase:",[224,225,231],"div",{"className":226,"tabIndex":228,"role":229,"ariaLabel":230},[227],"table-frame",0,"region","Table: Watching a run",[232,233,234,250],"table",{},[235,236,237],"thead",{},[238,239,240,244,247],"tr",{},[241,242,243],"th",{},"Phase",[241,245,246],{},"What it means",[241,248,249],{},"Primary button",[251,252,253,269,284,300,315],"tbody",{},[238,254,255,261,264],{},[256,257,258],"td",{},[52,259,260],{},"Ready",[256,262,263],{},"Created, never run — or run, with no result stored",[256,265,266],{},[52,267,268],{},"Run",[238,270,271,276,279],{},[256,272,273],{},[52,274,275],{},"Working",[256,277,278],{},"A run is in progress",[256,280,281],{},[52,282,283],{},"View progress",[238,285,286,291,294],{},[256,287,288],{},[52,289,290],{},"Paused",[256,292,293],{},"The run has stopped and is waiting on you",[256,295,296,299],{},[52,297,298],{},"Answer"," (badged)",[238,301,302,307,310],{},[256,303,304],{},[52,305,306],{},"Done",[256,308,309],{},"A run finished and produced a result",[256,311,312],{},[52,313,314],{},"View results",[238,316,317,322,325],{},[256,318,319],{},[52,320,321],{},"Failed",[256,323,324],{},"The run errored — hover the status for the reason",[256,326,327],{},[52,328,329],{},"Retry",[14,331,332,335,336,338,339,341,342,344,345,348,349,352],{},[52,333,334],{},"Done, not \"idle\"."," A finished analysis reads ",[52,337,306],{}," and offers ",[52,340,314],{},"; a never-run one reads ",[52,343,260],{},". Beside the primary button, a ",[52,346,347],{},"trash"," button deletes the analysis — it is hidden while a run is in flight (Working or Paused). The overflow menu adds ",[52,350,351],{},"Re-run"," once an analysis has run at least once.",[14,354,355,358,359,361,362,365,366,369,370,372],{},[52,356,357],{},"Progress and questions are module capabilities."," Clicking ",[52,360,283],{}," opens the ",[52,363,364],{},"Analysis Flow"," dialog, which lists the messages the running module streams back, newest first — for an AI module that is its reasoning trail; for a module that streams nothing, it says ",[17,367,368],{},"Waiting for analysis responses...",". If a module pauses a run to ask you something, the row goes to ",[52,371,290],{}," and a question dialog is offered; answering it resumes the run.",[14,374,375,376,378],{},"Neither surface does anything for the OSS ",[52,377,65],{}," analysis, which runs to completion without streaming messages or asking questions.",[45,380,382],{"id":381},"what-modules-can-offer","What modules can offer",[14,384,385,386,388],{},"What appears in the ",[52,387,83],{}," menu depends entirely on which modules are installed. A module might provide one analysis type or several:",[29,390,391,394,397,400],{},[32,392,393],{},"Quick vulnerability scans based on component configuration",[32,395,396],{},"AI-assisted threat evaluation with interactive Q&A",[32,398,399],{},"Compliance checks against specific regulatory frameworks",[32,401,402],{},"MITRE ATT&CK mapping and countermeasure recommendations",[21,404,406],{"id":405},"understanding-results","Understanding Results",[45,408,410],{"id":409},"result-structure","Result structure",[14,412,413],{},"Result format and content depend on the module that runs the analysis. Common elements include:",[14,415,416],{},[52,417,418],{},"Findings:",[29,420,421,427,433,439],{},[32,422,423,426],{},[52,424,425],{},"Severity"," -- how the module classifies risk (the scale and labels vary by module)",[32,428,429,432],{},[52,430,431],{},"Description"," -- what the issue is",[32,434,435,438],{},[52,436,437],{},"Impact"," -- business and technical consequences",[32,440,441,444],{},[52,442,443],{},"Recommendations"," -- steps to address the finding",[14,446,447,450],{},[52,448,449],{},"Framework mappings"," (when the module supports it):",[29,452,453,459,465],{},[32,454,455,458],{},[52,456,457],{},"MITRE ATT&CK"," -- attack techniques that could exploit identified issues",[32,460,461,464],{},[52,462,463],{},"D3FEND"," -- defensive measures that can protect against threats",[32,466,467,470],{},[52,468,469],{},"Compliance"," -- regulatory requirements related to findings",[14,472,473],{},"Some modules also produce a system overview with architecture summaries and data classification before listing findings.",[45,475,477],{"id":476},"working-with-results","Working with results",[14,479,480],{},[52,481,482],{},"Review Process:",[123,484,485,497,503,509],{},[32,486,487,490,491,493,494,496],{},[52,488,489],{},"Open Results",": Click ",[52,492,314],{}," in the analysis row (the primary button on a ",[52,495,306],{}," analysis). The results open on their own page, rendered by the module that produced them.",[32,498,499,502],{},[52,500,501],{},"Priority Review",": Start with highest severity findings",[32,504,505,508],{},[52,506,507],{},"Understand Context",": Review which components and data flows are affected",[32,510,511,514],{},[52,512,513],{},"Plan Response",": Decide on accept, mitigate, transfer, or avoid strategies",[14,516,517],{},[52,518,519],{},"Key Questions to Ask:",[29,521,522,525,528,531],{},[32,523,524],{},"Which findings require immediate action?",[32,526,527],{},"What findings can be addressed with security controls?",[32,529,530],{},"Are there patterns across multiple findings?",[32,532,533],{},"Which findings align with our compliance requirements?",[21,535,537],{"id":536},"converting-findings-to-issues","Converting Findings to Issues",[14,539,540],{},"A module's results view can hand a finding to the platform's issue workflow. What it opens is the same in every module, because the platform owns it.",[45,542,544],{"id":543},"raising-a-new-issue-from-a-finding","Raising a new issue from a finding",[123,546,547,553,560,573],{},[32,548,549,552],{},[52,550,551],{},"Trigger the issue action"," on the finding in the results view.",[32,554,555,556,559],{},"A dialog opens, titled ",[52,557,558],{},"Raise an issue from this finding",", naming the finding underneath.",[32,561,562,563,566,567,570,571,66],{},"Under ",[17,564,565],{},"Or create an issue:",", ",[52,568,569],{},"click an issue class",". The class list is whatever your installed modules provide — on a stock OSS install, the six from ",[57,572,74],{},[32,574,575,576,581],{},"The issue is created immediately and its card opens for editing. It is pre-named ",[17,577,578],{},[57,579,580],{},"\u003CFinding> Issue on \u003Celement>"," and pre-described from the finding's own description.",[14,583,584,587,588,591,592,595],{},[52,585,586],{},"What gets linked:"," the finding, the element it was raised on, and the model. ",[52,589,590],{},"Not the analysis run"," — nothing records which analysis produced the finding. If that traceability matters, add the analysis by hand from the issue's ",[52,593,594],{},"Associated Elements"," tab.",[14,597,598,599,66],{},"For the full picture of what each creation path links, see ",[62,600,602],{"href":601},"\u002Fplatform\u002Fissue-management-guide#what-actually-gets-associated","What actually gets associated",[14,604,605],{},[52,606,607],{},"Why raise an issue at all:",[29,609,610,616,622],{},[32,611,612,615],{},[52,613,614],{},"Traceability",": a link from the tracked work back to the element and model it concerns",[32,617,618,621],{},[52,619,620],{},"Team coordination",": an owner, a severity, and a class-defined lifecycle to work through",[32,623,624,627],{},[52,625,626],{},"Progress tracking",": an open\u002Fclosed board that survives the next analysis run",[14,629,630,631,66],{},"Issues are tracked entirely within Dethernety; no integration with an external tracker ships with the platform. See ",[62,632,634],{"href":633},"\u002Fplatform\u002Fissue-management-guide#external-system-integration","External system integration",[45,636,638],{"id":637},"adding-a-finding-to-an-existing-issue","Adding a finding to an existing issue",[14,640,641,642,645],{},"The same dialog's ",[52,643,644],{},"Add to Issue board"," button copies the finding to Dethernety's clipboard and sends you to the Issues page:",[123,647,648,654,657,663],{},[32,649,650,651,653],{},"Click ",[52,652,644],{},". You land on the Issues page.",[32,655,656],{},"Find the target issue and click its row to expand the card.",[32,658,650,659,662],{},[52,660,661],{},"Add from clipboard",". The finding's elements are linked and a timestamped comment records what was added.",[32,664,650,665,671],{},[52,666,667,668],{},"Return to ",[57,669,670],{},"\u003Cpage>"," to go back to the results.",[14,673,674,677,678,66],{},[52,675,676],{},"The clipboard holds one finding at a time."," Copying a second overwrites the first, so build a multi-finding issue by repeating the loop — copy, paste, return, copy the next — rather than copying several and pasting once. The clipboard also expires after 30 minutes. See ",[62,679,681],{"href":680},"\u002Fplatform\u002Fissue-management-guide#adding-elements-to-an-existing-issue","Adding elements to an existing issue",[21,683,685],{"id":684},"best-practices","Best Practices",[45,687,689],{"id":688},"analysis-strategy","Analysis strategy",[14,691,692],{},[52,693,694],{},"Regular Analysis:",[29,696,697,700,703],{},[32,698,699],{},"Run analysis after significant model changes",[32,701,702],{},"Periodic reviews for ongoing projects",[32,704,705],{},"Before major deployments or releases",[14,707,708],{},[52,709,710],{},"Analysis Selection:",[29,712,713,716],{},[32,714,715],{},"If a module offers multiple analysis types, start with lighter assessments for routine checks and use deeper analysis for complex systems or high-risk scenarios",[32,717,718],{},"For compliance requirements, look for modules that provide framework-specific analysis",[45,720,722],{"id":721},"result-management","Result management",[14,724,725],{},[52,726,727],{},"Prioritization:",[29,729,730,736,742],{},[32,731,732,735],{},[52,733,734],{},"Critical\u002FHigh",": Address immediately, may require stopping deployment",[32,737,738,741],{},[52,739,740],{},"Medium",": Include in current development cycle",[32,743,744,747],{},[52,745,746],{},"Low",": Plan for future improvement cycles",[14,749,750],{},[52,751,752],{},"Documentation:",[29,754,755,761,767],{},[32,756,757,760],{},[52,758,759],{},"Accept decisions",": Document business justification for accepted risks",[32,762,763,766],{},[52,764,765],{},"Mitigation plans",": Track implementation of security controls",[32,768,769,772],{},[52,770,771],{},"Progress updates",": Regular status updates in issue comments",[45,774,776],{"id":775},"team-collaboration","Team collaboration",[14,778,779],{},[52,780,781],{},"Analysis Reviews:",[29,783,784,787,790],{},[32,785,786],{},"Include security team in analysis result reviews",[32,788,789],{},"Involve development teams in remediation planning",[32,791,792],{},"Engage compliance teams for regulatory findings",[14,794,795],{},[52,796,797],{},"Communication:",[29,799,800,803,806],{},[32,801,802],{},"Use analysis results to communicate risks to stakeholders",[32,804,805],{},"Convert technical findings into business impact language",[32,807,808],{},"Share analysis reports with relevant teams and management",[21,810,812],{"id":811},"common-analysis-patterns","Common Analysis Patterns",[45,814,816],{"id":815},"new-system-analysis","New system analysis",[818,819,824],"pre",{"className":820,"code":822,"language":823},[821],"language-text","1. Complete initial model → Run full analysis\n2. Review all findings → Create issues for critical\u002Fhigh items\n3. Implement controls → Re-run analysis to verify improvements\n4. Track remaining issues → Plan ongoing security improvements\n","text",[57,825,822],{"__ignoreMap":826},"",[45,828,830],{"id":829},"ongoing-system-analysis","Ongoing system analysis",[818,832,835],{"className":833,"code":834,"language":823},[821],"1. Model updates → Quick analysis to check new issues\n2. Periodic reviews → Full analysis for complete assessment\n3. Change impact → Analysis after significant architecture changes\n4. Compliance cycles → Specific compliance analysis as required\n",[57,836,834],{"__ignoreMap":826},[45,838,840],{"id":839},"pre-deployment-analysis","Pre-deployment analysis",[818,842,845],{"className":843,"code":844,"language":823},[821],"1. Final model review → Ensure model reflects current architecture\n2. Full analysis → Complete security assessment\n3. Critical issue resolution → Must fix before deployment\n4. Risk acceptance → Document any accepted risks with justification\n",[57,846,844],{"__ignoreMap":826},[848,849],"hr",{},[14,851,852],{},[52,853,854],{},"Next Steps:",[29,856,857,864,873,882,891],{},[32,858,859,863],{},[52,860,861],{},[62,862,65],{"href":64},": Read, filter, and export the OSS analysis type's output",[32,865,866,872],{},[52,867,868],{},[62,869,871],{"href":870},"\u002Fplatform\u002Fmanaging-findings","Managing Findings",": Affirm, dispose, and customize exposures and countermeasures",[32,874,875,881],{},[52,876,877],{},[62,878,880],{"href":879},"\u002Fplatform\u002Fworking-with-security-controls","Working with Security Controls",": Implement recommended countermeasures",[32,883,884,890],{},[52,885,886],{},[62,887,889],{"href":888},"\u002Fplatform\u002Fissue-management-guide","Issue Management Guide",": Track and manage analysis findings",[32,892,893,899],{},[52,894,895],{},[62,896,898],{"href":897},"\u002Fplatform\u002Funderstanding-modules","Understanding Modules",": Where analysis types come from",{"title":826,"searchDepth":901,"depth":901,"links":902},3,[903,907,912,916,920,925],{"id":23,"depth":904,"text":24,"children":905},2,[906],{"id":47,"depth":901,"text":48},{"id":116,"depth":904,"text":117,"children":908},[909,910,911],{"id":120,"depth":901,"text":121},{"id":214,"depth":901,"text":215},{"id":381,"depth":901,"text":382},{"id":405,"depth":904,"text":406,"children":913},[914,915],{"id":409,"depth":901,"text":410},{"id":476,"depth":901,"text":477},{"id":536,"depth":904,"text":537,"children":917},[918,919],{"id":543,"depth":901,"text":544},{"id":637,"depth":901,"text":638},{"id":684,"depth":904,"text":685,"children":921},[922,923,924],{"id":688,"depth":901,"text":689},{"id":721,"depth":901,"text":722},{"id":775,"depth":901,"text":776},{"id":811,"depth":904,"text":812,"children":926},[927,928,929],{"id":815,"depth":901,"text":816},{"id":829,"depth":901,"text":830},{"id":839,"depth":901,"text":840},"md",{"category":932,"position":933,"tags":934},"analysis",6,[935,936,932,937,938,939,940],"intermediate","guide","ai-analysis","findings","practical","workflow",true,"\u002Fplatform\u002Fsecurity-analysis-workflow",{"title":5,"description":19},"01.platform\u002F03.security-analysis-workflow","7JRobiUCiykI_R1QSxGFih2YDUhzfX2BxHR7UZvETU8",[947,990,1025,1080,1112,1156,1171,1241],{"title":948,"description":949,"path":950,"stem":951,"children":952,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[953,957,962,967,968,971,974,977,982,985],{"title":954,"path":950,"stem":955,"description":956},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":958,"path":959,"stem":960,"description":961},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":963,"path":964,"stem":965,"description":966},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":5,"path":942,"stem":944,"description":19},{"title":871,"path":870,"stem":969,"description":970},"01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":880,"path":879,"stem":972,"description":973},"01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":889,"path":888,"stem":975,"description":976},"01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":978,"path":979,"stem":980,"description":981},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":898,"path":897,"stem":983,"description":984},"01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":986,"path":987,"stem":988,"description":989},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":991,"description":992,"path":993,"stem":994,"children":995,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[996,1000,1005,1010,1015,1020],{"title":997,"path":993,"stem":998,"description":999},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":1001,"path":1002,"stem":1003,"description":1004},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":1006,"path":1007,"stem":1008,"description":1009},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":1011,"path":1012,"stem":1013,"description":1014},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":1016,"path":1017,"stem":1018,"description":1019},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":1021,"path":1022,"stem":1023,"description":1024},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":1026,"description":1027,"path":1028,"stem":1029,"children":1030,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[1031,1035,1040,1045,1050,1055,1060,1065,1070,1075],{"title":1032,"path":1028,"stem":1033,"description":1034},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":1036,"path":1037,"stem":1038,"description":1039},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":1041,"path":1042,"stem":1043,"description":1044},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":1046,"path":1047,"stem":1048,"description":1049},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":1051,"path":1052,"stem":1053,"description":1054},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":1056,"path":1057,"stem":1058,"description":1059},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":1061,"path":1062,"stem":1063,"description":1064},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":1066,"path":1067,"stem":1068,"description":1069},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":1071,"path":1072,"stem":1073,"description":1074},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":1076,"path":1077,"stem":1078,"description":1079},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":65,"description":1081,"path":64,"stem":1082,"children":1083,"page":-1},"The residual-risk report over a threat model: reading it, filtering it and exporting it.","04.threat-report",[1084,1087,1092,1097,1102,1107],{"title":65,"path":64,"stem":1085,"description":1086},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":1088,"path":1089,"stem":1090,"description":1091},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":1093,"path":1094,"stem":1095,"description":1096},"Reading the Report","\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":1098,"path":1099,"stem":1100,"description":1101},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":1103,"path":1104,"stem":1105,"description":1106},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":1108,"path":1109,"stem":1110,"description":1111},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":1113,"description":1114,"path":1115,"stem":1116,"children":1117,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[1118,1122,1127,1132,1137,1142,1146,1151],{"title":1119,"path":1115,"stem":1120,"description":1121},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":1123,"path":1124,"stem":1125,"description":1126},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":1128,"path":1129,"stem":1130,"description":1131},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":1133,"path":1134,"stem":1135,"description":1136},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":1138,"path":1139,"stem":1140,"description":1141},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":1093,"path":1143,"stem":1144,"description":1145},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":1147,"path":1148,"stem":1149,"description":1150},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":1152,"path":1153,"stem":1154,"description":1155},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":1157,"description":1158,"path":1159,"stem":1160,"children":1161,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[1162,1166],{"title":1163,"path":1159,"stem":1164,"description":1165},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":1167,"path":1168,"stem":1169,"description":1170},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":1172,"description":1173,"path":1174,"stem":1175,"children":1176,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[1177,1181,1186,1191,1196,1201,1206,1211,1216,1221,1226,1231,1236],{"title":1178,"path":1174,"stem":1179,"description":1180},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":1182,"path":1183,"stem":1184,"description":1185},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":1187,"path":1188,"stem":1189,"description":1190},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":1192,"path":1193,"stem":1194,"description":1195},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":1197,"path":1198,"stem":1199,"description":1200},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":1202,"path":1203,"stem":1204,"description":1205},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":1207,"path":1208,"stem":1209,"description":1210},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":1212,"path":1213,"stem":1214,"description":1215},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":1217,"path":1218,"stem":1219,"description":1220},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":1222,"path":1223,"stem":1224,"description":1225},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":1227,"path":1228,"stem":1229,"description":1230},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":1232,"path":1233,"stem":1234,"description":1235},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":1237,"path":1238,"stem":1239,"description":1240},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":1242,"description":1243,"path":1244,"stem":1245,"children":1246,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[1247,1251,1256],{"title":1248,"path":1244,"stem":1249,"description":1250},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":1252,"path":1253,"stem":1254,"description":1255},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":1257,"path":1258,"stem":1259,"description":1260},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748184840]