[{"data":1,"prerenderedAt":1437},["ShallowReactive",2],{"page-\u002Fplatform\u002Funderstanding-modules":3,"navigation":1120},{"id":4,"title":5,"body":6,"description":19,"extension":1107,"meta":1108,"navigation":480,"path":1116,"seo":1117,"stem":1118,"__hash__":1119},"docs\u002F01.platform\u002F08.understanding-modules.md","Understanding Modules",{"type":7,"value":8,"toc":1071},"minimark",[9,13,20,25,33,67,76,80,85,107,126,132,136,139,165,175,179,182,202,206,209,239,243,250,261,265,269,276,279,283,286,332,339,346,350,357,388,395,398,405,409,413,416,542,545,565,569,572,580,584,587,613,617,620,717,729,736,738,741,755,757,760,774,776,786,815,822,824,834,844,848,851,883,889,903,909,913,917,938,944,948,982,985,989,992,1000,1004,1007,1015,1019,1022,1030,1033,1038,1067],[10,11,5],"h1",{"id":12},"understanding-modules",[14,15,16],"p",{},[17,18,19],"em",{},"How Dethernety's module system extends your threat modeling capabilities.",[21,22,24],"h2",{"id":23},"what-are-modules","What Are Modules?",[14,26,27,28,32],{},"Modules are packages that provide the classes and analysis logic used in your threat models. They are ",[29,30,31],"strong",{},"installed on your Dethernety deployment",", not picked per model — every class from every installed module is offered in every model on that deployment. What is installed determines:",[34,35,36,43,49,55,61],"ul",{},[37,38,39,42],"li",{},[29,40,41],{},"What classes"," you can classify your components, data flows, boundaries, and data items with",[37,44,45,48],{},[29,46,47],{},"What security analysis"," is performed on your configurations",[37,50,51,54],{},[29,52,53],{},"What types of controls"," are available for protection",[37,56,57,60],{},[29,58,59],{},"What types of issues"," can be created",[37,62,63,66],{},[29,64,65],{},"How exposures are detected"," and calculated",[14,68,69,70,75],{},"Installing a module is a deployment action, not something you do from inside a model — see ",[71,72,74],"a",{"href":73},"#where-the-classes-you-can-pick-come-from","Where the classes you can pick come from",".",[21,77,79],{"id":78},"what-modules-provide","What Modules Provide",[81,82,84],"h3",{"id":83},"component-classes","Component Classes",[14,86,87,88,91,92,91,95,98,99,102,103,106],{},"Component classes are what you classify a component with once it is on the canvas. The canvas palette itself is fixed — ",[29,89,90],{},"Process",", ",[29,93,94],{},"Store",[29,96,97],{},"External Entity",", and ",[29,100,101],{},"Boundary"," — so modules do not change what you can draw; they change what each drawn element can ",[17,104,105],{},"be",". Each class specifies:",[34,108,109,117,120,123],{},[37,110,111,112,114,115],{},"Which component type it is written for — a class written for a ",[29,113,94],{}," is never offered to a ",[29,116,90],{},[37,118,119],{},"Available configuration attributes (ports, protocols, encryption settings, etc.)",[37,121,122],{},"Default values for common configurations",[37,124,125],{},"Validation rules for attribute combinations",[14,127,128,131],{},[29,129,130],{},"Example",": A web server class might provide attributes for protocol, port, TLS version, and authentication method, while a database class provides attributes for encryption at rest, connection pooling, and access control.",[81,133,135],{"id":134},"security-analysis-logic","Security Analysis Logic",[14,137,138],{},"Modules contain OPA\u002FRego policies that evaluate component configurations:",[34,140,141,147,153,159],{},[37,142,143,146],{},[29,144,145],{},"Evaluate configurations"," against security policies",[37,148,149,152],{},[29,150,151],{},"Identify exposures"," based on component attributes",[37,154,155,158],{},[29,156,157],{},"Calculate risk levels"," using defined rules",[37,160,161,164],{},[29,162,163],{},"Map exposures to attack techniques"," from MITRE ATT&CK",[14,166,167,169,170,174],{},[29,168,130],{},": A web application module detects that setting ",[171,172,173],"code",{},"protocol: \"HTTP\""," on a production component creates an \"Unencrypted Web Traffic\" exposure linked to network sniffing attacks.",[81,176,178],{"id":177},"control-classes-and-countermeasures","Control Classes and Countermeasures",[14,180,181],{},"Modules provide control class definitions that generate countermeasures when applied:",[34,183,184,190,196],{},[37,185,186,189],{},[29,187,188],{},"Match controls to exposures"," based on security rules",[37,191,192,195],{},[29,193,194],{},"Provide implementation guidance"," for specific technologies",[37,197,198,201],{},[29,199,200],{},"Connect to D3FEND"," defensive techniques",[81,203,205],{"id":204},"issue-classes","Issue Classes",[14,207,208],{},"Modules define issue types with customizable attributes:",[34,210,211,217,223,229],{},[37,212,213,216],{},[29,214,215],{},"Custom issue types"," (security vulnerabilities, compliance violations, configuration errors)",[37,218,219,222],{},[29,220,221],{},"Tailored attributes"," (priority levels, assignment categories, SLA tracking)",[37,224,225,228],{},[29,226,227],{},"Issue templates"," with pre-filled information",[37,230,231,234,235],{},[29,232,233],{},"External system integration",": a module may implement a hook that pulls an issue's attributes from an external tracker. No integration module ships with the platform — see ",[71,236,238],{"href":237},"\u002Fplatform\u002Fcomponent-configuration-guide#issue-class-integration","Issue Class Integration",[81,240,242],{"id":241},"analysis-classes","Analysis Classes",[14,244,245,246,249],{},"Modules can provide analysis types that appear in a model's ",[29,247,248],{},"Analyses"," dialog, opened from the canvas toolbar in the data flow editor. These define the analysis workflow, including what questions to ask, what data to evaluate, and how to structure results.",[14,251,252,253,256,257,75],{},"Analysis is entirely module-supplied — a deployment with no analysis-providing module installed has an empty ",[29,254,255],{},"New Analysis"," menu. The OSS distribution ships exactly one: the ",[71,258,260],{"href":259},"#dethernety-threat-report","Dethernety Threat Report",[21,262,264],{"id":263},"where-the-classes-you-can-pick-come-from","Where the Classes You Can Pick Come From",[81,266,268],{"id":267},"one-catalogue-for-the-whole-deployment","One catalogue for the whole deployment",[14,270,271,272,275],{},"Modules are installed on your Dethernety deployment, not attached to individual models. Every class from every installed module forms a ",[29,273,274],{},"single catalogue",", and that one catalogue is offered to every model on the deployment.",[14,277,278],{},"There is no per-model module selection. Nothing you do in a model's settings widens or narrows the catalogue, and two models on the same deployment always see exactly the same classes.",[81,280,282],{"id":281},"what-narrows-what-you-are-offered","What narrows what you are offered",[14,284,285],{},"The picker never shows you the whole catalogue at once. It narrows by:",[34,287,288,294,308,314],{},[37,289,290,293],{},[29,291,292],{},"The element you are classifying",": a component picker offers component classes, a boundary picker offers boundary classes, a data flow picker offers data flow classes, and the Data dialog offers data classes",[37,295,296,299,300,91,302,304,305,307],{},[29,297,298],{},"The component's type",": every component class is written for exactly one of ",[29,301,90],{},[29,303,94],{},", or ",[29,306,97],{},", and is never offered to a component of another type",[37,309,310,313],{},[29,311,312],{},"What you type",": the picker searches the catalogue by name, and on a deployment with an embedding backend also matches semantically against the element's name and description",[37,315,316,319,320,323,324,327,328,331],{},[29,317,318],{},"The facets you choose",": the ",[29,321,322],{},"Browse classes"," drawer has ",[29,325,326],{},"Category"," and ",[29,329,330],{},"Module"," chips you can use to narrow the catalogue yourself",[14,333,334,335,338],{},"The dropdown also offers ",[29,336,337],{},"Recently used in this model",". That list is a convenience kept in your own browser — it is not a property of the model and it does not restrict what else you can pick.",[14,340,341,342,75],{},"The full picker workflow is in ",[71,343,345],{"href":344},"\u002Fplatform\u002Fcomponent-configuration-guide#how-an-element-gets-its-class","How an Element Gets Its Class",[81,347,349],{"id":348},"getting-more-classes","Getting more classes",[14,351,352,353,356],{},"If nothing in the catalogue describes what you are modeling, the class you need has to come from a module — and installing a module is a ",[29,354,355],{},"deployment action",", not a modeling one. There is no in-model UI for it. How it is done depends on how your deployment is run:",[34,358,359,369],{},[37,360,361,364,365,75],{},[29,362,363],{},"A curated content package",": an operator mounts it from the deployment's operator console, then recreates the platform. See ",[71,366,368],{"href":367},"\u002Fbyodt-cloud\u002Fcloud#mounting-content-packages","Mounting content packages",[37,370,371,374,375,381,382,387],{},[29,372,373],{},"A module you or your team wrote",": an operator places its build output in the deployment's modules directory, which is read when the platform starts. See the ",[71,376,380],{"href":377,"rel":378},"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Fblob\u002Fmain\u002Fdocs\u002Farchitecture\u002Fmodules\u002FDEVELOPMENT_GUIDE.md",[379],"nofollow","Module Development Guide"," for writing one, and the ",[71,383,386],{"href":384,"rel":385},"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Fblob\u002Fmain\u002Fdocs\u002FCONFIGURATION_GUIDE.md",[379],"Configuration Guide"," for where that directory lives.",[14,389,390,391,394],{},"Either way, the new classes appear in ",[29,392,393],{},"every"," model on the deployment from the next platform start — there is nothing to enable per model afterwards.",[14,396,397],{},"So if a class you expect is missing, check the element's type first, and then ask whoever operates the deployment whether the module that provides it is installed.",[14,399,400,401,75],{},"Installing a module aimed at your technology does more than add rows to the picker — it also changes how specific the analysis can be. See ",[71,402,404],{"href":403},"#module-impact-on-analysis","Module Impact on Analysis",[21,406,408],{"id":407},"how-modules-work","How Modules Work",[81,410,412],{"id":411},"policy-evaluation","Policy Evaluation",[14,414,415],{},"Modules use OPA\u002FRego policies to analyze your configurations:",[417,418,423],"pre",{"className":419,"code":420,"language":421,"meta":422,"style":422},"language-rego shiki shiki-themes github-light github-dark-dimmed","# Example: a Web Server class policy (shortened)\n_weak_tls_termination_def := {\n    \"name\": \"Weak TLS termination\",\n    \"criticality\": \"high\",\n    \"exploited_by\": [\n        {\"label\": \"MitreAttackTechnique\", \"property\": \"attack_id\", \"value\": \"T1557\"}  # Adversary-in-the-Middle\n    ]\n}\n\nweak_tls_termination[_weak_tls_termination_def] if {\n    input.min_tls_version == \"tls1_0_or_tls1_1_or_sslv3_accepted\"  # Your configuration\n}\n\nweak_tls_termination[_weak_tls_termination_def] if {\n    not input.hsts_enabled                                        # An unanswered attribute counts too\n}\n\nexposures contains _weak_tls_termination_def if {\n    count(weak_tls_termination) > 0  # Result: exposure with its attack technique mapping\n}\n","rego","",[171,424,425,433,439,445,451,457,463,469,475,482,488,494,499,504,509,515,520,525,531,537],{"__ignoreMap":422},[426,427,430],"span",{"class":428,"line":429},"line",1,[426,431,432],{},"# Example: a Web Server class policy (shortened)\n",[426,434,436],{"class":428,"line":435},2,[426,437,438],{},"_weak_tls_termination_def := {\n",[426,440,442],{"class":428,"line":441},3,[426,443,444],{},"    \"name\": \"Weak TLS termination\",\n",[426,446,448],{"class":428,"line":447},4,[426,449,450],{},"    \"criticality\": \"high\",\n",[426,452,454],{"class":428,"line":453},5,[426,455,456],{},"    \"exploited_by\": [\n",[426,458,460],{"class":428,"line":459},6,[426,461,462],{},"        {\"label\": \"MitreAttackTechnique\", \"property\": \"attack_id\", \"value\": \"T1557\"}  # Adversary-in-the-Middle\n",[426,464,466],{"class":428,"line":465},7,[426,467,468],{},"    ]\n",[426,470,472],{"class":428,"line":471},8,[426,473,474],{},"}\n",[426,476,478],{"class":428,"line":477},9,[426,479,481],{"emptyLinePlaceholder":480},true,"\n",[426,483,485],{"class":428,"line":484},10,[426,486,487],{},"weak_tls_termination[_weak_tls_termination_def] if {\n",[426,489,491],{"class":428,"line":490},11,[426,492,493],{},"    input.min_tls_version == \"tls1_0_or_tls1_1_or_sslv3_accepted\"  # Your configuration\n",[426,495,497],{"class":428,"line":496},12,[426,498,474],{},[426,500,502],{"class":428,"line":501},13,[426,503,481],{"emptyLinePlaceholder":480},[426,505,507],{"class":428,"line":506},14,[426,508,487],{},[426,510,512],{"class":428,"line":511},15,[426,513,514],{},"    not input.hsts_enabled                                        # An unanswered attribute counts too\n",[426,516,518],{"class":428,"line":517},16,[426,519,474],{},[426,521,523],{"class":428,"line":522},17,[426,524,481],{"emptyLinePlaceholder":480},[426,526,528],{"class":428,"line":527},18,[426,529,530],{},"exposures contains _weak_tls_termination_def if {\n",[426,532,534],{"class":428,"line":533},19,[426,535,536],{},"    count(weak_tls_termination) > 0  # Result: exposure with its attack technique mapping\n",[426,538,540],{"class":428,"line":539},20,[426,541,474],{},[14,543,544],{},"What this means in practice:",[34,546,547,553,559],{},[37,548,549,552],{},[29,550,551],{},"Real-time feedback",": Exposures are recalculated each time you save an element's attributes",[37,554,555,558],{},[29,556,557],{},"Several routes to one exposure",": A policy can raise the same exposure from different attribute combinations",[37,560,561,564],{},[29,562,563],{},"Automated coverage",": Policies check many security considerations automatically",[81,566,568],{"id":567},"security-framework-mapping","Security Framework Mapping",[14,570,571],{},"Modules connect your configurations to security frameworks:",[417,573,578],{"className":574,"code":576,"language":577},[575],"language-text","Your Configuration  ->  Module Analysis  ->  Framework Integration\n|-- Component: Web Server\n|-- Protocol: HTTP\n|-- Authentication: Basic\n`-- Module evaluates...\n    |-- Detects: Unencrypted traffic exposure\n    |-- Maps to: MITRE ATT&CK T1040 (Network Sniffing)\n    |-- Links to: D3FEND D3-TTE (Transport Encryption)\n    `-- Recommends: TLS encryption control\n","text",[171,579,576],{"__ignoreMap":422},[81,581,583],{"id":582},"dynamic-form-generation","Dynamic Form Generation",[14,585,586],{},"Modules define the configuration forms you see in the UI:",[34,588,589,595,601,607],{},[37,590,591,594],{},[29,592,593],{},"JSON Schema definitions"," control what attributes are available",[37,596,597,600],{},[29,598,599],{},"Forms adapt"," to different component types and classes",[37,602,603,606],{},[29,604,605],{},"Validation rules"," enforce proper configurations",[37,608,609,612],{},[29,610,611],{},"Help text"," provides context-specific guidance",[21,614,616],{"id":615},"included-modules","Included Modules",[14,618,619],{},"The OSS distribution ships with four modules. Only the first contributes classes to the pickers; the other three supply framework data, a report, and the coverage facts that report reads.",[621,622,628],"div",{"className":623,"tabIndex":625,"role":626,"ariaLabel":627},[624],"table-frame",0,"region","Table: Included Modules",[629,630,631,646],"table",{},[632,633,634],"thead",{},[635,636,637,640,643],"tr",{},[638,639,330],"th",{},[638,641,642],{},"Identifier",[638,644,645],{},"Contributes",[647,648,649,665,680,698],"tbody",{},[635,650,651,657,662],{},[652,653,654],"td",{},[29,655,656],{},"Dethernety General",[652,658,659],{},[171,660,661],{},"dethernety-general",[652,663,664],{},"Component, boundary, data flow, control, data, and issue classes, plus the Rego policies that turn their attributes into exposures and countermeasures",[635,666,667,672,677],{},[652,668,669],{},[29,670,671],{},"MITRE Frameworks",[652,673,674],{},[171,675,676],{},"mitre-frameworks",[652,678,679],{},"Pre-loaded ATT&CK, ATLAS and D3FEND data",[635,681,682,686,691],{},[652,683,684],{},[29,685,260],{},[652,687,688],{},[171,689,690],{},"dethernety-threat-report",[652,692,693,694,697],{},"The ",[29,695,696],{},"Threat Report"," analysis type and the report it renders",[635,699,700,705,710],{},[652,701,702],{},[29,703,704],{},"Dethernety Coverage Tools",[652,706,707],{},[171,708,709],{},"dethernety-coverage-tools",[652,711,712,713,716],{},"The graded MITRE coverage facts the Threat Report's ",[29,714,715],{},"Coverage & Gaps"," matrix reads",[14,718,693,719,722,723,725,726,728],{},[29,720,721],{},"identifier"," is the name the platform uses, and the name to quote when asking an operator whether something is installed. A module that provides classes also appears under it on the ",[29,724,330],{}," facet chips in the ",[29,727,322],{}," drawer.",[14,730,731,732,735],{},"MITRE Frameworks is the odd one out: it is a ",[29,733,734],{},"data pack"," rather than a running module. It loads the ATT&CK, ATLAS and D3FEND content into the graph, provides no classes and no logic of its own, and so never appears as a facet chip — but everything that maps a finding or a countermeasure to a framework depends on it having been loaded.",[81,737,656],{"id":661},[14,739,740],{},"The default class-providing module:",[34,742,743,746,749,752],{},[37,744,745],{},"General-purpose component classes for all three component types — processes (web server, API gateway, application service, firewall), data stores (relational database, object storage, cache, message queue), and external entities (end user, administrator, third-party service)",[37,747,748],{},"Boundary classes (network perimeter, network segment, application layer, data layer, container, host, and more) and data flow classes (HTTP\u002FS request, API call, database query, authentication exchange, and more)",[37,750,751],{},"Control classes (encryption at rest and in transit, multi-factor authentication, role-based access control, web application firewall rules, and more), data classes, and issue classes",[37,753,754],{},"Core security analysis policies — every class carries the Rego rules that turn its configured attributes into exposures and countermeasures",[81,756,671],{"id":676},[14,758,759],{},"Provides pre-loaded MITRE ATT&CK, ATLAS and D3FEND data:",[34,761,762,765,768,771],{},[37,763,764],{},"Attack technique definitions",[37,766,767],{},"Defensive technique mappings",[37,769,770],{},"Framework relationship data used by analysis and countermeasure generation",[37,772,773],{},"MITRE ATLAS techniques, tactics, mitigations and case studies for attacks on AI-enabled systems, linked to the ATT&CK techniques they cite. ATLAS is loaded but not yet offered in the technique picker.",[81,775,260],{"id":690},[14,777,778,779,782,783,785],{},"Contributes ",[29,780,781],{},"one analysis type — \"Threat Report\""," — and the report it renders. It is the only analysis type the OSS distribution ships, and therefore the only entry in a stock deployment's ",[29,784,255],{}," menu.",[34,787,788,795,806,812],{},[37,789,790,791,794],{},"It provides ",[29,792,793],{},"no classes and no policies",". Nothing it does changes what you can classify an element with.",[37,796,797,798,801,802,805],{},"It runs ",[29,799,800],{},"no AI",": running it computes a point-in-time ",[29,803,804],{},"snapshot"," of the model with graph queries, asks no questions, and streams no reasoning.",[37,807,808,809,811],{},"Opening the results renders the report's own interface over that snapshot — a Posture Summary, a ",[29,810,715],{}," matrix, Reachability, Boundary Crossings, a Residual Risk ledger, and a per-element Component Profile.",[37,813,814],{},"Because the report reads a snapshot rather than the live model, it also detects when the model has changed underneath a snapshot and offers to re-run.",[14,816,817,818,821],{},"See ",[71,819,696],{"href":820},"\u002Fthreat-report"," for how to read and export one.",[81,823,704],{"id":709},[14,825,826,827,830,831,833],{},"A backend-only module with ",[29,828,829],{},"no user interface of its own",". It computes the graded, element-scoped MITRE coverage facts that the Threat Report's ",[29,832,715],{}," matrix is built from — for each exposure, which attack techniques it exposes and how strongly each is countered by the controls covering that element.",[14,835,836,837,840,841,843],{},"It is a ",[29,838,839],{},"dependency of the Threat Report",", not an alternative to it. If it is not deployed, the ",[29,842,715],{}," tab still appears, but instead of a matrix it says the coverage facts are unavailable and names the missing module. The rest of the report is unaffected, and no empty or all-green grid is ever shown in place of the missing data.",[21,845,847],{"id":846},"building-custom-modules","Building Custom Modules",[14,849,850],{},"Modules are JavaScript\u002FTypeScript packages that extend the platform. A module can include:",[34,852,853,859,865,871,877],{},[37,854,855,858],{},[29,856,857],{},"Component, data flow, boundary, and data classes"," with JSON Schema attribute definitions",[37,860,861,864],{},[29,862,863],{},"OPA\u002FRego policies"," for exposure detection and countermeasure generation",[37,866,867,870],{},[29,868,869],{},"Analysis class definitions"," for custom analysis workflows",[37,872,873,876],{},[29,874,875],{},"Issue class definitions"," with external system integration logic",[37,878,879,882],{},[29,880,881],{},"Custom business logic"," using full JavaScript capabilities",[14,884,885,888],{},[29,886,887],{},"Possible module types include",":",[34,890,891,894,897,900],{},[37,892,893],{},"Technology-specific modules (AWS, Kubernetes, container security, database security)",[37,895,896],{},"Compliance modules (NIST, PCI DSS, GDPR, SOC 2)",[37,898,899],{},"Industry-specific modules (healthcare, financial services, manufacturing)",[37,901,902],{},"Integration modules (connecting to external vulnerability scanners, SIEMs, or ticketing systems)",[14,904,905,906,75],{},"For module development details, see the ",[71,907,380],{"href":377,"rel":908},[379],[21,910,912],{"id":911},"best-practices","Best Practices",[81,914,916],{"id":915},"choosing-what-to-install","Choosing What to Install",[918,919,920,926,932],"ol",{},[37,921,922,925],{},[29,923,924],{},"Start with the included modules"," for basic threat modeling",[37,927,928,931],{},[29,929,930],{},"Add specialized modules"," as they become available for your technology stack",[37,933,934,937],{},[29,935,936],{},"Include compliance modules"," if you have regulatory requirements",[14,939,940,941,75],{},"These are decisions about the deployment rather than about one model, so they are taken with whoever operates it — see ",[71,942,349],{"href":943},"#getting-more-classes",[81,945,947],{"id":946},"working-with-a-large-catalogue","Working with a Large Catalogue",[34,949,950,956,962,976],{},[37,951,952,955],{},[29,953,954],{},"Install only what is needed",": every installed module adds to the one catalogue every model searches, so unused modules make the picker noisier for everyone on the deployment",[37,957,958,961],{},[29,959,960],{},"Focus on your technology stack",": prefer modules that match your actual systems",[37,963,964,967,968,327,970,972,973,975],{},[29,965,966],{},"Filter rather than scroll",": use the ",[29,969,326],{},[29,971,330],{}," facets in the ",[29,974,322],{}," drawer to cut a large catalogue down to what you are looking for",[37,977,978,981],{},[29,979,980],{},"Review what is installed periodically",": as your architecture evolves, ask for modules that cover it — and for ones you no longer model against to be removed",[21,983,404],{"id":984},"module-impact-on-analysis",[81,986,988],{"id":987},"exposure-detection-quality","Exposure Detection Quality",[14,990,991],{},"More specific modules produce more specific exposure detection:",[34,993,994,997],{},[37,995,996],{},"Generic module: \"Database security issue\"",[37,998,999],{},"Technology-specific module: \"Unencrypted PostgreSQL connections with weak authentication on port 5432\"",[81,1001,1003],{"id":1002},"countermeasure-relevance","Countermeasure Relevance",[14,1005,1006],{},"Technology-aware modules produce actionable recommendations:",[34,1008,1009,1012],{},[37,1010,1011],{},"Generic: \"Enable encryption\"",[37,1013,1014],{},"Technology-specific: \"Enable encryption at rest using KMS with automatic key rotation\"",[81,1016,1018],{"id":1017},"analysis-depth","Analysis Depth",[14,1020,1021],{},"Multiple modules provide broader coverage:",[34,1023,1024,1027],{},[37,1025,1026],{},"Single module: Standard security checks",[37,1028,1029],{},"Multiple complementary modules: Technology-specific, compliance, and framework-based analysis",[1031,1032],"hr",{},[14,1034,1035,888],{},[29,1036,1037],{},"Next Steps",[34,1039,1040,1049,1058],{},[37,1041,1042,1048],{},[29,1043,1044],{},[71,1045,1047],{"href":1046},"\u002Fplatform\u002Fcomponent-configuration-guide","Component Configuration Guide",": Learn how to configure components against the classes your installed modules provide",[37,1050,1051,1057],{},[29,1052,1053],{},[71,1054,1056],{"href":1055},"\u002Fplatform\u002Fsecurity-analysis-workflow","Security Analysis Workflow",": Understand how modules affect your analysis results",[37,1059,1060,1066],{},[29,1061,1062],{},[71,1063,1065],{"href":1064},"\u002Fplatform\u002Fworking-with-security-controls","Working with Security Controls",": See how modules provide countermeasures",[1068,1069,1070],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":422,"searchDepth":441,"depth":441,"links":1072},[1073,1074,1081,1086,1091,1097,1098,1102],{"id":23,"depth":435,"text":24},{"id":78,"depth":435,"text":79,"children":1075},[1076,1077,1078,1079,1080],{"id":83,"depth":441,"text":84},{"id":134,"depth":441,"text":135},{"id":177,"depth":441,"text":178},{"id":204,"depth":441,"text":205},{"id":241,"depth":441,"text":242},{"id":263,"depth":435,"text":264,"children":1082},[1083,1084,1085],{"id":267,"depth":441,"text":268},{"id":281,"depth":441,"text":282},{"id":348,"depth":441,"text":349},{"id":407,"depth":435,"text":408,"children":1087},[1088,1089,1090],{"id":411,"depth":441,"text":412},{"id":567,"depth":441,"text":568},{"id":582,"depth":441,"text":583},{"id":615,"depth":435,"text":616,"children":1092},[1093,1094,1095,1096],{"id":661,"depth":441,"text":656},{"id":676,"depth":441,"text":671},{"id":690,"depth":441,"text":260},{"id":709,"depth":441,"text":704},{"id":846,"depth":435,"text":847},{"id":911,"depth":435,"text":912,"children":1099},[1100,1101],{"id":915,"depth":441,"text":916},{"id":946,"depth":441,"text":947},{"id":984,"depth":435,"text":404,"children":1103},[1104,1105,1106],{"id":987,"depth":441,"text":988},{"id":1002,"depth":441,"text":1003},{"id":1017,"depth":441,"text":1018},"md",{"category":1109,"position":484,"tags":1110},"reference",[1111,1109,1112,1113,1114,1115],"intermediate","conceptual","modules","extensions","system-architecture","\u002Fplatform\u002Funderstanding-modules",{"title":5,"description":19},"01.platform\u002F08.understanding-modules","jsXubLDpgJYpVGcVS7mPArTKhInyNpLR4k3kaHgyqNI",[1121,1166,1201,1256,1288,1332,1347,1417],{"title":1122,"description":1123,"path":1124,"stem":1125,"children":1126,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[1127,1131,1136,1141,1144,1149,1152,1157,1162,1163],{"title":1128,"path":1124,"stem":1129,"description":1130},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":1132,"path":1133,"stem":1134,"description":1135},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":1137,"path":1138,"stem":1139,"description":1140},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":1056,"path":1055,"stem":1142,"description":1143},"01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":1145,"path":1146,"stem":1147,"description":1148},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":1065,"path":1064,"stem":1150,"description":1151},"01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":1153,"path":1154,"stem":1155,"description":1156},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":1158,"path":1159,"stem":1160,"description":1161},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":5,"path":1116,"stem":1118,"description":19},{"title":1047,"path":1046,"stem":1164,"description":1165},"01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":1167,"description":1168,"path":1169,"stem":1170,"children":1171,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[1172,1176,1181,1186,1191,1196],{"title":1173,"path":1169,"stem":1174,"description":1175},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":1177,"path":1178,"stem":1179,"description":1180},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":1182,"path":1183,"stem":1184,"description":1185},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":1187,"path":1188,"stem":1189,"description":1190},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":1192,"path":1193,"stem":1194,"description":1195},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":1197,"path":1198,"stem":1199,"description":1200},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":1202,"description":1203,"path":1204,"stem":1205,"children":1206,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[1207,1211,1216,1221,1226,1231,1236,1241,1246,1251],{"title":1208,"path":1204,"stem":1209,"description":1210},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":1212,"path":1213,"stem":1214,"description":1215},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":1217,"path":1218,"stem":1219,"description":1220},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":1222,"path":1223,"stem":1224,"description":1225},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":1227,"path":1228,"stem":1229,"description":1230},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":1232,"path":1233,"stem":1234,"description":1235},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":1237,"path":1238,"stem":1239,"description":1240},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":1242,"path":1243,"stem":1244,"description":1245},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":1247,"path":1248,"stem":1249,"description":1250},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":1252,"path":1253,"stem":1254,"description":1255},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":696,"description":1257,"path":820,"stem":1258,"children":1259,"page":-1},"The residual-risk report over a threat model: reading it, filtering it and exporting it.","04.threat-report",[1260,1263,1268,1273,1278,1283],{"title":696,"path":820,"stem":1261,"description":1262},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":1264,"path":1265,"stem":1266,"description":1267},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":1269,"path":1270,"stem":1271,"description":1272},"Reading the Report","\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":1274,"path":1275,"stem":1276,"description":1277},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":1279,"path":1280,"stem":1281,"description":1282},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":1284,"path":1285,"stem":1286,"description":1287},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":1289,"description":1290,"path":1291,"stem":1292,"children":1293,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[1294,1298,1303,1308,1313,1318,1322,1327],{"title":1295,"path":1291,"stem":1296,"description":1297},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":1299,"path":1300,"stem":1301,"description":1302},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":1304,"path":1305,"stem":1306,"description":1307},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":1309,"path":1310,"stem":1311,"description":1312},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":1314,"path":1315,"stem":1316,"description":1317},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":1269,"path":1319,"stem":1320,"description":1321},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":1323,"path":1324,"stem":1325,"description":1326},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":1328,"path":1329,"stem":1330,"description":1331},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":1333,"description":1334,"path":1335,"stem":1336,"children":1337,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[1338,1342],{"title":1339,"path":1335,"stem":1340,"description":1341},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":1343,"path":1344,"stem":1345,"description":1346},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":1348,"description":1349,"path":1350,"stem":1351,"children":1352,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[1353,1357,1362,1367,1372,1377,1382,1387,1392,1397,1402,1407,1412],{"title":1354,"path":1350,"stem":1355,"description":1356},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":1358,"path":1359,"stem":1360,"description":1361},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":1363,"path":1364,"stem":1365,"description":1366},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":1368,"path":1369,"stem":1370,"description":1371},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":1373,"path":1374,"stem":1375,"description":1376},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":1378,"path":1379,"stem":1380,"description":1381},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":1383,"path":1384,"stem":1385,"description":1386},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":1388,"path":1389,"stem":1390,"description":1391},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":1393,"path":1394,"stem":1395,"description":1396},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":1398,"path":1399,"stem":1400,"description":1401},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":1403,"path":1404,"stem":1405,"description":1406},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":1408,"path":1409,"stem":1410,"description":1411},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":1413,"path":1414,"stem":1415,"description":1416},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":1418,"description":1419,"path":1420,"stem":1421,"children":1422,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[1423,1427,1432],{"title":1424,"path":1420,"stem":1425,"description":1426},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":1428,"path":1429,"stem":1430,"description":1431},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":1433,"path":1434,"stem":1435,"description":1436},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748184840]