[{"data":1,"prerenderedAt":4833},["ShallowReactive",2],{"page-\u002Fthreat-patterns":3,"navigation":4515},{"id":4,"title":5,"body":6,"description":16,"extension":4508,"meta":4509,"navigation":4510,"path":4511,"seo":4512,"stem":4513,"__hash__":4514},"docs\u002F06.threat-patterns\u002Findex.md","Threat Patterns User Guide",{"type":7,"value":8,"toc":4453},"minimark",[9,13,17,29,34,37,41,81,85,165,175,194,201,204,234,240,260,266,270,279,293,303,307,458,462,465,478,491,614,621,628,650,668,678,743,756,771,778,781,784,819,824,864,867,872,876,879,882,921,924,928,974,978,991,998,1002,1005,1086,1096,1103,1107,1123,1126,1206,1220,1230,1240,1252,1255,1258,1307,1330,1344,1349,1353,1369,1375,1475,1481,1491,1497,1508,1526,1560,1565,1589,1592,1616,1642,1651,1654,1662,1665,1683,1703,1740,1756,1774,1798,1801,1840,1846,1906,1912,1918,1979,2046,2087,2100,2103,2112,2166,2175,2184,2190,2198,2201,2207,2212,2244,2249,2281,2295,2301,2341,2344,2353,2370,2373,2386,2389,2399,2409,2413,2421,2445,2450,2456,2474,2478,2540,2547,2550,2556,2576,2582,2633,2641,2645,2676,2683,2693,2697,2700,2705,2719,2725,2729,2748,2756,2760,2773,2829,2832,2835,2863,2867,2914,2917,2931,2936,2939,2948,3004,3007,3016,3039,3042,3048,3051,3062,3073,3081,3090,3095,3105,3108,3131,3134,3151,3163,3202,3205,3208,3229,3233,3236,3309,3332,3337,3344,3348,3365,3368,3380,3388,3397,3406,3417,3430,3433,3441,3444,3447,3472,3476,3493,3560,3563,3567,3573,3626,3629,3635,3711,3720,3816,3848,3861,3866,3874,3905,3912,3915,3920,3924,3927,4041,4045,4074,4077,4080,4084,4097,4101,4120,4123,4422,4426],[10,11,5],"h1",{"id":12},"threat-patterns-user-guide",[14,15,16],"p",{},"Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",[14,18,19,20,24,25,28],{},"The analysis is deterministic. There is no AI, and a pattern finding carries no score. A finding is ",[21,22,23],"strong",{},"Confirmed"," or ",[21,26,27],{},"Not ruled out",", and every part of it points back to something in your model. When the model does not say enough, the analysis tells you exactly what to add.",[30,31,33],"h2",{"id":32},"who-this-guide-is-for","Who this guide is for",[14,35,36],{},"Security architects and analysts who model AI agents and their tools on the Dethernety platform, and the people who read the one-page sheet the analysis produces. You need to be able to open and edit your model.",[30,38,40],{"id":39},"before-you-start","Before you start",[42,43,44,51,57,75],"ul",{},[45,46,47,50],"li",{},[21,48,49],{},"A threat model with agents in it."," The analysis looks at agents, their tools, MCP servers, harnesses, credentials and the flows between them.",[45,52,53,56],{},[21,54,55],{},"The Threat Patterns analysis and a pattern pack."," Threat Patterns runs the pattern packs installed on your platform. The agentic pack provides the four patterns below. If you do not see Threat Patterns, or it says no pattern pack is installed, contact your administrator.",[45,58,59,62,63,66,67,70,71,74],{},[21,60,61],{},"Platform 0.11.0 or later"," for full results. This release adds the ",[21,64,65],{},"Origin"," and ",[21,68,69],{},"Credential"," fields on data items. On an older platform the analysis still runs, but those facts stay unanswered. The legs that depend on them stay undetermined and appear under ",[21,72,73],{},"Facts to establish",". Nothing is confirmed on a fact the model does not state.",[45,76,77,80],{},[21,78,79],{},"Permission to run analyses"," on the model.",[30,82,84],{"id":83},"run-the-analysis","Run the analysis",[86,87,88,91,106,120,129],"ol",{},[45,89,90],{},"Open your threat model.",[45,92,93,94,97,98,105],{},"On the canvas toolbar on the left, click the sparkles icon (tooltip ",[21,95,96],{},"Analyses","). A dialog headed ",[21,99,100,101],{},"Analysis: ",[102,103,104],"em",{},"model name"," opens, with the model's analyses.",[45,107,108,109,112,113,116,117,119],{},"Click ",[21,110,111],{},"New Analysis"," and choose ",[21,114,115],{},"Threat Patterns"," from the menu. A row named ",[21,118,115],{}," appears in the list.",[45,121,108,122,125,126],{},[21,123,124],{},"View results"," on that row. Before the first run, the page reads ",[21,127,128],{},"This analysis has not run yet.",[45,130,108,131,134,135,138,139,142,143,142,146,142,149,66,152,154,155,157,158,160,161,164],{},[21,132,133],{},"Generate",". The analysis reads the model and the installed packs. When it finishes, the button reads ",[21,136,137],{},"Generate again",", and you see the header and five tabs: ",[21,140,141],{},"Sheet",", ",[21,144,145],{},"Findings",[21,147,148],{},"Fixes",[21,150,151],{},"By item",[21,153,73],{},". The page opens on ",[21,156,141],{},", unless you followed a link to another tab. The ",[21,159,73],{}," label carries the number of questions it asks, for example ",[21,162,163],{},"Facts to establish (4)",".",[14,166,167,168,171,172,174],{},"If you change the model later, a banner reads ",[21,169,170],{},"The model changed since this run. Generate again to read the current model."," Click ",[21,173,137],{}," to refresh. Nothing changes until you do. Moving or resizing elements on the canvas, or changing which side a flow leaves from, does not mark the result out of date.",[14,176,177,178,189,190,193],{},"The banner also shows after Threat Patterns or its credit table is updated: a result's fingerprint includes the model, the version of Threat Patterns that made it and its credit table, so a change in any of them marks the result out of date. After an engine update it reads ",[21,179,180,181,184,185,188],{},"Threat Patterns was updated (engine ",[102,182,183],{},"old version"," → ",[102,186,187],{},"new version",") since this run. Generate again to read the current model."," It names the update alone, even if you also changed the model, because a new engine can read the model differently. After an update of the credit table alone it reads ",[21,191,192],{},"Threat Patterns was updated since this run. Generate again to read the current model."," When you changed the model and the credit table was updated, the banner names both, the model first.",[14,195,196,197,200],{},"The banner reads ",[21,198,199],{},"The model or Threat Patterns changed since this run. Generate again to read the current model."," when it cannot tell which changed: the result was generated before Threat Patterns engine 0.1.5, the server does not report what changed, or only your assertions changed. After you update to engine 0.1.5, every earlier result shows this banner once, until you generate it again. A model update that changes nothing, for example saving the same answers again, does not mark a result out of date.",[14,202,203],{},"The same banner shows when:",[42,205,206,217],{},[45,207,208,211,212,164],{},[21,209,210],{},"You assert or withdraw an assertion"," on this analysis. It shows at once, without a reload. See ",[213,214,216],"a",{"href":215},"#act-on-a-question","Act on a question",[45,218,219,222,223,24,226,229,230,164],{},[21,220,221],{},"An exposure's disposition changes."," When you change it from the analysis, with ",[21,224,225],{},"Affirm",[21,227,228],{},"Disposition…",", the banner shows at once. A change made elsewhere on the platform shows the next time you open the analysis. See ",[213,231,233],{"href":232},"#dispositions-on-exposures","Dispositions on exposures",[14,235,236,239],{},[21,237,238],{},"A pattern pack the engine did not run."," A pattern pack can need a newer Threat Patterns engine than the one installed. The engine then skips that pack and runs the others. A notice above the tabs names each pack it skipped:",[241,242,243],"blockquote",{},[14,244,245,246,249,250,253,254,256,257,259],{},"Pattern pack ",[102,247,248],{},"pack","@",[102,251,252],{},"version"," needs the Threat Patterns engine ",[102,255,252],{}," or later; the engine is ",[102,258,252],{},". Upgrade the engine module. It was not run.",[14,261,262,263,265],{},"The report holds no findings from that pack. Ask your administrator to upgrade the Threat Patterns engine module, then click ",[21,264,137],{},". The exported sheet carries the same line under its title.",[30,267,269],{"id":268},"read-the-header","Read the header",[14,271,272,273,278],{},"The header reads ",[21,274,275,276],{},"Threat Patterns · ",[102,277,104],{},". Under it are the generated time, for example \"Generated 11 Oct 2026, 20:58 UTC\", and two count lines:",[42,280,281,287],{},[45,282,283,286],{},[21,284,285],{},"Systemic findings",", by confidence: \"5 systemic findings: 2 Confirmed · 3 Not ruled out\".",[45,288,289,292],{},[21,290,291],{},"Element exposures",", by whether a finding holds them and by triage: \"29 element exposures: 14 not inside a finding · 9 inside one · 6 accepted or dismissed, not counted · 20 untriaged\".",[14,294,295,296,24,299,302],{},"Accepted and dismissed exposures (triage ",[21,297,298],{},"accepted",[21,300,301],{},"dispositioned",") are listed, but never counted. The two lines are never added together.",[30,304,306],{"id":305},"the-four-patterns","The four patterns",[308,309,315],"div",{"className":310,"tabIndex":312,"role":313,"ariaLabel":314},[311],"table-frame",0,"region","Table: The four patterns",[316,317,318,337],"table",{},[319,320,321],"thead",{},[322,323,324,328,331,334],"tr",{},[325,326,327],"th",{},"Pattern",[325,329,330],{},"What it means",[325,332,333],{},"Parts (legs) that must line up",[325,335,336],{},"Makes it worse",[338,339,340,372,401,432],"tbody",{},[322,341,342,349,352,366],{},[343,344,345,348],"td",{},[21,346,347],{},"Lethal trifecta"," (critical)",[343,350,351],{},"Untrusted content can steer the agent into sending private data where the attacker reads it",[343,353,354,357,358,361,362,365],{},[21,355,356],{},"U"," untrusted content reaches the agent · ",[21,359,360],{},"P"," the agent can read private data · ",[21,363,364],{},"X"," the agent can transmit to where an outsider reads",[343,367,368,371],{},[21,369,370],{},"W"," the agent writes without approval",[322,373,374,379,382,396],{},[343,375,376,348],{},[21,377,378],{},"Credential chain",[343,380,381],{},"A foothold in the agent stack reaches a credential that unlocks sensitive data or privileged actions",[343,383,384,387,388,391,392,395],{},[21,385,386],{},"foothold"," · ",[21,389,390],{},"reach"," the credential · ",[21,393,394],{},"unlock"," something with it",[343,397,398],{},[21,399,400],{},"weak credential",[322,402,403,409,412,424],{},[343,404,405,408],{},[21,406,407],{},"Injection to action"," (high)",[343,410,411],{},"Untrusted content can trigger a write, destructive or code-execution action that nobody approves",[343,413,414,387,417,387,420,423],{},[21,415,416],{},"untrusted input",[21,418,419],{},"action tools",[21,421,422],{},"no gate"," (no approval)",[343,425,426,387,429],{},[21,427,428],{},"sensitive target",[21,430,431],{},"broad identity",[322,433,434,439,442,453],{},[343,435,436,408],{},[21,437,438],{},"Delegation hop",[343,440,441],{},"Untrusted content reaches an agent that hands the work, with its origin, to an agent holding the other legs",[343,443,444,387,447,387,450],{},[21,445,446],{},"untrusted content at the delegator",[21,448,449],{},"origin carried to the delegate",[21,451,452],{},"delegate holds the rest",[343,454,455],{},[21,456,457],{},"open delegation",[30,459,461],{"id":460},"read-a-finding","Read a finding",[14,463,464],{},"A finding appears when at least two required legs are present and none is absent.",[42,466,467,472],{},[45,468,469,471],{},[21,470,23],{},": every required leg is present.",[45,473,474,477],{},[21,475,476],{},"Not ruled out: N present, M undetermined",": some legs are present, and the model does not say enough to decide the rest. This is not a lower grade of risk. It means the model is missing a fact.",[14,479,480,481,142,484,24,487,490],{},"Each leg is ",[21,482,483],{},"present",[21,485,486],{},"absent",[21,488,489],{},"undetermined",". Expand a finding to see each leg's routes: the elements and flows that make it present, with a label that says where the evidence comes from:",[308,492,495],{"className":493,"tabIndex":312,"role":313,"ariaLabel":494},[311],"Table: Read a finding",[316,496,497,507],{},[319,498,499],{},[322,500,501,504],{},[325,502,503],{},"Label",[325,505,506],{},"Meaning",[338,508,509,519,529,539,549,559,569,583,593,603],{},[322,510,511,516],{},[343,512,513],{},[21,514,515],{},"stated",[343,517,518],{},"Something you drew or answered, used directly",[322,520,521,526],{},[343,522,523],{},[21,524,525],{},"derived from topology",[343,527,528],{},"Inferred from what you drew, for example content carried out of an untrusted zone",[322,530,531,536],{},[343,532,533],{},[21,534,535],{},"class premise",[343,537,538],{},"Follows from the element's class, for example an Untrusted Content Source",[322,540,541,546],{},[343,542,543],{},[21,544,545],{},"class exposure",[343,547,548],{},"An exposure the element's class raised",[322,550,551,556],{},[343,552,553],{},[21,554,555],{},"from class list",[343,557,558],{},"The data item's class is a known credential class",[322,560,561,566],{},[343,562,563],{},[21,564,565],{},"from host mode",[343,567,568],{},"Read from the approval mode of the harness that runs the agent",[322,570,571,580],{},[343,572,573,576,577],{},[21,574,575],{},"via executor"," \u002F ",[21,578,579],{},"via neighbour",[343,581,582],{},"The agent transmits through a tool executor or a neighbouring element",[322,584,585,590],{},[343,586,587],{},[21,588,589],{},"analyst assertion",[343,591,592],{},"An assertion you recorded on this analysis",[322,594,595,600],{},[343,596,597],{},[21,598,599],{},"affirmed",[343,601,602],{},"An exposure the class raised and someone affirmed on the platform. The route still counts, and names the affirmation and its time",[322,604,605,609],{},[343,606,607],{},[21,608,301],{},[343,610,611,612],{},"An exposure left out by its disposition (false positive, not applicable or superseded). The route reads absent and names the exposure. See ",[213,613,233],{"href":232},[14,615,616,617,620],{},"Where the evidence names a zone, it reads as the model editor names it: the word on the zone's pill in the diagram, then the zone's ",[21,618,619],{},"Trust zone"," name, for example \"Customer (Untrusted, Open internet)\" or \"CRM (Vendor, Trusted external)\".",[14,622,623,624,627],{},"An undetermined route has no label. It shows ",[21,625,626],{},"to settle:"," and names the fact or drawing that would decide it, and on which element.",[14,629,630,633,634,637,638,641,642,645,646,164],{},[21,631,632],{},"Controls."," A control counts against a leg only when its countermeasure is linked to a technique that route stands for. The link is either the countermeasure's own edge to the technique, or a MITRE mitigation of the technique, which the analysis's credit table classes as prevention or detection from the mitigation's own MITRE description. A mitigation the credit table does not hold credits detection. A finding then reads ",[21,635,636],{},"control modelled",". A control that only detects reads ",[21,639,640],{},"detected only",". Detection never counts as prevention. Otherwise the finding is ",[21,643,644],{},"unmitigated",". A credited finding names the required legs that earn its word, for example \"detected only on U\". The leg dialog shows how each credit was earned; see ",[213,647,649],{"href":648},"#dialogs","Dialogs",[14,651,652,653,655,656,658,659,661,662,664,665,667],{},"A finding leaves that state in one of two ways. Set the elements' attributes so that a required leg is absent, and the finding disappears on the next run. Or model a compensating control whose countermeasure credits a required leg's technique, and the finding then reads ",[21,654,636],{},", or ",[21,657,640],{}," for a detection. Either way, click ",[21,660,137],{}," to see the change. Nothing marks a finding as done by hand. On the ",[21,663,145],{}," tab and in the sheet's top findings, hover over or move to the word ",[21,666,644],{}," to see these two ways again.",[14,669,670,673,674,677],{},[21,671,672],{},"Element exposures."," Your element classes also raise exposures of their own. Each one shows a ",[21,675,676],{},"triage",", taken from its disposition on the platform:",[308,679,681],{"className":680,"tabIndex":312,"role":313,"ariaLabel":494},[311],[316,682,683,693],{},[319,684,685],{},[322,686,687,690],{},[325,688,689],{},"Triage",[325,691,692],{},"Platform disposition",[338,694,695,705,715,724,734],{},[322,696,697,702],{},[343,698,699],{},[21,700,701],{},"untriaged",[343,703,704],{},"none yet",[322,706,707,712],{},[343,708,709],{},[21,710,711],{},"analyst-confirmed",[343,713,714],{},"Affirmed",[322,716,717,721],{},[343,718,719],{},[21,720,298],{},[343,722,723],{},"Risk Accepted",[322,725,726,731],{},[343,727,728],{},[21,729,730],{},"compensate",[343,732,733],{},"Compensating Control",[322,735,736,740],{},[343,737,738],{},[21,739,301],{},[343,741,742],{},"Not Applicable, False Positive or Superseded. Counted apart",[14,744,745,746,24,748,750,751,753,754,164],{},"Beside the triage, an exposure can carry a control note, ",[21,747,636],{},[21,749,640],{},", by the same rule as above. The note stays whatever the triage, for example \"untriaged · control modelled\". A control can also sit on a data item. It then counts for the exposures on that data item, and for a finding's route on it. It does not count for the element that handles the data item, and a control on that element does not count for the data item, unless that element is one of the finding's own agents: a control on one of them, or on a boundary around it, counts for every route of that finding. With the agentic pack, no required leg has a route on a data item, so a control on a data item changes the notes on that data item's exposures and no finding. ",[21,752,711],{}," is an analyst's verdict on one exposure. It is not a pattern's ",[21,755,23],{},[14,757,758,759,142,761,24,763,765,766,768,769,164],{},"An ",[21,760,711],{},[21,762,298],{},[21,764,730],{}," exposure still counts in systemic findings: accepting or compensating a risk changes no fact in the model. A ",[21,767,301],{}," exposure is left out of the analysis, and so are the routes of a finding that rested on it. See ",[213,770,233],{"href":232},[14,772,773,774,777],{},"An element exposure can sit inside a systemic finding: it is on an element that supplies one of the finding's legs, and it shares a technique family with the pattern. ",[213,775,145],{"href":776},"#findings"," shows where it appears.",[14,779,780],{},"Where several exposures are counted by triage, the total comes last: \"3 analyst-confirmed · 2 accepted · 24 untriaged, 29 in all\". A single state stands alone: \"15 untriaged\". Dispositioned exposures are added as \"; 4 dispositioned, counted apart\".",[30,782,145],{"id":783},"findings",[14,785,786,787,789,790,142,793,142,796,142,799,66,802,805,806,808,809,811,812,24,815,818],{},"The ",[21,788,145],{}," tab lists systemic findings and element exposures. You can filter by ",[21,791,792],{},"Scope",[21,794,795],{},"Severity",[21,797,798],{},"Confidence",[21,800,801],{},"State",[21,803,804],{},"Zone",". ",[21,807,801],{}," offers both the finding states and the triage states. ",[21,810,804],{}," names each zone as the model editor does, for example ",[21,813,814],{},"Untrusted (Open internet)",[21,816,817],{},"Vendor (Trusted external)",". A line above the list says how many rows are shown, for example \"12 of 41 shown\".",[820,821,823],"h3",{"id":822},"group-and-rank","Group and rank",[14,825,826,829,830,832,833,835,836,142,838,142,841,66,843,845,846,24,849,852,853,856,857,24,860,863],{},[21,827,828],{},"Group by"," defaults to ",[21,831,327],{},": one group per pattern, then ",[21,834,291],{},". The other groupings are ",[21,837,792],{},[21,839,840],{},"Subject",[21,842,795],{},[21,844,801],{},". Click a group's header to fold or unfold it. With the keyboard, move to the ",[21,847,848],{},"▸",[21,850,851],{},"▾"," at its start with ",[21,854,855],{},"Tab"," and press ",[21,858,859],{},"Enter",[21,861,862],{},"Space",". A group with more than 25 rows starts folded.",[14,865,866],{},"Findings are ranked by one rule in every grouping. It is stated once above the list:",[241,868,869],{},[14,870,871],{},"Ranked Confirmed before Not ruled out, then the pattern's severity band, then unmitigated or detected only before a control modelled, then more aggravating legs present.",[820,873,875],{"id":874},"pattern-groups","Pattern groups",[14,877,878],{},"A pattern group's header shows the severity band, the pattern and its counts, for example \"3 findings: 1 Confirmed · 2 Not ruled out\". The line under it gives the pattern's reason, followed by \"Severity is the pattern's band.\"",[14,880,881],{},"The pattern's legs are named columns, required legs first. Aggravating legs are muted. Each finding row has one mark per leg:",[308,883,886],{"className":884,"tabIndex":312,"role":313,"ariaLabel":885},[311],"Table: Pattern groups",[316,887,888,898],{},[319,889,890],{},[322,891,892,895],{},[325,893,894],{},"Mark",[325,896,897],{},"Leg state",[338,899,900,907,914],{},[322,901,902,905],{},[343,903,904],{},"●",[343,906,483],{},[322,908,909,912],{},[343,910,911],{},"◐",[343,913,489],{},[322,915,916,919],{},[343,917,918],{},"○",[343,920,486],{},[14,922,923],{},"In the other groupings, the same marks sit in the row, each beside its leg's name.",[820,925,927],{"id":926},"finding-rows","Finding rows",[42,929,930,940,965],{},[45,931,932,935,936,939],{},[21,933,934],{},"Band."," The severity band stands alone. A Not ruled out finding has ",[21,937,938],{},"if confirmed"," on a line under it.",[45,941,942,945,946,24,948,950,951,954,955,958,959,961,962,164],{},[21,943,944],{},"State."," For example \"Confirmed · unmitigated\" or \"Not ruled out · control modelled on P\". A ",[21,947,636],{},[21,949,640],{}," finding names its credited required legs after ",[21,952,953],{},"on",". Amber marks only what is still open. A Not ruled out finding's state is amber, with a link ",[21,956,957],{},"N questions →"," that opens its questions on ",[21,960,73],{},". Where another element's legs decide the finding, the link reads ",[21,963,964],{},"what decides it →",[45,966,967,970,971,164],{},[21,968,969],{},"Exposures inside."," A finding with element exposures inside it shows ",[21,972,973],{},"N exposures inside",[820,975,977],{"id":976},"element-exposure-rows","Element exposure rows",[14,979,980,981,984,985,988,989,164],{},"An exposure row shows its triage and control note. Untriaged exposures are muted. An exposure inside a finding shows one ",[21,982,983],{},"inside:"," chip that names the finding, and ",[21,986,987],{},"+N"," when it sits inside more than one. Click the chip to open that finding's dialog. See ",[213,990,649],{"href":648},[14,992,993,994,997],{},"Exposures inside a finding are hidden from the list by default. Click ",[21,995,996],{},"show the N element exposures inside a finding"," to list them too. The toggle names the accepted or dismissed ones apart, so its count matches the header: \"show the 19 element exposures inside a finding (1 accepted or dismissed)\" while the header says \"18 inside one\".",[820,999,1001],{"id":1000},"tooltips","Tooltips",[14,1003,1004],{},"Hover over a part of a finding to see what it means:",[308,1006,1009],{"className":1007,"tabIndex":312,"role":313,"ariaLabel":1008},[311],"Table: Tooltips",[316,1010,1011,1021],{},[319,1012,1013],{},[322,1014,1015,1018],{},[325,1016,1017],{},"Part",[325,1019,1020],{},"The tooltip shows",[338,1022,1023,1044,1054,1067],{},[322,1024,1025,1034],{},[343,1026,1027,1030,1031,1033],{},[21,1028,1029],{},"Pattern name"," (grouped by ",[21,1032,327],{}," only)",[343,1035,1036,1037,66,1040,1043],{},"The pattern and its band, its reason, then ",[21,1038,1039],{},"Required legs",[21,1041,1042],{},"Aggravating, never counted",", each leg with what it means",[322,1045,1046,1051],{},[343,1047,1048],{},[21,1049,1050],{},"Leg column header",[343,1052,1053],{},"The leg, what it means, and what its role means. Required: every required leg must be present for a Confirmed finding. Aggravating: makes the finding worse, but never counts toward it",[322,1055,1056,1061],{},[343,1057,1058],{},[21,1059,1060],{},"Mark in a row",[343,1062,1063,1064,1066],{},"The leg, its mark and state, what the leg means, what the state means, and the role; when a control credits the leg, also its credit and what it means. In the groupings other than ",[21,1065,327],{}," it also gives the evidence label, where there is one",[322,1068,1069,1078],{},[343,1070,1071,142,1073,24,1075,1077],{},[21,1072,644],{},[21,1074,636],{},[21,1076,640],{}," in a finding's state",[343,1079,1080,1081,1083,1084],{},"The word, with the credited legs it names, and what it means. For ",[21,1082,644],{},", the two ways out: attributes that make a required leg absent, or a compensating control whose countermeasure credits a required leg's technique. Then ",[21,1085,137],{},[14,1087,1088,1089,1091,1092,1095],{},"Pattern names, leg headers and these state words have a dotted underline. Move to them with ",[21,1090,855],{}," to open the tooltip, and press ",[21,1093,1094],{},"Escape"," to close it. The marks in a row open on hover only. Each row's screen-reader text already names every leg and its state.",[14,1097,1098,1099,164],{},"The sheet's top findings carry the pattern and coverage tooltips too. See ",[213,1100,1102],{"href":1101},"#the-sheet","The sheet",[820,1104,1106],{"id":1105},"expand-a-finding","Expand a finding",[14,1108,1109,1110,856,1112,24,1114,1116,1117,1119,1120,1122],{},"Click a row to expand it, and click it again to close it. With the keyboard, move to the row's title with ",[21,1111,855],{},[21,1113,859],{},[21,1115,862],{},". The ",[21,1118,848],{}," before the title turns to ",[21,1121,851],{}," while the row is open. Clicking the element name opens the element instead.",[14,1124,1125],{},"An expanded finding reads in this order:",[86,1127,1128,1135,1142,1149,1186,1190,1196],{},[45,1129,1130,1131,1134],{},"The pattern's reason, then the confidence (for example ",[21,1132,1133],{},"Not ruled out: 2 present, 1 undetermined","), the coverage, and the pattern with its version.",[45,1136,1137,1138,164],{},"The finding's diagram. See ",[213,1139,1141],{"href":1140},"#read-the-diagram","Read the diagram",[45,1143,1144,1145,1148],{},"For a credential chain, its ",[21,1146,1147],{},"Paths",": foothold → reach → unlock.",[45,1150,1151,1152,1154,1155,1158,1159,1161,1162,1164,1165,1168,1169,1172,1173,1176,1177,1179,1180,1183,1184,164],{},"Each leg with its routes and their labels. Every undetermined route has a ",[21,1153,626],{}," line with its next step, such as ",[21,1156,1157],{},"Answer it",". An attribute it names reads by its title in the model editor, as on ",[21,1160,73],{},". Where elements in the finding's ",[21,1163,626],{}," lines share a name, they read \"",[102,1166,1167],{},"name"," (from ",[102,1170,1171],{},"A"," to ",[102,1174,1175],{},"B",")\" for a flow and \"",[102,1178,1167],{}," (in ",[102,1181,1182],{},"parent",")\" for another element, as on ",[21,1185,73],{},[45,1187,1188,164],{},[21,1189,148],{},[45,1191,1192,1193,164],{},"The element exposures inside, each with its triage and control note. Accepted or dismissed ones are collapsed behind ",[21,1194,1195],{},"show N accepted or dismissed",[45,1197,1198,1201,1202,164],{},[21,1199,1200],{},"Dispositions",", when the finding rests on a dispositioned exposure or left one out: each exposure, who set its disposition and when, and whether the finding still counts it. See ",[213,1203,1205],{"href":1204},"#where-a-disposition-shows","Where a disposition shows",[14,1207,1208,1209,142,1211,24,1214,1217,1218,164],{},"The next step is ",[21,1210,1157],{},[21,1212,1213],{},"Draw it",[21,1215,1216],{},"Ask the owner",", by what the question asks. See ",[213,1219,216],{"href":215},[14,1221,1222,1225,1226,164],{},[21,1223,1224],{},"＋ Issue"," beside the pattern's reason, and beside each fix, turns the finding or the fix into a tracked issue. See ",[213,1227,1229],{"href":1228},"#raise-an-issue","Raise an issue",[14,1231,1232,1235,1236,164],{},[21,1233,1234],{},"＋ Risk"," beside the pattern's reason records the finding as a risk in Risk Assessment's register, or adds it to one. See ",[213,1237,1239],{"href":1238},"#record-a-finding-or-an-exposure-as-a-risk","Record a finding or an exposure as a risk",[14,1241,1242,1243,1245,1246,1249,1250,164],{},"Expanding an element exposure lists its techniques by id and name, then the score the exposure's policy gave it (\"score none\" when it has none) and its disposition in words, for example \"disposition false positive · left out of the analysis\". See ",[213,1244,1205],{"href":1204},". Click a technique to open its dialog. A name appears once it has been read from the platform. Click ",[21,1247,1248],{},"Open the exposure"," to open the exposure's dialog. See ",[213,1251,649],{"href":648},[820,1253,1141],{"id":1254},"read-the-diagram",[14,1256,1257],{},"The diagram draws the finding as a fishbone. The line above it reads \"every required leg must be present\".",[42,1259,1260,1266,1277,1286,1302],{},[45,1261,1262,1265],{},[21,1263,1264],{},"Head."," The box on the right is the finding: its title, the element it is at, Confirmed or Not ruled out, and the severity.",[45,1267,1268,1271,1272,24,1274,1276],{},[21,1269,1270],{},"Bones."," One bone per leg. Its label gives the leg and its state, for example \"foothold · present\", and ",[21,1273,636],{},[21,1275,640],{}," when a control in the model credits the leg. Required legs sit nearest the head. Aggravating legs sit left of a short tick on the spine, drawn as a thin double bone, and the line above adds that they never count.",[45,1278,1279,1282,1283,164],{},[21,1280,1281],{},"Ribs."," Each route is a rib off its leg, with the route's kind and, where it has one, its element. A leg shows up to four routes, then ",[21,1284,1285],{},"+N more routes",[45,1287,1288,1291,1292,1295,1296,1298,1299,164],{},[21,1289,1290],{},"Small bones."," Under a route, in this order: the control note and the control that credits it, for example \"detected only · ",[102,1293,1294],{},"control","\" (",[21,1297,987],{}," for more controls), the questions that would settle it (amber, starting \"?\"), the evidence label, and how many exposures it carries. A route shows up to three, then ",[21,1300,1301],{},"+N more",[45,1303,1304,1306],{},[21,1305,944],{}," A present leg or route is drawn solid, an undetermined one dashed amber, an absent one faded. Colour never carries the state alone: each leg's state is written in its label, and each route's in the leg's details.",[14,1308,1309,1310,856,1312,24,1314,1316,1317,1319,1320,1322,1323,142,1325,24,1327,1329],{},"Click any part, or move to it with ",[21,1311,855],{},[21,1313,859],{},[21,1315,862],{},". Each part opens a dialog; see ",[213,1318,649],{"href":648},". The head opens the finding in full. A leg, route or small bone opens the leg dialog; see ",[213,1321,649],{"href":648},". An element name opens the element's profile. A question opens its next step, ",[21,1324,1157],{},[21,1326,1213],{},[21,1328,1216],{},". The diagram keeps a question's short text; the dialogs give the attribute's title. From the leg, an exposure opens with its description.",[14,1331,1332,1335,1336,1339,1340,1343],{},[21,1333,1334],{},"Show where a fix cuts:"," above the diagram lists the fixes that break or downgrade the finding. A partial fix is not listed: it narrows its routes and cuts none. Click one to draw a ",[21,1337,1338],{},"cut"," mark on the bone it breaks; click it again to remove it. A fix that cuts more than one kind of route on a leg draws the cut on the rib of each of them. A link from the ",[213,1341,148],{"href":1342},"#fixes"," tab opens the finding with its change already selected.",[14,1345,786,1346,1348],{},[21,1347,141],{}," tab shows the same diagram under each top finding, and the exported sheet carries it as a static picture.",[820,1350,1352],{"id":1351},"fixes-on-a-finding","Fixes on a finding",[14,1354,1355,1356,142,1359,142,1362,655,1365,1368],{},"Each fix names the change, the element it lands on and its owner. It says what the fix does to this finding: ",[21,1357,1358],{},"breaks this finding alone",[21,1360,1361],{},"downgrades it to Not ruled out",[21,1363,1364],{},"clears it: no longer raised once set",[21,1366,1367],{},"does not break it alone",". A fix counts as breaking a finding only when a required leg becomes absent once the fix is applied.",[14,1370,1371,1374],{},[21,1372,1373],{},"Who holds a fix."," Who can make a change depends on two things: who runs the element it lands on, and what the change touches. A change can touch a setting the element offers you, the element's own software, or the environment the element runs in. A setting is always yours. The element's own software belongs to whoever runs the element. The environment belongs to whoever runs the boundary the element is drawn in, when that boundary says so; otherwise to whoever runs the element. So a fix is one of three kinds:",[308,1376,1379],{"className":1377,"tabIndex":312,"role":313,"ariaLabel":1378},[311],"Table: Fixes on a finding",[316,1380,1381,1396],{},[319,1382,1383],{},[322,1384,1385,1388,1391,1394],{},[325,1386,1387],{},"Kind",[325,1389,1390],{},"Chip beside the owner",[325,1392,1393],{},"The owner reads",[325,1395,330],{},[338,1397,1398,1422,1444],{},[322,1399,1400,1405,1408,1419],{},[343,1401,1402],{},[21,1403,1404],{},"Change",[343,1406,1407],{},"none",[343,1409,1410,1411,1414,1415,1418],{},"A role, such as \"operator of the agent\". On an element a vendor runs: \"you, through the settings the vendor offers for ",[102,1412,1413],{},"element",": ",[102,1416,1417],{},"settings","\"",[343,1420,1421],{},"You can make it, and it does what its line says",[322,1423,1424,1429,1434,1441],{},[343,1425,1426],{},[21,1427,1428],{},"Partial",[343,1430,1431],{},[21,1432,1433],{},"partial: narrows, does not close",[343,1435,1436,1437,1414,1439,1418],{},"\"you, in part, through the settings the vendor offers for ",[102,1438,1413],{},[102,1440,1417],{},[343,1442,1443],{},"You set it through what the vendor offers, but it only narrows the routes. On its own it does not break, downgrade or clear the finding",[322,1445,1446,1451,1456,1472],{},[343,1447,1448],{},[21,1449,1450],{},"The vendor's",[343,1452,1453],{},[21,1454,1455],{},"compensate or accept",[343,1457,1458,1459,1461,1462,1465,1466,1461,1469,1471],{},"\"the vendor of ",[102,1460,1413],{}," (",[102,1463,1464],{},"product",")\", or \"the vendor running ",[102,1467,1468],{},"boundary",[102,1470,1464],{},")\"",[343,1473,1474],{},"Only the vendor can make it. Compensate where you hold a lever, or accept the risk",[14,1476,1477,1478,1480],{},"The product shows only where the model records one. A fix whose elements read differently, for example one you run and one you set through a vendor's settings, shows both owner phrases joined by \"; \". When you run the boundary a vendor's element is drawn in, a change to its environment is yours, and the owner ends \"you run ",[102,1479,1468],{},"\".",[14,1482,1483,1486,1487,1490],{},[21,1484,1485],{},"A partial fix"," reads \"narrows, does not close; if it cut those routes it would break this finding\" (or downgrade it, or clear it). That is what it would do if it closed the routes. It does not close them. Under it, ",[21,1488,1489],{},"what stays open:"," names what remains, for example \"what the signed-in user can reach stays readable to it\". It may also carry a question to put to the vendor.",[14,1492,1493,1496],{},[21,1494,1495],{},"A fix the vendor holds"," names the vendor. Under it you may see:",[42,1498,1499,1502],{},[45,1500,1501],{},"a question to put to the vendor, for example \"Ask the vendor how the agent's outbound requests are restricted\";",[45,1503,1504,1507],{},[21,1505,1506],{},"compensate where you hold a lever:"," and the finding's fixes on its other legs that are yours, with their legs. These are the changes you can make on this finding while this one stays with the vendor.",[14,1509,1510,1513,1514,1516,1517,1520,1521,1525],{},[21,1511,1512],{},"who holds it depends on:"," A fix can carry this amber line when the model does not say who runs an element, and the answer could change who holds the fix. Click ",[21,1515,1157],{}," and answer ",[21,1518,1519],{},"Operated by"," on the element it names; see ",[213,1522,1524],{"href":1523},"#answer-who-runs-an-element","Answer who runs an element",". The question takes one of these forms:",[42,1527,1528,1534,1545,1551],{},[45,1529,1530,1531,1533],{},"\"who builds or runs ",[102,1532,1413],{},"'s own software? Answer Operated by, under Operation & version in its class attributes\"",[45,1535,1418,1536,1538,1539,1541,1542,1544],{},[102,1537,1413],{}," sits in ",[102,1540,1468],{},", run by the vendor: who runs ",[102,1543,1413],{}," itself? Answer Operated by, under Operation & version\"",[45,1546,1547,1548,1550],{},"\"who runs the environment of what is drawn in ",[102,1549,1468],{},"? Answer Operated by, under Operation\"",[45,1552,1553,1554,1556,1557,1559],{},"\"classify ",[102,1555,1413],{},", then answer who runs it\", or \"classify ",[102,1558,1468],{},", then answer who runs its environment\", when it has no class yet",[14,1561,1562,1563,164],{},"A fix on a setting never asks: a setting is yours whoever runs the element. These questions show on the fix, not on ",[21,1564,73],{},[14,1566,1567,1568,1571,1572,1575,1576,1578,1579,1461,1582,1584,1585,1588],{},"When no single change settles a leg, a line names the changes that settle it together, and says whether together they break the finding. A partial part ends ",[21,1569,1570],{},"narrows, does not close",", and a combination with one does not break the finding: its line reads \"",[102,1573,1574],{},"leg",", all together (does not break it: a lever only narrows its route):\". When the combination falls short for another reason, it reads \"does not break it: another route stays undetermined\". When one of the routes can only be closed by the vendor, there is no combination. The route is named instead: \"",[102,1577,1574],{}," ",[102,1580,1581],{},"route",[102,1583,1413],{},"): its only fix is the vendor's: compensate or accept (",[102,1586,1587],{},"vendor",")\".",[820,1590,1524],{"id":1591},"answer-who-runs-an-element",[14,1593,1594,1595,1597,1598,1601,1602,1605,1606,1609,1610,24,1613,164],{},"Who runs an element comes from its ",[21,1596,1519],{}," field. It sits in the last panel of the element's ",[21,1599,1600],{},"Attributes"," tab: ",[21,1603,1604],{},"Operation & version"," on a component, ",[21,1607,1608],{},"Operation"," on a boundary. The panel shows once the element has a class. Choose ",[21,1611,1612],{},"You (your organisation)",[21,1614,1615],{},"A vendor",[42,1617,1618,1630,1636],{},[45,1619,1620,1623,1624,1626,1627,1629],{},[21,1621,1622],{},"On a component",", it says who builds or runs the element's own software. Choose ",[21,1625,1615],{}," for a hosted service you only configure. Choose ",[21,1628,1612],{}," for something you build or run, also on a vendor's platform.",[45,1631,1632,1635],{},[21,1633,1634],{},"On a boundary",", it says who runs the environment of what is drawn directly in it: the hosts or the platform runtime. Draw each element directly in the boundary that runs its environment. The canvas itself never speaks for an environment.",[45,1637,1638,1641],{},[21,1639,1640],{},"Product"," names the vendor and product. A fix the vendor holds shows it after the vendor.",[14,1643,1644,1647,1648,1650],{},[21,1645,1646],{},"Leave it empty unless you know."," Do not guess. An empty field is read from the zone instead: an element in a ",[21,1649,817],{}," zone counts as the vendor's, any other as yours. Each fix whose holder depends on it then asks, so the open answer stays visible. A guess would hide it, and the fix would rest on it. A value other than the two choices, for example from an imported model, counts as yours, and the fixes ask about it too.",[14,1652,1653],{},"A flow has no field of its own. It counts as the vendor's only when every element it connects is. A data item is always yours.",[14,1655,108,1656,1658,1659,164],{},[21,1657,137],{}," after you answer. The fixes then follow your answers. The full guidance on the panel is in ",[213,1660,1604],{"href":1661},"\u002Fplatform\u002Fcomponent-configuration-guide#operation-version",[820,1663,649],{"id":1664},"dialogs",[14,1666,1667,1668,142,1670,24,1672,1674,1675,1677,1678,1680,1681,164],{},"A finding, a leg, an element exposure, an element, a MITRE technique, a part of an exposure's map and a question's next step (",[21,1669,1157],{},[21,1671,1213],{},[21,1673,1216],{},") open as dialogs over the tab you are on. You open them from the diagram, an ",[21,1676,983],{}," chip, an element name, an exposure inside a finding, ",[21,1679,1248],{}," on an expanded exposure row, a technique id, an exposure's map, or a link on ",[21,1682,151],{},[14,1684,1685,1688,1689,1691,1692,1695,1696,1698,1699,1702],{},[21,1686,1687],{},"Dialogs stack."," A dialog opened from another opens over it: a finding, then an exposure inside it, then the exposure's element, or a leg, then ",[21,1690,1157],{},". The dialog on top offers ",[21,1693,1694],{},"Back to"," and the name of the dialog under it. A long name ends in an ellipsis; hover over the button to read it in full. Click it, press ",[21,1697,1094],{}," or click outside the dialog to go back one. ",[21,1700,1701],{},"Close"," closes them all. If you open something that is already open lower down, you go back to it. It does not open twice.",[14,1704,1705,1708,1709,1711,1712,1714,1715,1718,1719,1722,1723,1726,1727,1729,1730,1733,1734,1736,1737,1739],{},[21,1706,1707],{},"The finding dialog"," shows the finding in full. It opens from the diagram's head, an ",[21,1710,983],{}," chip, a link on ",[21,1713,151],{},", or an exposure's ",[21,1716,1717],{},"Part of",". Under ",[21,1720,1721],{},"The pattern"," it says what each leg means, required legs first, then the aggravating ones. Under ",[21,1724,1725],{},"This finding"," it shows what the expanded row on ",[21,1728,145],{}," shows: see ",[213,1731,1106],{"href":1732},"#expand-a-finding",". That includes the diagram with ",[21,1735,1334],{},", and the next step on each ",[21,1738,626],{}," line. In this dialog the diagram's head opens nothing.",[14,1741,1742,1745,1746,1749,1750,805,1752,1755],{},[21,1743,1744],{},"The leg dialog"," opens from a leg, route or small bone on the diagram. Under the title, it says why the leg is present, undetermined or absent. ",[21,1747,1748],{},"What this means"," gives the leg's letter and name, what the leg means, what its state means, what its credit means when a control credits it, and what its role means. These are the same words as a leg mark's tooltip on ",[21,1751,145],{},[21,1753,1754],{},"Routes"," then lists each route with its evidence, the controls that credit it, its exposures and its questions, each attribute by its title and each question with its next step. The fixes that act on the leg come last.",[14,1757,1758,1759,1761,1762,1765,1766,1769,1770,1773],{},"Each credit reads \"credited by ",[102,1760,1294],{}," · prevention · ",[102,1763,1764],{},"technique","\", or detection, then says how it was earned (see ",[21,1767,1768],{},"Controls"," in ",[213,1771,461],{"href":1772},"#read-a-finding","):",[42,1775,1776,1782,1788],{},[45,1777,1778,1781],{},[21,1779,1780],{},"Through an edge",", named by the platform's relation, for example: through its countermeasure's DETECTS edge, which reads as detection.",[45,1783,1784,1787],{},[21,1785,1786],{},"Through a mitigation",", for example: through mitigation M1050 Exploit Protection, which the credit table classes as prevention. The next line quotes the mitigation's MITRE description: MITRE: \"…\".",[45,1789,1790,1793,1794,1797],{},[21,1791,1792],{},"Through a mitigation the table does not hold",": through mitigation ",[102,1795,1796],{},"id",", which the credit table does not hold, so it credits detection.",[14,1799,1800],{},"Click the technique in a credit to open its dialog.",[14,1802,1803,1806,1807,142,1809,142,1811,66,1813,1815,1816,1820,1821,1718,1823,1826,1827,142,1830,66,1833,1836,1837,1839],{},[21,1804,1805],{},"The exposure dialog"," shows what the platform holds about the exposure. Beside the element's name under the title are ",[21,1808,1234],{},[21,1810,1224],{},[21,1812,225],{},[21,1814,228],{},"; see ",[213,1817,1819],{"href":1818},"#affirm-or-disposition-an-exposure","Affirm or disposition an exposure",". Under them, beside the exposure's state, a chip gives its disposition in words; see ",[213,1822,1205],{"href":1204},[21,1824,1825],{},"Techniques",", each technique shows its id and name, which open the technique's dialog, its framework, the technique it is part of, its tactics, the first lines of its description and its MITRE mitigations. The dialog does not list the countermeasures of those MITRE mitigations. ",[21,1828,1829],{},"Mitigation suggestions",[21,1831,1832],{},"Detection methods",[21,1834,1835],{},"References"," follow, each only when the exposure has some. Under ",[21,1838,1717],{}," it lists the findings the exposure sits inside. Click one to open that finding's dialog.",[14,1841,1842,1845],{},[21,1843,1844],{},"Why the platform raises it"," shows the rule behind the exposure, from the platform's knowledge graph, and how it reads this element. It explains why the rule raises the exposure; it is not a verdict on the element.",[42,1847,1848,1858,1864,1897],{},[45,1849,1850,1853,1854,1857],{},[21,1851,1852],{},"The map."," For each threat behind the rule, a map is drawn from top to bottom: the attributes the rule reads, the rule, the threat, and the sources the threat cites. With no threat recorded, the map shows the rule alone. The attributes of a condition group that holds on the element are drawn bold as the cause; the rest are the rule's other inputs, as a legend line says. The threat's techniques sit in a dashed chip beside the rule, marked ",[21,1855,1856],{},"provisional · Dethernety synthesis",": the mapping is the knowledge graph's, not MITRE's. Many techniques wrap into rows inside the chip. A map is drawn only when one of the rule's condition groups holds on the element.",[45,1859,1860,1863],{},[21,1861,1862],{},"Open a part of the map."," Click an attribute, the rule, a threat or a source to open its dialog over the exposure's. Click a technique id in the map to open the technique's dialog.",[45,1865,1866,1869,1870,1873,1874,1878,1879,1882,1883,1886,1887,142,1890,24,1893,1896],{},[21,1867,1868],{},"The text under the map."," The rule's name, then what the rule says, then ",[21,1871,1872],{},"It reads:"," and the attributes it reads. Each condition group follows in words, with its verdict and the element's own values, for example \"Group 1 holds on this element: ",[1875,1876,1877],"code",{},"egress"," eq ",[1875,1880,1881],{},"open"," (here: egress = open)\". The attribute and operator read as the rule states them; an attribute the element has no value for reads \"",[102,1884,1885],{},"attribute",": value not recorded\". A verdict is ",[21,1888,1889],{},"holds on this element",[21,1891,1892],{},"does not hold",[21,1894,1895],{},"cannot be decided from the recorded values",". The rule raises the exposure when any one group holds, and a group holds when every condition in it does. Each threat behind the rule follows with its attack surface, its techniques, each opening its dialog, and its sources.",[45,1898,1899,1902,1903,1905],{},[21,1900,1901],{},"With the keyboard."," The map is one picture; a screen reader reads the chain in words. The rule's name, each attribute after ",[21,1904,1872],{}," and each threat's name in the text are buttons that open the same dialogs as the map.",[14,1907,1908,1909,1911],{},"When the knowledge graph is not installed or could not be reached, the platform's knowledge-graph access does not include this request, the platform's knowledge-graph version does not include the element's class, it has no rule of this name for the element's class, the element is not an instance of a class, the exposure was added by hand, or the rule could not be read from the platform, one line says so instead, and no map is drawn. After ",[21,1910,137],{},", the dialog reads the reasoning afresh, so it shows the element's values as they are now.",[14,1913,1914,1917],{},[21,1915,1916],{},"A dialog from the map"," shows one part of it:",[308,1919,1922],{"className":1920,"tabIndex":312,"role":313,"ariaLabel":1921},[311],"Table: Dialogs",[316,1923,1924,1933],{},[319,1925,1926],{},[322,1927,1928,1930],{},[325,1929,1017],{},[325,1931,1932],{},"The dialog shows",[338,1934,1935,1949,1959,1969],{},[322,1936,1937,1942],{},[343,1938,1939],{},[21,1940,1941],{},"An attribute",[343,1943,1944,1945,1948],{},"Its title and description as the rule reads it, the element's value or ",[21,1946,1947],{},"no value recorded",", and the condition groups that read it, each with its verdict",[322,1950,1951,1956],{},[343,1952,1953],{},[21,1954,1955],{},"The rule",[343,1957,1958],{},"What the rule says, and every condition group with its verdict and the element's values",[322,1960,1961,1966],{},[343,1962,1963],{},[21,1964,1965],{},"A threat",[343,1967,1968],{},"Its attack surface, description, techniques (each opening the technique's dialog) and sources",[322,1970,1971,1976],{},[343,1972,1973],{},[21,1974,1975],{},"A source",[343,1977,1978],{},"Its link, noted as opening outside the product. A source with no web address shows its text instead",[14,1980,1981,1984,1985,1988,1989,387,1992,1578,1995,1997,1998,2001,2002,2005,2006,2008,2009,2012,2013,2016,2017,2020,2021,142,2024,142,2027,24,2030,2033,2034,142,2036,142,2038,66,2040,2042,2043,2045],{},[21,1982,1983],{},"The element dialog"," opens from an element name anywhere and shows the element's profile. A crown jewel reads ",[21,1986,1987],{},"★ crown jewel"," in the title. Zones read as the model editor names them, for example \"zone Public (Internet-facing)\". Under the title, a line names the element's class and the module that provides it: \"",[102,1990,1991],{},"class",[102,1993,1994],{},"module",[102,1996,252],{},"\". An element that is not an instance of a class reads ",[21,1999,2000],{},"No class: the element is not an instance of a class",". Under the element's description, ",[21,2003,2004],{},"About the class"," gives the class's description, when it has one. If the platform cannot be read, the class line and ",[21,2007,2004],{}," are left out. Beside the profile, a small map of the model shows the element highlighted: a data flow with both its ends, a boundary, or for a data item the elements that handle it. Crown jewels carry a star. The line under the map says what is highlighted, and the expand button opens the map larger. Under ",[21,2010,2011],{},"In this analysis"," the dialog lists the systemic findings at the element (",[21,2014,2015],{},"here","), then those with a route through it (",[21,2018,2019],{},"through here","), each with its state, then the element's exposures, each with its severity as a coloured chip: ",[21,2022,2023],{},"critical",[21,2025,2026],{},"high",[21,2028,2029],{},"medium",[21,2031,2032],{},"low",", in the same colours as in Risk Assessment. An exposure with a disposition also carries its disposition chip. Each exposure row ends with ",[21,2035,1234],{},[21,2037,1224],{},[21,2039,225],{},[21,2041,228],{},". Click an exposure to open its dialog over the profile. When the model cannot be read, the profile says so, and the descriptions and ",[21,2044,2011],{}," still show.",[14,2047,2048,2051,2052,24,2054,2056,2057,2059,2060,24,2063,2066,2067,387,2069,2071,2072,2078,2079,2082,2083,2086],{},[21,2049,2050],{},"The technique dialog"," opens from a technique id: under ",[21,2053,1825],{},[21,2055,1844],{}," in an exposure dialog (its map included), in a threat's dialog from the map, on an expanded exposure row on ",[21,2058,145],{},", or in a leg dialog's credit. Above the title it reads ",[21,2061,2062],{},"ATT&CK technique",[21,2064,2065],{},"ATLAS technique",", and the title is \"",[102,2068,1796],{},[102,2070,1167],{},"\". Under the title are its tactics and the technique it is part of. Click that technique to open its dialog over this one. Then come the technique's description and its MITRE mitigations, and the link ",[21,2073,2074,2075,2077],{},"Open ",[102,2076,1796],{}," on attack.mitre.org"," (or ",[21,2080,2081],{},"atlas.mitre.org","). The last line reads: \"The name, description, tactics and mitigations are MITRE's. That this technique belongs to the exposure or leg it was opened from is the class's or the pattern pack's mapping, not MITRE's.\" When the platform cannot supply the technique, the dialog reads ",[21,2084,2085],{},"No description is available for this technique here."," and still shows the id and its link. An id that is not a well-formed ATT&CK or ATLAS technique id stays plain text and opens nothing.",[14,2088,2089,2092,2093,2096,2097,2099],{},[21,2090,2091],{},"Open in Findings."," A finding, leg or exposure dialog has ",[21,2094,2095],{},"Open in Findings",". It closes all dialogs and opens the row on the ",[21,2098,145],{}," tab, expanded and scrolled into view. For a leg, that is its finding's row. Filters are cleared only when they hide the row.",[30,2101,148],{"id":2102},"fixes",[14,2104,786,2105,2107,2108,2111],{},[21,2106,148],{}," tab ranks the changes across the whole model. Changes are grouped by what they change, who owns it and their kind, strongest first: findings broken, then Confirmed findings downgraded to Not ruled out, then findings cleared. Partial fixes come after every change. See ",[213,2109,1352],{"href":2110},"#fixes-on-a-finding"," for the kinds.",[42,2113,2114,2124,2138,2151,2157],{},[45,2115,2116,2119,2120,2123],{},[21,2117,2118],{},"A group"," shows the change, its ",[21,2121,2122],{},"owner"," and the elements it lands on. It counts every finding any of its elements breaks, each once, out of the total, for example \"breaks 3 of 7 findings; downgrades 1 of 7 to Not ruled out\".",[45,2125,2126,2129,2130,2133,2134,2137],{},[21,2127,2128],{},"Elements."," Under the group's header, a line names three elements, then ",[21,2131,2132],{},"and N more",". Click it to show them all; it then reads ",[21,2135,2136],{},"show fewer",". A group on a single element names it.",[45,2139,2140,2143,2144,2147,2148,2150],{},[21,2141,2142],{},"Click a group"," to see its elements. Each element has its effect line, for example \"breaks 1 of 27 findings:\", and under it the findings the change reaches there. Each finding is a link that reads \"",[102,2145,2146],{},"finding"," at ",[102,2149,1413],{},"\". Where the change reaches that element's findings in more than one way, each link names its effect: \"breaks\", \"downgrades to Not ruled out\" or \"clears\".",[45,2152,2153,2156],{},[21,2154,2155],{},"or instead:"," A group whose broken findings are all broken by a stronger group shows under that group. It reads \"breaks the same N\" when it breaks the same findings, or \"breaks K of those\" when it breaks fewer. A change that breaks nothing (it only downgrades or clears) always stands alone. Click an alternative to open it the same way as a group.",[45,2158,2159,2162,2163,2165],{},[21,2160,2161],{},"Partial fixes"," carry the chip ",[21,2164,1433],{}," beside the owner. Their line reads \"narrows, does not close; if it cut those routes it would: breaks 2 of 7 findings\", ranked by what they would do. Their links read \"would break if it cut\", \"would downgrade if it cut\" or \"would clear if it cut\". A partial fix always stands alone, never as an alternative to a change.",[14,2167,2168,2169,2171,2172,2174],{},"Click a finding link to open the finding on the ",[21,2170,145],{}," tab, expanded and scrolled into view. When the change breaks or downgrades the finding, its diagram opens with that change selected under ",[21,2173,1334],{}," and drawn where it cuts. A finding the change only clears, or a partial fix narrows, opens with no change selected. Neither is drawn as a cut.",[14,2176,2177,2178,2180,2181,2183],{},"The address keeps the finding and its change while you stay on ",[21,2179,145],{},", so a reload or a shared address opens them again. If the change no longer applies to that finding, for example after you generate again, the finding opens with no change selected. Switching tabs clears the address, so coming back to ",[21,2182,145],{}," opens nothing.",[14,2185,2186,2187,2189],{},"A fix the vendor holds reads ",[21,2188,1455],{},". It is not ranked on this tab; it shows on its finding, with the vendor named. The footer says so: \"A fix the vendor holds is compensate or accept, not ranked here; it shows on its finding. A partial fix only narrows its routes: it is listed after the changes, by what it would do if it cut them.\"",[14,2191,2192,2193,2195,2196,164],{},"A finding link also carries ",[21,2194,1224],{}," when the finding lists the change as one of its own fixes. It raises an issue for that fix. See ",[213,2197,1229],{"href":1228},[30,2199,1229],{"id":2200},"raise-an-issue",[14,2202,2203,2204,2206],{},"Turn a finding, a fix or an exposure into a tracked issue, so the work it calls for gets an owner. The issue is a platform issue like any other: you edit, assign and close it on the issue board. Raising an issue does not change the finding. Only a change to the model, then ",[21,2205,137],{},", does that.",[14,2208,2209],{},[21,2210,2211],{},"Where to find ＋ Issue:",[42,2213,2214,2223,2235],{},[45,2215,2216,2219,2220,2222],{},[21,2217,2218],{},"A systemic finding",": beside the pattern's reason, at the top of an expanded row on ",[21,2221,145],{}," and in the finding dialog.",[45,2224,2225,2228,2229,2231,2232,2234],{},[21,2226,2227],{},"A fix",": beside each fix under ",[21,2230,148],{}," in an expanded finding or the finding dialog, and beside a finding link under a change on the ",[213,2233,148],{"href":1342}," tab.",[45,2236,2237,2240,2241,2243],{},[21,2238,2239],{},"An element exposure",": beside each exposure under ",[21,2242,2011],{}," in the element dialog, and beside the element's name under the title of the exposure dialog.",[14,2245,2246],{},[21,2247,2248],{},"To raise an issue:",[86,2250,2251,2260,2278],{},[45,2252,108,2253,2255,2256,2259],{},[21,2254,1224],{},". The platform's ",[21,2257,2258],{},"Raise an issue from this finding"," dialog opens, with the name of what you raise it from.",[45,2261,2262,2263],{},"Choose one:\n",[42,2264,2265,2271],{},[45,2266,2267,2270],{},[21,2268,2269],{},"Add to Issue board"," copies the issue to the issue board and takes you there.",[45,2272,2273,2274,2277],{},"An issue class under ",[21,2275,2276],{},"Or create an issue:"," creates the issue now and opens it for you to edit.",[45,2279,2280],{},"If you created an issue, close it when you are done editing.",[14,2282,2283,2284,24,2287,2290,2291,2294],{},"A message at the bottom of the analysis reports the outcome: ",[21,2285,2286],{},"Issue created.",[21,2288,2289],{},"Copied to the issue board."," If you click ",[21,2292,2293],{},"Cancel",", nothing is raised and no message shows.",[14,2296,2297,2300],{},[21,2298,2299],{},"Where the issue lands."," The issue is attached to one element of the model:",[308,2302,2305],{"className":2303,"tabIndex":312,"role":313,"ariaLabel":2304},[311],"Table: Raise an issue",[316,2306,2307,2317],{},[319,2308,2309],{},[322,2310,2311,2314],{},[325,2312,2313],{},"You raise it from",[325,2315,2316],{},"The issue is attached to",[338,2318,2319,2327,2334],{},[322,2320,2321,2324],{},[343,2322,2323],{},"A finding",[343,2325,2326],{},"The element the finding is at",[322,2328,2329,2331],{},[343,2330,2227],{},[343,2332,2333],{},"The element the fix lands on, when it lands on exactly one. Otherwise the element its finding is at",[322,2335,2336,2338],{},[343,2337,2239],{},[343,2339,2340],{},"The exposure's element",[14,2342,2343],{},"When there is no such element, the issue is attached to the model itself.",[14,2345,2346,2349,2350,2352],{},[21,2347,2348],{},"What the issue says."," Its name is the finding's title, the fix's change or the exposure's name, followed by \"Issue on ",[102,2351,1413],{},"\". The description depends on what you raise it from:",[42,2354,2355,2360,2365],{},[45,2356,2357,2359],{},[21,2358,2323],{}," carries a plain-text summary that starts \"Threat Patterns finding:\". It names the finding and the element it is at, Confirmed or Not ruled out, the severity, and each leg's state. It ends with the first fix that breaks or downgrades the finding: the change, its owner, where it lands and what it does.",[45,2361,2362,2364],{},[21,2363,2227],{}," carries a summary that starts \"Threat Patterns fix:\". It gives the fix first, then the finding it acts on.",[45,2366,2367,2369],{},[21,2368,2239],{}," carries the platform's own description, \"Exposure:\" and the exposure's name.",[14,2371,2372],{},"A summary is at most 400 characters. A longer one is cut short with an ellipsis.",[14,2374,2375,2376,2378,2379,2382,2383,164],{},"If ",[21,2377,1224],{}," is greyed out, hover over it. ",[21,2380,2381],{},"Unavailable — the host platform is too old for issue actions"," means your platform does not offer issues to Threat Patterns yet. Ask your administrator to upgrade it. When it is available, the tooltip reads ",[21,2384,2385],{},"Create or link a tracked issue",[30,2387,1239],{"id":2388},"record-a-finding-or-an-exposure-as-a-risk",[14,2390,2391,2392,2396,2397,2206],{},"Record a systemic finding or an element exposure in Risk Assessment's risk register, so the risk behind it gets an assessment, an owner and a treatment decision. You do not need to open a Risk Assessment analysis for this. The risk lives in the register like any other risk: you rate it, decide its treatment, accept it and close it there. See ",[213,2393,2395],{"href":2394},"\u002Frisk-assessment\u002Fthe-risk-register","The Risk Register",". Recording a risk does not change the finding or the exposure. Only a change to the model, then ",[21,2398,137],{},[14,2400,2401,2402,2404,2405,164],{},"You need Risk Assessment on your platform. Without it, ",[21,2403,1234],{}," is greyed out, and its tooltip says why; see ",[213,2406,2408],{"href":2407},"#troubleshooting","Troubleshooting",[820,2410,2412],{"id":2411},"where-to-find-risk","Where to find ＋ Risk",[14,2414,2415,2417,2418,2420],{},[21,2416,1234],{}," always sits just before ",[21,2419,1224],{},":",[42,2422,2423,2429],{},[45,2424,2425,2219,2427,2222],{},[21,2426,2218],{},[21,2428,145],{},[45,2430,2431,2240,2433,2435,2436,2438,2439,2441,2442,2444],{},[21,2432,2239],{},[21,2434,2011],{}," in the element dialog, and beside the element's name under the title of the exposure dialog. An expanded exposure row on ",[21,2437,145],{}," has no ",[21,2440,1234],{},". Click ",[21,2443,1248],{}," to reach its dialog.",[14,2446,2447,2448,164],{},"Fixes have no ",[21,2449,1234],{},[14,2451,2452,2453,2455],{},"Beside ",[21,2454,1234],{},", a chip names each risk the finding or exposure already feeds: its reference handle, status and treatment, for example \"DT-CS-260717-4 · open · undecided\". The chips are read only. To change a risk, open it in the register.",[14,2457,2458,2459,2462,2463,2465,2466,2468,2469,1769,2471,2473],{},"An exposure's chip ends in ",[21,2460,2461],{},"· dispositioned",", in amber, when the exposure has a disposition on the platform other than Affirmed: Risk Accepted, Compensating Control, Not Applicable, False Positive or Superseded. The platform then no longer counts the exposure as live. The risk is unchanged; open it in the register and decide whether it still stands. The marks are read again each time the register is read, and after ",[21,2464,137],{},". This mark is wider than the triage ",[21,2467,301],{}," under ",[21,2470,291],{},[213,2472,461],{"href":1772},": it covers accepted and compensate too.",[820,2475,2477],{"id":2476},"record-a-new-risk","Record a new risk",[86,2479,2480,2489,2496,2511,2529],{},[45,2481,108,2482,2484,2485,2488],{},[21,2483,1234],{},". A dialog opens, headed ",[21,2486,2487],{},"Risk register"," and the finding at its element, or the exposure on its element.",[45,2490,2491,2492,2495],{},"Keep ",[21,2493,2494],{},"Record as risk…"," selected.",[45,2497,2498,2499,164,2503,2506,2507,2510],{},"Check the three parts of the risk statement. Each is filled in from what you clicked, and you can edit it. See ",[213,2500,2502],{"href":2501},"#what-the-risk-statement-starts-with","What the risk statement starts with",[2504,2505],"br",{},"Each part holds at most 400 characters. A longer text is cut short with an ellipsis. ",[21,2508,2509],{},"Record risk"," stays greyed out while a part is empty.",[45,2512,2513,2514,2517,2518,2521,2522,2525,2526,164],{},"Optional: choose a ",[21,2515,2516],{},"Likelihood"," (Rare, Possible, Likely, Almost certain) and an ",[21,2519,2520],{},"Impact rating"," (Low, Medium, High, Critical), and enter an ",[21,2523,2524],{},"Owner",". The two ratings start at ",[21,2527,2528],{},"Not assessed",[45,2530,108,2531,2533,2534,2537,2538,164],{},[21,2532,2509],{},". The dialog closes, and a message at the bottom of the analysis reads ",[21,2535,2536],{},"Risk recorded."," A chip for the new risk appears beside ",[21,2539,1234],{},[14,2541,2542,2543,2546],{},"The treatment starts as ",[21,2544,2545],{},"Undecided",". Decide it, and accept the risk, in Risk Assessment's register.",[820,2548,2502],{"id":2549},"what-the-risk-statement-starts-with",[14,2551,2552,2553,2420],{},"For a ",[21,2554,2555],{},"systemic finding",[42,2557,2558,2564,2570],{},[45,2559,2560,2563],{},[21,2561,2562],{},"Cause",": what each present leg means, then the legs not yet determined, by name.",[45,2565,2566,2569],{},[21,2567,2568],{},"Event",": the finding at its element, with Confirmed or Not ruled out.",[45,2571,2572,2575],{},[21,2573,2574],{},"Impact",": the reason for the finding's severity.",[14,2577,2578,2579,2420],{},"For an ",[21,2580,2581],{},"element exposure",[42,2583,2584,2598,2614],{},[45,2585,2586,2588,2589,2591,2592,2594,2595,2597],{},[21,2587,2562],{},": the rule that raises the exposure, from the platform's knowledge graph, and what the rule says. Until the rule is read, or when there is no rule, it says only what is known: \"A person added this exposure to ",[102,2590,1413],{}," by hand.\" for an exposure a person added, \"It is on ",[102,2593,1413],{},", which is not an instance of a class.\" when the element has no class, and otherwise \"The platform raises this exposure on ",[102,2596,1413],{},".\"",[45,2599,2600,2602,2603,2606,2607,2609,2610,2613],{},[21,2601,2568],{},": \"",[102,2604,2605],{},"exposure"," on ",[102,2608,1413],{}," (Threat Patterns element exposure, severity ",[102,2611,2612],{},"severity",").\"",[45,2615,2616,2618,2619,2621,2622,1461,2625,142,2627,2630,2631,2597],{},[21,2617,2574],{},": the threats behind the rule, as \"Threats: …\". When the exposure sits inside a finding that a fix on the exposure's element breaks or downgrades, the fix follows, as \"Fix, for the finding \"",[102,2620,2146],{},"\": ",[102,2623,2624],{},"change",[102,2626,2122],{},[102,2628,2629],{},"what it does to the finding",").\" With neither, it reads \"Severity ",[102,2632,2612],{},[14,2634,2635,2636,66,2638,2640],{},"The rule and its threats arrive a moment after the dialog opens, once they are read. They fill ",[21,2637,2562],{},[21,2639,2574],{}," only where you have not edited the text yet. Your own words stay.",[820,2642,2644],{"id":2643},"add-the-finding-or-exposure-to-a-risk","Add the finding or exposure to a risk",[86,2646,2647,2651,2657,2667],{},[45,2648,108,2649,164],{},[21,2650,1234],{},[45,2652,2653,2654,164],{},"Select ",[21,2655,2656],{},"Add to risk…",[45,2658,2659,2660,2663,2664,2666],{},"Under ",[21,2661,2662],{},"Risk",", choose a risk. The list holds the open risks this finding or exposure does not feed yet, each by its reference handle and event. When there is none, ",[21,2665,2656],{}," is greyed out.",[45,2668,108,2669,2672,2673],{},[21,2670,2671],{},"Add evidence",". The finding or exposure is added to the risk as evidence. The risk's own words stay as they are. The dialog closes, and the message reads ",[21,2674,2675],{},"Evidence added.",[14,2677,2678,2679,2682],{},"If someone deleted the risk in the meantime, the message reads ",[21,2680,2681],{},"That risk is no longer in the register."," Nothing is saved, and the list is read again. Choose another risk, or record a new one.",[14,2684,2685,2686,2689,2690,2692],{},"If a save fails for any other reason, the message reads ",[21,2687,2688],{},"Couldn't save the risk."," Nothing is saved, and the dialog stays open so you can try again. Click ",[21,2691,2293],{}," to close the dialog without saving.",[820,2694,2696],{"id":2695},"what-the-register-keeps","What the register keeps",[14,2698,2699],{},"Either way, the finding or exposure is linked to the risk as evidence.",[14,2701,2552,2702,2704],{},[21,2703,2555],{},", the evidence holds:",[42,2706,2707,2710,2713,2716],{},[45,2708,2709],{},"the finding's title at its element, Confirmed or Not ruled out, its severity and the reason for it",[45,2711,2712],{},"the finding's severity and a digest of the finding, both read from Threat Patterns when you save. They let the register tell you later when the finding has changed since you linked it",[45,2714,2715],{},"the analysis the finding came from",[45,2717,2718],{},"links to the element the finding is at (a component or a data item) and to the model. When that element has been deleted from the model since the run, the evidence is linked to the model alone",[14,2720,2721,2722],{},"Threat Patterns reads the finding as it stands before it saves. If it cannot, the message reads ",[21,2723,2724],{},"Couldn't confirm it still stands as shown, so nothing was saved.",[14,2726,2578,2727,2704],{},[21,2728,2581],{},[42,2730,2731,2739,2742,2745],{},[45,2732,2733,2734,2606,2736,2738],{},"the exposure's name, and \"",[102,2735,2605],{},[102,2737,1413],{},"\". When a person added the exposure by hand rather than the platform raising it, the text ends \", added by hand\". Threat Patterns reads who added it from the platform. When it cannot tell, the text makes no claim either way",[45,2740,2741],{},"the exposure's severity and a digest of the exposure, both read from the platform when you save. They let the register tell you later when the exposure has changed or gone since you linked it",[45,2743,2744],{},"the analysis you recorded it from",[45,2746,2747],{},"links to the exposure's element (a component, data item, boundary or data flow) and to the model",[14,2749,2750,2751,171,2753,2755],{},"Threat Patterns saves an exposure only while the platform still holds it on its element as it is. If the exposure is gone, for example because a change to the element removed it, or it cannot be read, nothing is saved and the message reads ",[21,2752,2724],{},[21,2754,137],{}," to see the exposures as they are now.",[820,2757,2759],{"id":2758},"when-risk-is-greyed-out","When ＋ Risk is greyed out",[14,2761,2762,2763,2765,2766,2769,2770,164],{},"Hover over ",[21,2764,1234],{}," to see why. When it is available, the tooltip reads ",[21,2767,2768],{},"Record this finding as a risk, or add it to one",", or on an exposure ",[21,2771,2772],{},"Record this exposure as a risk, or add it to one",[308,2774,2777],{"className":2775,"tabIndex":312,"role":313,"ariaLabel":2776},[311],"Table: When ＋ Risk is greyed out",[316,2778,2779,2788],{},[319,2780,2781],{},[322,2782,2783,2786],{},[325,2784,2785],{},"Tooltip",[325,2787,506],{},[338,2789,2790,2800,2816],{},[322,2791,2792,2797],{},[343,2793,2794],{},[21,2795,2796],{},"Unavailable — the risk register comes with Risk Assessment",[343,2798,2799],{},"Risk Assessment is not installed on your platform",[322,2801,2802,2807],{},[343,2803,2804],{},[21,2805,2806],{},"Unavailable — this platform's Risk Assessment does not take Threat Patterns findings yet",[343,2808,2809,2810,2812,2813,2815],{},"Your Risk Assessment is too old to take Threat Patterns findings. Threat Patterns learns this from the first save it refuses: the same words show as a message and nothing is saved. Click ",[21,2811,2293],{}," to close the dialog. ",[21,2814,1234],{}," on findings then stays greyed out until you open the analysis again",[322,2817,2818,2823],{},[343,2819,2820],{},[21,2821,2822],{},"Unavailable — this platform's Risk Assessment does not take Threat Patterns exposures yet",[343,2824,2825,2826,2828],{},"The same for exposures. Your Risk Assessment may take findings but not yet exposures, so each is learned on its own: ",[21,2827,1234],{}," on findings stays available",[14,2830,2831],{},"In both cases, ask your administrator.",[30,2833,233],{"id":2834},"dispositions-on-exposures",[14,2836,2837,2838,142,2840,142,2843,142,2846,142,2849,24,2852,2855,2856,66,2858,2860,2861,164],{},"A disposition is the platform's verdict on one element exposure: ",[21,2839,599],{},[21,2841,2842],{},"risk accepted",[21,2844,2845],{},"compensating control",[21,2847,2848],{},"false positive",[21,2850,2851],{},"not applicable",[21,2853,2854],{},"superseded",". You set it on the platform, or from this analysis with ",[21,2857,225],{},[21,2859,228],{},". The analysis reads dispositions when it runs, so a change shows only after ",[21,2862,137],{},[820,2864,2866],{"id":2865},"what-a-disposition-does-to-the-analysis","What a disposition does to the analysis",[308,2868,2871],{"className":2869,"tabIndex":312,"role":313,"ariaLabel":2870},[311],"Table: What a disposition does to the analysis",[316,2872,2873,2883],{},[319,2874,2875],{},[322,2876,2877,2880],{},[325,2878,2879],{},"Disposition",[325,2881,2882],{},"In the analysis",[338,2884,2885,2898],{},[322,2886,2887,2895],{},[343,2888,2889,142,2891,142,2893],{},[21,2890,599],{},[21,2892,2842],{},[21,2894,2845],{},[343,2896,2897],{},"The exposure still counts. Accepting or compensating a risk changes no fact in the model. A finding that rests on the exposure names the disposition",[322,2899,2900,2908],{},[343,2901,2902,142,2904,142,2906],{},[21,2903,2848],{},[21,2905,2851],{},[21,2907,2854],{},[343,2909,2910,2911,2913],{},"The exposure is left out of the analysis. A route that rested on it reads absent, with the label ",[21,2912,301],{},", and the exposure is no longer among the exposures inside a finding. If that leaves a required leg absent, the finding is no longer raised",[14,2915,2916],{},"Two kinds of disposition count as none:",[42,2918,2919,2925],{},[45,2920,2921,2924],{},[21,2922,2923],{},"Stale",": the exposure changed after the disposition was set.",[45,2926,2927,2930],{},[21,2928,2929],{},"Unstamped",": no one or no time is recorded for the disposition, because it was set outside the platform's own flow.",[14,2932,2933,2934,164],{},"A disposition acts only on an exposure the platform raised. Some footholds are derived from the model's topology instead, for example an agent that untrusted content reaches and that has a code or file tool. No disposition removes such a foothold. Change the model, then click ",[21,2935,137],{},[820,2937,1205],{"id":2938},"where-a-disposition-shows",[14,2940,2941,2944,2945,2947],{},[21,2942,2943],{},"The disposition chip."," In the exposure dialog, on each exposure row of the element dialog, and on an expanded exposure row on ",[21,2946,145],{},", an exposure with a disposition shows it in words:",[308,2949,2952],{"className":2950,"tabIndex":312,"role":313,"ariaLabel":2951},[311],"Table: Where a disposition shows",[316,2953,2954,2963],{},[319,2955,2956],{},[322,2957,2958,2961],{},[325,2959,2960],{},"Chip",[325,2962,506],{},[338,2964,2965,2973,2984,2994],{},[322,2966,2967,2970],{},[343,2968,2969],{},"The kind alone, for example \"risk accepted\"",[343,2971,2972],{},"The disposition is in force and the exposure still counts",[322,2974,2975,2981],{},[343,2976,1418,2977,2980],{},[102,2978,2979],{},"kind"," · left out of the analysis\"",[343,2982,2983],{},"False positive, not applicable or superseded: the exposure is left out",[322,2985,2986,2991],{},[343,2987,1418,2988,2990],{},[102,2989,2979],{}," · stale, counts as none\"",[343,2992,2993],{},"The exposure changed after the disposition was set",[322,2995,2996,3001],{},[343,2997,1418,2998,3000],{},[102,2999,2979],{}," · unstamped, counts as none\"",[343,3002,3003],{},"No one or no time is recorded for the disposition",[14,3005,3006],{},"In the dialogs, a chip that counts as none is drawn dashed and muted. The words carry the meaning either way.",[14,3008,3009,3012,3013,3015],{},[21,3010,3011],{},"A finding's Dispositions."," An expanded finding, and the finding dialog, end with ",[21,3014,1200],{}," when the finding rests on a dispositioned exposure or left one out. Each line names the exposure and its element, then the disposition, who set it and when, and what it does to this finding:",[42,3017,3018,3028,3036],{},[45,3019,3020,3021,142,3024,3027],{},"\"risk accepted by ",[102,3022,3023],{},"person",[102,3025,3026],{},"time"," · still counted\"",[45,3029,3030,3031,142,3033,3035],{},"\"false positive by ",[102,3032,3023],{},[102,3034,3026],{}," · left out of this finding\"",[45,3037,3038],{},"\"affirmed, unstamped (no one or no time recorded) · counts as none\"",[14,3040,3041],{},"A left-out exposure is no longer among the exposures inside the finding, so this block is where it is named. Click an exposure to open its dialog. A stale disposition is not listed, because it counts as none.",[14,3043,3044,3045,3047],{},"When the finding's foothold is derived from the model's topology, a note under the dispositions says so: \"Its foothold at ",[102,3046,1413],{}," is derived from the model's topology, not raised as a platform exposure, so no disposition removes it.\"",[820,3049,1819],{"id":3050},"affirm-or-disposition-an-exposure",[14,3052,3053,66,3055,3057,3058,66,3060,2420],{},[21,3054,225],{},[21,3056,228],{}," sit just after ",[21,3059,1234],{},[21,3061,1224],{},[42,3063,3064,3067],{},[45,3065,3066],{},"beside the element's name under the title of the exposure dialog",[45,3068,3069,3070,3072],{},"on each exposure row under ",[21,3071,2011],{}," in the element dialog",[14,3074,3075,3076,3078,3079,2444],{},"An expanded exposure row on ",[21,3077,145],{}," has neither. Click ",[21,3080,1248],{},[14,3082,3083,3086,3087,3089],{},[21,3084,3085],{},"To affirm an exposure,"," click ",[21,3088,225],{},". The platform affirms it at once. No dialog opens.",[14,3091,3092],{},[21,3093,3094],{},"To set, change or remove a disposition:",[86,3096,3097,3102],{},[45,3098,108,3099,3101],{},[21,3100,228],{},". The platform's own disposition dialog opens. It starts from the exposure's disposition as the platform holds it now.",[45,3103,3104],{},"Choose a kind, or remove the disposition, and save it in that dialog.",[14,3106,3107],{},"After a save:",[42,3109,3110,3116,3125],{},[45,3111,3112,3115],{},[21,3113,3114],{},"pending Generate"," shows beside the buttons.",[45,3117,3118,3119,1414,3121,3124],{},"A message at the bottom of the analysis reads \"",[102,3120,2605],{},[102,3122,3123],{},"disposition",". This result reads stale until you Generate again.\", for example \"Prompt injection: false positive. This result reads stale until you Generate again.\" A removed disposition reads \"disposition removed\".",[45,3126,3127,3128,3130],{},"The stale banner shows. Until you click ",[21,3129,137],{},", the findings, chips and counts show the last run.",[14,3132,3133],{},"If you cancel the platform's dialog, nothing changes and no message shows.",[14,3135,3136,3137,3143,3144,3147,3148,164],{},"If the platform refuses the change, the message gives its reason: ",[21,3138,3139,3140,164],{},"Couldn't save — ",[102,3141,3142],{},"reason"," If the save fails for any other reason, it reads ",[21,3145,3146],{},"Couldn't save the disposition."," Either way nothing is saved, and the message offers ",[21,3149,3150],{},"Retry",[14,3152,3153,3156,3157,66,3160,164],{},[21,3154,3155],{},"When the buttons are greyed out."," Hover over a button to see why. When they are available, the tooltips read ",[21,3158,3159],{},"Affirm: confirm this exposure is a real, live risk",[21,3161,3162],{},"Disposition… (opens the platform's dialog)",[308,3164,3167],{"className":3165,"tabIndex":312,"role":313,"ariaLabel":3166},[311],"Table: Affirm or disposition an exposure",[316,3168,3169,3177],{},[319,3170,3171],{},[322,3172,3173,3175],{},[325,3174,2785],{},[325,3176,506],{},[338,3178,3179,3192],{},[322,3180,3181,3186],{},[343,3182,3183],{},[21,3184,3185],{},"Already affirmed",[343,3187,3188,3189,3191],{},"On ",[21,3190,225],{}," only. The exposure is affirmed and the affirmation is in force, or you affirmed it since the last run. A stale or unstamped affirmation can be affirmed again",[322,3193,3194,3199],{},[343,3195,3196],{},[21,3197,3198],{},"Unavailable — the host platform is too old for disposition actions",[343,3200,3201],{},"On both buttons. Your platform does not offer disposition actions to Threat Patterns yet. Ask your administrator to upgrade it",[14,3203,3204],{},"While a save on an exposure is in progress, both of its buttons are greyed out.",[30,3206,151],{"id":3207},"by-item",[14,3209,3210,3212,3213,3216,3217,3220,3221,3224,3225,3228],{},[21,3211,151],{}," maps findings to three lists: the ",[21,3214,3215],{},"OWASP Top 10 for Agentic Applications",", the ",[21,3218,3219],{},"OWASP Top 10 for LLM Applications",", and the ",[21,3222,3223],{},"MITRE ATT&CK and ATLAS tactics",". Choose the list under ",[21,3226,3227],{},"List",". Its edition shows beside it.",[820,3230,3232],{"id":3231},"owasp-lists","OWASP lists",[14,3234,3235],{},"In the two OWASP lists, the columns are:",[308,3237,3240],{"className":3238,"tabIndex":312,"role":313,"ariaLabel":3239},[311],"Table: OWASP lists",[316,3241,3242,3252],{},[319,3243,3244],{},[322,3245,3246,3249],{},[325,3247,3248],{},"Column",[325,3250,3251],{},"Shows",[338,3253,3254,3264,3290,3300],{},[322,3255,3256,3261],{},[343,3257,3258],{},[21,3259,3260],{},"Item",[343,3262,3263],{},"The item's id and title",[322,3265,3266,3271],{},[343,3267,3268],{},[21,3269,3270],{},"Assessed",[343,3272,3273,3274,142,3277,142,3280,3285,3286,3289],{},"Whether the patterns assess the item: ",[21,3275,3276],{},"assessed",[21,3278,3279],{},"partly assessed",[21,3281,3282,3283],{},"not assessed: ",[102,3284,3142],{}," (for example \"not assessed: emergent system property\"), or ",[21,3287,3288],{},"not assessed: nothing in this model exercises it",". The last one means the classes that would show the item are not drawn, or their facts are unanswered",[322,3291,3292,3297],{},[343,3293,3294],{},[21,3295,3296],{},"Pattern findings",[343,3298,3299],{},"The item's systemic findings, for example \"1 pattern finding: 1 Confirmed\"",[322,3301,3302,3306],{},[343,3303,3304],{},[21,3305,291],{},[343,3307,3308],{},"The item's exposures by triage, then how many have a control modelled or are detected only, for example \"1 analyst-confirmed · 4 untriaged, 5 in all · 2 with a control modelled\"",[14,3310,3311,3312,3314,3315,3317,3318,3320,3321,3323,3324,3326,3327,3329,3330,164],{},"An empty cell reads ",[21,3313,1407],{},". Click a row to fold it open onto its findings and exposures. Each one starts with its severity chip, in the element dialog's colours: first the findings with their own severity, a Not ruled out finding marked ",[21,3316,938],{}," as on the ",[21,3319,145],{}," tab, then the exposures, the most severe first and then by name. Each one is a link that opens its dialog over ",[21,3322,151],{},", so you keep your place. To see it on the ",[21,3325,145],{}," tab, click ",[21,3328,2095],{}," in the dialog. See ",[213,3331,649],{"href":648},[14,3333,3334,3335,164],{},"An item on the sheet's OWASP Agentic strip opens here, with its row open. See ",[213,3336,1102],{"href":1101},[14,3338,3339,3340,3343],{},"Findings without a reference in the list go to the ",[21,3341,3342],{},"Unmapped"," row. The footer says \"One finding can sit under several items.\" It then reminds readers that the OWASP lists are awareness lists, not standards.",[820,3345,3347],{"id":3346},"mitre-tactics","MITRE tactics",[14,3349,3350,3351,2468,3353,3355,3356,66,3359,3362,3363,164],{},"Choose ",[21,3352,3223],{},[21,3354,3227],{}," to see your findings by what an attacker is trying to achieve. There is one row for each tactic in the MITRE ATT&CK and MITRE ATLAS data loaded on your platform. ATT&CK comes first, then ATLAS, each in the order of its matrix, with the rows grouped under ",[21,3357,3358],{},"MITRE ATT&CK",[21,3360,3361],{},"MITRE ATLAS",". A tactic with nothing under it reads ",[21,3364,1407],{},[14,3366,3367],{},"A finding falls under a tactic through its techniques:",[42,3369,3370,3375],{},[45,3371,3372,3374],{},[21,3373,2239],{}," falls under every tactic of its own ATT&CK and ATLAS techniques.",[45,3376,3377,3379],{},[21,3378,2218],{}," falls under the tactics of its pattern's techniques, and of the techniques behind the parts of it that are present in your model. A part the model leaves undetermined or absent adds no tactic.",[14,3381,3382,3383,66,3385,3387],{},"One technique can sit under several tactics, so one finding can appear in several rows. Within a row it is counted once. The ",[21,3384,3296],{},[21,3386,291],{}," columns read as in the OWASP lists, with the same triage counts and control notes. Click a row to fold it open onto its findings.",[14,3389,3390,3393,3394,3396],{},[21,3391,3392],{},"No Assessed column."," For the OWASP lists, the pattern pack states which items its patterns assess. There is no such statement for tactics: the rows come from the MITRE data, and findings land on them only through their techniques. So a tactic row does not say whether it is assessed. A tactic that reads ",[21,3395,1407],{}," means that no finding in this model has a technique under it, nothing more.",[14,3398,3399,3402,3403,3405],{},[21,3400,3401],{},"Not mapped."," The ",[21,3404,3342],{}," row holds what falls under no tactic:",[42,3407,3408,3411,3414],{},[45,3409,3410],{},"an element exposure with no technique, for example many monitoring, audit-trail and data-retention exposures",[45,3412,3413],{},"an element exposure whose techniques sit under no tactic in the loaded MITRE data",[45,3415,3416],{},"a systemic finding with no tactic",[14,3418,3419,3422,3423,3426,3427,3429],{},[21,3420,3421],{},"Edition."," Your platform does not record which MITRE release it loaded, so the edition names the tactics this run read, for example ",[21,3424,3425],{},"as loaded (tactics 6904ca3a)",". The code after \"tactics\" changes when MITRE data is loaded again with a different list of tactics. Loading MITRE data again does not mark a result as out of date. Click ",[21,3428,137],{}," to see the new tactics.",[14,3431,3432],{},"The footer reads \"Tactics come from the MITRE technique mappings of each finding; a finding counts under every tactic of its techniques. This view orients; it is not detection or control coverage.\"",[14,3434,3435,3436,3438,3439,164],{},"The tactics list is on the ",[21,3437,151],{}," tab only. The sheet keeps the OWASP Agentic strip. A result made before the tactics list existed shows the earlier-version message; see ",[213,3440,2408],{"href":2407},[30,3442,73],{"id":3443},"facts-to-establish",[14,3445,3446],{},"This tab tells you what to add to the model so the analysis can decide. Each question is asked once, for one element and what settles it, however many findings or legs it settles.",[42,3448,3449,3460,3466],{},[45,3450,3451,3454,3455,142,3457,3459],{},[21,3452,3453],{},"Model gaps"," are counts with a denominator, such as \"2 of 6 agents have no declared outbound flows\", with the elements named under it: \"on ",[102,3456,1171],{},[102,3458,1175],{},"\". A gap says how to close it where there is more than one way, for example \"agents' W depends on an unanswered harness mode: answer the harness's approval mode, or each agent's own approval of consequential tools\". An identity, such as a managed identity, with no credential drawn on it reads, for example, \"1 of 3 identities have no token drawn on them: draw the credential each issues, or its reach and what it unlocks stay unseen\". With none named, it reads \"No gaps these patterns can detect; not an attestation of completeness.\"",[45,3461,3462,3465],{},[21,3463,3464],{},"Open questions on Not ruled out findings"," lists each Not ruled out finding in the ranking above, with the questions on its undetermined required legs.",[45,3467,3468,3471],{},[21,3469,3470],{},"Facts that could raise a finding"," lists the questions on agents and credentials that have no finding, or a pattern short of one. The questions are grouped by the agents and credentials they settle. The questions that settle the most of them come first.",[820,3473,3475],{"id":3474},"read-a-question","Read a question",[14,3477,3478,3479,1461,3482,3485,3486,3488,3489,3492],{},"Each question is one sentence, for example \"Set the attribute ",[21,3480,3481],{},"Consequential Tools Present",[1875,3483,3484],{},"consequential_tools_present",", in Human Oversight)\" or \"Draw the outbound flows of research-agent\". An attribute reads as the model editor's form names it: its title, then its key and the form section it sits in. Until the titles have been read from the platform, or if they cannot be read, the key shows alone. The question's next step is on the right; see ",[213,3487,216],{"href":215},". A model gap carries a ",[21,3490,3491],{},"Known gap"," chip and no button.",[42,3494,3495,3501,3510,3518,3524,3542],{},[45,3496,3497,3500],{},[21,3498,3499],{},"Under a Not ruled out finding",", the element the question is on follows the sentence. A line under it says what it settles.",[45,3502,3503,3506,3507,3509],{},[21,3504,3505],{},"In Facts that could raise a finding",", the element follows as \"· on ",[102,3508,1413],{},"\" only when the sentence does not already name it. The group header says what the questions settle.",[45,3511,3512,3515,3516,2597],{},[21,3513,3514],{},"Shared questions."," A question several findings share sits under the first-ranked one. The others point to it: \"The question \"…\" is asked under ",[102,3517,2146],{},[45,3519,3520,3523],{},[21,3521,3522],{},"Below the bar."," A question that also settles agents or credentials without a finding says \"also settles, below the bar: …\". It is not asked again in the second section.",[45,3525,3526,3529,3530,1168,3532,1172,3534,3536,3537,1179,3539,3541],{},[21,3527,3528],{},"Same names."," Where two or more elements in the list share a name, a flow reads \"",[102,3531,1167],{},[102,3533,1171],{},[102,3535,1175],{},")\" and another element \"",[102,3538,1167],{},[102,3540,1182],{},")\", in the question, the element it is on and its next step's dialog. A name no other element shares stays plain, and so does an element with no ends or parent to name.",[45,3543,3544,3547,3548,3551,3552,3555,3556,3559],{},[21,3545,3546],{},"Delegation hops."," A delegation hop with nothing to ask on its own says \"decided by ",[102,3549,3550],{},"delegate","'s own legs\". Click ",[21,3553,3554],{},"its questions"," to show only the delegate's questions. Click ",[21,3557,3558],{},"show all"," to clear it.",[14,3561,3562],{},"When both sections are empty, the tab reads \"Nothing to establish: every finding is Confirmed, and every agent and credential without one has its legs settled.\"",[820,3564,3566],{"id":3565},"read-a-group","Read a group",[14,3568,3569,3570,3572],{},"In ",[21,3571,3470],{},", there is one group per set of agents and credentials the questions settle, and one checklist of items that may be credentials. Each question is in exactly one group.",[42,3574,3575,3589,3595,3601,3613],{},[45,3576,3577,3580,3581,3584,3585,3588],{},[21,3578,3579],{},"Header."," It reads \"Settles: ",[102,3582,3583],{},"names","\", in alphabetical order. A group with more than one question adds \"· ",[102,3586,3587],{},"N"," questions\".",[45,3590,3591,3594],{},[21,3592,3593],{},"Order."," The group holding the first-ranked question comes first. Within a group, the questions keep the same order.",[45,3596,3597,3600],{},[21,3598,3599],{},"Detail."," Hover over the header to see, for each agent or credential, the pattern, leg and route its questions settle. Where a question asks whether an item is a credential, the leg reads \"whether it is a credential\" and the route \"an item that may hold a key, token or password\".",[45,3602,3603,3606,3607,3609,3610,3612],{},[21,3604,3605],{},"Long groups."," A group of more than eight questions starts folded. Click ",[21,3608,848],{}," to open it and ",[21,3611,851],{}," to close it.",[45,3614,3615,3618,3619,3622,3623,3625],{},[21,3616,3617],{},"Credential checklist."," The questions that only ask whether an item is a credential (\"Mark whether ",[102,3620,3621],{},"item"," is a credential\") form one checklist, headed \"Contains a key, token or password?\" with a count, for example \"· 8 items, likeliest first\". Under the header it reads \"Mark each item that holds a credential. Only a real credential leads a chain on, so the others drop out.\" The likeliest credentials come first: restricted or confidential items, and items whose name sounds like a secret or a place one is often left, such as configuration, code or memory. The checklist sits where its first question ranks. Click ",[21,3624,1157],{}," on each item that holds a credential. A question that also settles something else, for example an agent's private data, stays in the group of what it settles.",[820,3627,216],{"id":3628},"act-on-a-question",[14,3630,3631,3632,3634],{},"Each question carries one next step, by what it asks. The same steps appear on ",[21,3633,145],{}," and in the dialogs. None of them writes anything: make the change, then generate again.",[308,3636,3639],{"className":3637,"tabIndex":312,"role":313,"ariaLabel":3638},[311],"Table: Act on a question",[316,3640,3641,3654],{},[319,3642,3643],{},[322,3644,3645,3648,3651],{},[325,3646,3647],{},"Button",[325,3649,3650],{},"When",[325,3652,3653],{},"The dialog",[338,3655,3656,3672,3687,3701],{},[322,3657,3658,3662,3665],{},[343,3659,3660],{},[21,3661,1157],{},[343,3663,3664],{},"An attribute, or a field of a data item",[343,3666,3667,3668,3671],{},"Names the element and the fact. ",[21,3669,3670],{},"Open the model"," opens it in the model editor",[322,3673,3674,3678,3681],{},[343,3675,3676],{},[21,3677,1213],{},[343,3679,3680],{},"Something to draw, such as flows, including a route that continues further than the analysis follows",[343,3682,3683,3684,3686],{},"Names what to draw. It says no form answers it, unless the question also offers an attribute to set. ",[21,3685,3670],{}," opens the model editor",[322,3688,3689,3693,3696],{},[343,3690,3691],{},[21,3692,1216],{},[343,3694,3695],{},"Nothing in the model answers it yet",[343,3697,3698,3699],{},"Names the question and asks you to put it to whoever owns the element, then draw or set what the answer says. There is no ",[21,3700,3670],{},[322,3702,3703,3705,3708],{},[343,3704,1407],{},[343,3706,3707],{},"A known gap of the analysis",[343,3709,3710],{},"—",[14,3712,3713,3716,3717,3719],{},[21,3714,3715],{},"Assert a fact."," Some questions can also be closed by an assertion: a fact you state where the model cannot say it. On ",[21,3718,73],{},", the question then carries a second button, worded for the fact it offers:",[308,3721,3723],{"className":3722,"tabIndex":312,"role":313,"ariaLabel":3638},[311],[316,3724,3725,3737],{},[319,3726,3727],{},[322,3728,3729,3731,3734],{},[325,3730,3647],{},[325,3732,3733],{},"Offered on",[325,3735,3736],{},"You state",[338,3738,3739,3752,3784],{},[322,3740,3741,3746,3749],{},[343,3742,3743],{},[21,3744,3745],{},"Assert outbound flows complete",[343,3747,3748],{},"An element whose class has no attribute that could state its egress",[343,3750,3751],{},"Every outbound flow of the element is drawn",[322,3753,3754,3762,3775],{},[343,3755,3756],{},[21,3757,3758,3759,3761],{},"Assert not a hand-off, and ",[102,3760,1175],{},"'s model never reads it",[343,3763,3764,3765,3767,3768,3770,3771,3774],{},"A flow the model reads as a possible hand-off to agent ",[102,3766,1175],{},". When the flow reaches several agents, the button names them all: \"Assert not a hand-off, and ",[102,3769,1175],{},"'s and ",[102,3772,3773],{},"C","'s models never read it\"",[343,3776,3777,3778,3780,3781,3783],{},"The flow hands no work on to ",[102,3779,1175],{},", and ",[102,3782,1175],{},"'s model never reads what it carries",[322,3785,3786,3799,3808],{},[343,3787,3788],{},[21,3789,3790,3791,3794,3795,3798],{},"Assert ",[102,3792,3793],{},"H"," is not assigned to ",[102,3796,3797],{},"F","'s compute",[343,3800,3801,3802,3804,3805,3807],{},"A question asking whether identity ",[102,3803,3793],{}," serves the compute that ",[102,3806,3797],{}," runs on. Each identity gets its own question and button",[343,3809,3810,3812,3813,3815],{},[102,3811,3793],{}," is not assigned to the compute ",[102,3814,3797],{}," runs on",[86,3817,3818,3831,3838],{},[45,3819,3820,3821,142,3824,24,3827,3830],{},"Click the button. A dialog opens, titled ",[21,3822,3823],{},"Assert: outbound flows complete",[21,3825,3826],{},"Assert: not a hand-off",[21,3828,3829],{},"Assert: identity not on this compute",". Its text says what you state and what the next run does with it.",[45,3832,3833,3834,3837],{},"Enter a ",[21,3835,3836],{},"Justification (required)",", at most 2000 characters.",[45,3839,108,3840,3843,3844,3847],{},[21,3841,3842],{},"Assert",". The dialog closes, the assertion appears under ",[21,3845,3846],{},"Assertions",", and the stale banner shows.",[14,3849,3850,3851,3853,3854,3857,3858,3860],{},"At the next run, the routes that rested on the fact read absent, with the label ",[21,3852,589],{},", and name your assertion. A change to the element the assertion is on makes it ",[21,3855,3856],{},"stale",": for outbound flows complete, a change to the element or its outbound flows; for the other two, a change to the flow or to ",[102,3859,3797],{},". A stale assertion is no longer applied.",[14,3862,3863,3864,164],{},"If the server refuses the assertion, the dialog shows its reason and stays open. Nothing is recorded. See ",[213,3865,2408],{"href":2407},[14,3867,3868,3869,3873],{},"See also ",[213,3870,3872],{"href":3871},"\u002Fthreat-patterns\u002Fmodelling-checklist#step-8-use-the-assertion-only-where-the-model-cannot-say-it","the assertion"," in the modelling checklist.",[14,3875,3876,3878,3879,142,3882,24,3885,3890,3891,142,3894,3896,3897,3900,3901,3904],{},[21,3877,3846],{}," lists every assertion on this analysis with its fact, author, time and justification. The fact reads ",[21,3880,3881],{},"outbound flows complete",[21,3883,3884],{},"not a hand-off",[21,3886,3887,3888],{},"identity not on this compute: ",[102,3889,3793],{},". An assertion is ",[21,3892,3893],{},"applied",[21,3895,3856],{}," (what it is on changed since) or ",[21,3898,3899],{},"withdrawn",". Use ",[21,3902,3903],{},"Withdraw"," to retire one. The entry stays, with who withdrew it.",[14,3906,786,3907,3911],{},[213,3908,3910],{"href":3909},"\u002Fthreat-patterns\u002Fmodelling-checklist","modelling checklist"," lists the common facts and drawings, and what each settles.",[30,3913,1102],{"id":3914},"the-sheet",[14,3916,3917,3919],{},[21,3918,141],{}," is a one-page summary for a CISO, with an appendix for engineers. Every page starts with the sensitivity mark \"Sensitive: names where credentials are held and what they unlock\".",[820,3921,3923],{"id":3922},"ciso-page","CISO page",[14,3925,3926],{},"In order, the CISO page shows:",[86,3928,3929,3936,3939,3953,3962,3997,4011,4018,4035],{},[45,3930,3931,3932,164],{},"The title, ",[21,3933,275,3934],{},[102,3935,104],{},[45,3937,3938],{},"The counts: the systemic findings line, one line per pattern (for example \"Credential chain: 1 Confirmed · 1 Not ruled out\"), then the element exposures line.",[45,3940,3941,3942],{},"A legend:\n",[42,3943,3944,3947,3950],{},[45,3945,3946],{},"\"Confirmed: every required leg of the pattern is present in the model.\"",[45,3948,3949],{},"\"Not ruled out: at least two required legs are present and none is absent; the rest are open questions, answered on the Facts to establish tab.\"",[45,3951,3952],{},"\"Severity is the pattern's band, not business impact.\"",[45,3954,786,3955,3958,3959,3961],{},[21,3956,3957],{},"triage coverage"," line: \"triage coverage: R of N exposures reviewed (P%) — element exposures only, as of ",[102,3960,3026],{},"; review progress, not a security measure\". N is every element exposure, dispositioned ones included, and R those with any disposition. The line is left out when the model has no exposures.",[45,3963,3964,3967,3968,3970,3971,2147,3974,3977,3978,3981,3982,3984,3985,3987,3988,3990,3991,3993,3994,164],{},[21,3965,3966],{},"Top findings",": the top three, under the ranking rule. Each gives the band (with \"if confirmed\" for a Not ruled out finding), Confirmed or Not ruled out, and the coverage with the credited legs it names, as on the ",[21,3969,145],{}," tab, for example \"control modelled on P\". The exported sheet shows the same words. Then \"",[102,3972,3973],{},"pattern",[102,3975,3976],{},"subject","\", the pattern's reason and \"Runs through ",[102,3979,3980],{},"elements","\". A Not ruled out finding adds how many questions stand open on the ",[21,3983,73],{}," tab. On screen, the finding's title and its coverage word, for example ",[21,3986,644],{},", carry the same tooltips as on the ",[21,3989,145],{}," tab: the pattern with its band, reason and legs, and what the word means. Hover over them or move to them with ",[21,3992,855],{},". See ",[213,3995,1001],{"href":3996},"#tooltips",[45,3998,3999,4002,4003,4005,4006,4008,4009,2234],{},[21,4000,4001],{},"Top fixes",": the top three changes, grouped as on the ",[21,4004,148],{}," tab, each with its owner, what it breaks, and its ",[21,4007,2155],{}," alternatives. A partial fix among them reads \"narrows, does not close; if it cut those routes it would: …\", as on the ",[21,4010,148],{},[45,4012,4013,4015,4016,2234],{},[21,4014,3453],{},", with the same no-gaps wording as the ",[21,4017,73],{},[45,4019,4020,4021,4023,4024,856,4026,4028,4029,4031,4032,4034],{},"The OWASP Agentic strip: each item's id with its short name under it (for example \"ASI01\" and \"Agent Goal Hijack\"), its ",[21,4022,3270],{}," wording and its findings, then how many findings have no reference in the list, and \"One finding can sit under several items.\" On screen, the note adds \"Each item opens on the By item tab.\" Click an item, or move to it with ",[21,4025,855],{},[21,4027,859],{},", to open its row on ",[21,4030,151],{}," under the OWASP Agentic list, expanded and scrolled into view. The address keeps the item while you stay on ",[21,4033,151],{},", so a reload or a shared address opens the same row. If the result no longer holds that item, the tab opens with no row open.",[45,4036,4037,4038,164],{},"The provenance line: the pattern packs and versions, the generated time, the fingerprint (\"fingerprint of the model, engine and credit table sha256:…\") and how many analyst assertions were applied. The fingerprint is what marks a result out of date; see ",[213,4039,84],{"href":4040},"#run-the-analysis",[820,4042,4044],{"id":4043},"engineer-appendix","Engineer appendix",[42,4046,4047,4053,4071],{},[45,4048,4049,4052],{},[21,4050,4051],{},"Top findings, leg by leg",": the same top three, each required leg with its state and the elements that supply it.",[45,4054,786,4055,4058,4059,142,4062,142,4065,66,4068,4070],{},[21,4056,4057],{},"rotate list",": one row per credential in a credential chain, with ",[21,4060,4061],{},"Holders",[21,4063,4064],{},"Wielders",[21,4066,4067],{},"Unlocks",[21,4069,2524],{}," (the issuer).",[45,4072,4073],{},"The pattern versions.",[14,4075,4076],{},"The exported file adds the legs of every finding and the facts to establish, each question listed once.",[14,4078,4079],{},"The analysis never treats a missing field as a secure answer: an unanswered fact is undetermined, never assumed safe.",[820,4081,4083],{"id":4082},"export-the-sheet","Export the sheet",[14,4085,108,4086,4089,4090,4092,4093,4096],{},[21,4087,4088],{},"Export sheet (HTML, print to PDF)"," to download a printable HTML file. It has no tooltips, and its strip items open nothing. Under its title it names each pattern pack the engine did not run, in the words of the notice above the report; see ",[213,4091,84],{"href":4040},". For a PDF, open it and use your browser's ",[21,4094,4095],{},"Print",". In print, the sensitivity mark repeats at the top of every printed page. The sheet names where credentials are held and what they unlock, so handle it as sensitive.",[30,4098,4100],{"id":4099},"what-the-analysis-does-not-claim","What the analysis does not claim",[42,4102,4103,4106,4109,4115],{},[45,4104,4105],{},"It reads your model, not your running systems. A missing leg may be a fact you have not drawn yet.",[45,4107,4108],{},"It shows no all-clear, and counts always carry a denominator. The only percentage is the sheet's triage coverage. It describes how far review of the exposures has got, not security.",[45,4110,4111,4112,4114],{},"A control in the model reads ",[21,4113,636],{},". That says nothing about how well the control works in practice.",[45,4116,786,4117,4119],{},[21,4118,151],{}," lists orient readers. The OWASP lists are not an attestation, and the tactics list is not detection or control coverage.",[30,4121,2408],{"id":4122},"troubleshooting",[308,4124,4127],{"className":4125,"tabIndex":312,"role":313,"ariaLabel":4126},[311],"Table: Troubleshooting",[316,4128,4129,4139],{},[319,4130,4131],{},[322,4132,4133,4136],{},[325,4134,4135],{},"You see",[325,4137,4138],{},"What to do",[338,4140,4141,4152,4164,4177,4190,4202,4213,4223,4237,4249,4268,4282,4298,4306,4332,4345,4357,4367,4378,4389,4401,4410],{},[322,4142,4143,4149],{},[343,4144,4145,4146,4148],{},"Threat Patterns is not in the ",[21,4147,111],{}," menu",[343,4150,4151],{},"The analysis is not installed on your platform. Contact your administrator",[322,4153,4154,4159],{},[343,4155,4156],{},[21,4157,4158],{},"No pattern pack is installed, so no pattern was evaluated.",[343,4160,4161,4162],{},"Ask your administrator to install the agentic pattern pack, then click ",[21,4163,137],{},[322,4165,4166,4172],{},[343,4167,4168,4169,4171],{},"Few findings and a long ",[21,4170,73],{}," list",[343,4173,4174,4175],{},"The model does not state enough yet. Work through the ",[213,4176,3910],{"href":3909},[322,4178,4179,4187],{},[343,4180,4181,4182,24,4184,4186],{},"No ",[21,4183,65],{},[21,4185,69],{}," field on data items",[343,4188,4189],{},"Your platform is older than 0.11.0. Results are partial until it is upgraded",[322,4191,4192,4197],{},[343,4193,4194],{},[21,4195,4196],{},"This result was made by an earlier version of Threat Patterns. Generate again to read it.",[343,4198,4199,4200],{},"The analysis was updated since the last run. Click ",[21,4201,137],{},[322,4203,4204,4210],{},[343,4205,4206,2438,4208,4171],{},[21,4207,151],{},[21,4209,3223],{},[343,4211,4212],{},"Your platform has no MITRE ATT&CK or ATLAS data loaded. Contact your administrator",[322,4214,4215,4220],{},[343,4216,4217,4218],{},"An assertion shows ",[21,4219,3856],{},[343,4221,4222],{},"What it is on changed: the element or its outbound flows, the flow, or the element whose compute it names. Check the model again, then withdraw it or assert again",[322,4224,4225,4232],{},[343,4226,4227,4228,4231],{},"The assertion dialog shows \"",[102,4229,4230],{},"flow"," is not a possible hand-off in the model: there is nothing to assert\"",[343,4233,4234,4235],{},"The model does not read the flow as a possible hand-off, so there is nothing to settle. Nothing was recorded. Click ",[21,4236,2293],{},[322,4238,4239,4244],{},[343,4240,4227,4241,4243],{},[102,4242,4230],{}," is drawn as a hand-off: redraw it if it is not one\", or \"… drawn as a hand-off between two agents: …\"",[343,4245,4246,4247],{},"The model already reads the flow as a hand-off from how it is drawn. An assertion cannot override the drawing. If the flow is not a hand-off, redraw it in the model, then click ",[21,4248,137],{},[322,4250,4251,4263],{},[343,4252,4253,4254],{},"A notice reads ",[21,4255,245,4256,249,4258,253,4260,4262],{},[102,4257,248],{},[102,4259,252],{},[102,4261,252],{}," or later; …",[343,4264,4265,4266],{},"The engine skipped that pack, so its findings are missing. Ask your administrator to upgrade the Threat Patterns engine module, then click ",[21,4267,137],{},[322,4269,4270,4279],{},[343,4271,4272,66,4274,4276,4277],{},[21,4273,225],{},[21,4275,228],{}," are greyed out: ",[21,4278,3198],{},[343,4280,4281],{},"Your platform does not offer disposition actions to Threat Patterns yet. Ask your administrator to upgrade it",[322,4283,4284,4292],{},[343,4285,4286,24,4290],{},[21,4287,3139,4288,164],{},[102,4289,3142],{},[21,4291,3146],{},[343,4293,4294,4295,4297],{},"Nothing was saved. Read the platform's reason, if there is one, then click ",[21,4296,3150],{}," on the message. If it keeps failing, contact your administrator",[322,4299,4300,4303],{},[343,4301,4302],{},"A run fails",[343,4304,4305],{},"The previous result stays. Try again; if it keeps failing, contact your administrator",[322,4307,4308,4314],{},[343,4309,4310,4311,4313],{},"A fix reads ",[21,4312,1455],{}," on an element you run",[343,4315,4316,4317,4319,4320,4322,4323,1172,4325,4327,4328,3993,4330],{},"The element's ",[21,4318,1519],{}," is set to ",[21,4321,1615],{},", or it is empty and the element sits in a vendor's zone, or the boundary it is drawn in says a vendor runs its environment. If you know you run it, set ",[21,4324,1519],{},[21,4326,1612],{}," on the element or the boundary, then click ",[21,4329,137],{},[213,4331,1524],{"href":1523},[322,4333,4334,4339],{},[343,4335,4336,4337],{},"A fix carries ",[21,4338,1512],{},[343,4340,4341,4342,4344],{},"The model does not say who runs the element it names. Answer ",[21,4343,1519],{}," there if you know; otherwise leave it empty and ask the element's owner",[322,4346,4347,4354],{},[343,4348,4349,4351,4352],{},[21,4350,1224],{}," is greyed out: ",[21,4353,2381],{},[343,4355,4356],{},"Your platform does not offer issues to Threat Patterns yet. Ask your administrator to upgrade it",[322,4358,4359,4364],{},[343,4360,4361],{},[21,4362,4363],{},"Couldn't open the issue workflow.",[343,4365,4366],{},"No issue was raised. Try again; if it keeps failing, contact your administrator",[322,4368,4369,4375],{},[343,4370,4371,4351,4373],{},[21,4372,1234],{},[21,4374,2796],{},[343,4376,4377],{},"Risk Assessment is not installed on your platform. Contact your administrator",[322,4379,4380,4386],{},[343,4381,4382,4351,4384],{},[21,4383,1234],{},[21,4385,2806],{},[343,4387,4388],{},"Your Risk Assessment is too old to take Threat Patterns findings. Ask your administrator to upgrade it",[322,4390,4391,4398],{},[343,4392,4393,4395,4396],{},[21,4394,1234],{}," on an exposure is greyed out: ",[21,4397,2822],{},[343,4399,4400],{},"Your Risk Assessment takes Threat Patterns findings but not yet exposures. Ask your administrator to upgrade it",[322,4402,4403,4407],{},[343,4404,4405],{},[21,4406,2688],{},[343,4408,4409],{},"Nothing was saved. Try again; if it keeps failing, contact your administrator",[322,4411,4412,4416],{},[343,4413,4414],{},[21,4415,2724],{},[343,4417,4418,4419,4421],{},"Threat Patterns could not read the finding or exposure as it stands, or the exposure is no longer on its element as it was, so no risk or evidence was saved. Try again. For an exposure, click ",[21,4420,137],{}," first to see whether it still stands. If it keeps failing, contact your administrator",[30,4423,4425],{"id":4424},"related-guides","Related guides",[42,4427,4428,4434,4441,4448],{},[45,4429,4430,4433],{},[213,4431,4432],{"href":3909},"Modelling checklist",": what to set and draw so the legs can be decided.",[45,4435,4436,4440],{},[213,4437,4439],{"href":4438},"\u002Fagentic-modelling","Model an agentic architecture",": a hands-on training that builds one agentic system step by step and runs Threat Patterns after each step.",[45,4442,4443,4447],{},[213,4444,4446],{"href":4445},"\u002Frisk-assessment","Risk Assessment",": the risk report and register for the same model.",[45,4449,4450,4452],{},[213,4451,2395],{"href":2394},": rate, treat, accept and close the risks you record from a finding or an exposure.",{"title":4454,"searchDepth":4455,"depth":4455,"links":4456},"",3,[4457,4459,4460,4461,4462,4463,4464,4476,4477,4478,4486,4491,4495,4500,4505,4506,4507],{"id":32,"depth":4458,"text":33},2,{"id":39,"depth":4458,"text":40},{"id":83,"depth":4458,"text":84},{"id":268,"depth":4458,"text":269},{"id":305,"depth":4458,"text":306},{"id":460,"depth":4458,"text":461},{"id":783,"depth":4458,"text":145,"children":4465},[4466,4467,4468,4469,4470,4471,4472,4473,4474,4475],{"id":822,"depth":4455,"text":823},{"id":874,"depth":4455,"text":875},{"id":926,"depth":4455,"text":927},{"id":976,"depth":4455,"text":977},{"id":1000,"depth":4455,"text":1001},{"id":1105,"depth":4455,"text":1106},{"id":1254,"depth":4455,"text":1141},{"id":1351,"depth":4455,"text":1352},{"id":1591,"depth":4455,"text":1524},{"id":1664,"depth":4455,"text":649},{"id":2102,"depth":4458,"text":148},{"id":2200,"depth":4458,"text":1229},{"id":2388,"depth":4458,"text":1239,"children":4479},[4480,4481,4482,4483,4484,4485],{"id":2411,"depth":4455,"text":2412},{"id":2476,"depth":4455,"text":2477},{"id":2549,"depth":4455,"text":2502},{"id":2643,"depth":4455,"text":2644},{"id":2695,"depth":4455,"text":2696},{"id":2758,"depth":4455,"text":2759},{"id":2834,"depth":4458,"text":233,"children":4487},[4488,4489,4490],{"id":2865,"depth":4455,"text":2866},{"id":2938,"depth":4455,"text":1205},{"id":3050,"depth":4455,"text":1819},{"id":3207,"depth":4458,"text":151,"children":4492},[4493,4494],{"id":3231,"depth":4455,"text":3232},{"id":3346,"depth":4455,"text":3347},{"id":3443,"depth":4458,"text":73,"children":4496},[4497,4498,4499],{"id":3474,"depth":4455,"text":3475},{"id":3565,"depth":4455,"text":3566},{"id":3628,"depth":4455,"text":216},{"id":3914,"depth":4458,"text":1102,"children":4501},[4502,4503,4504],{"id":3922,"depth":4455,"text":3923},{"id":4043,"depth":4455,"text":4044},{"id":4082,"depth":4455,"text":4083},{"id":4099,"depth":4458,"text":4100},{"id":4122,"depth":4458,"text":2408},{"id":4424,"depth":4458,"text":4425},"md",{},true,"\u002Fthreat-patterns",{"title":5,"description":16},"06.threat-patterns\u002Findex","wN-VuSRw4zV8AS9UC2GekMeS0xgrSlv6l9rq4p7K4-o",[4516,4571,4606,4661,4695,4735,4744,4813],{"title":4517,"description":4518,"path":4519,"stem":4520,"children":4521,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[4522,4526,4531,4536,4541,4546,4551,4556,4561,4566],{"title":4523,"path":4519,"stem":4524,"description":4525},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":4527,"path":4528,"stem":4529,"description":4530},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":4532,"path":4533,"stem":4534,"description":4535},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":4537,"path":4538,"stem":4539,"description":4540},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":4542,"path":4543,"stem":4544,"description":4545},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":4547,"path":4548,"stem":4549,"description":4550},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":4552,"path":4553,"stem":4554,"description":4555},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":4557,"path":4558,"stem":4559,"description":4560},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":4562,"path":4563,"stem":4564,"description":4565},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":4567,"path":4568,"stem":4569,"description":4570},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":4572,"description":4573,"path":4574,"stem":4575,"children":4576,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[4577,4581,4586,4591,4596,4601],{"title":4578,"path":4574,"stem":4579,"description":4580},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":4582,"path":4583,"stem":4584,"description":4585},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":4587,"path":4588,"stem":4589,"description":4590},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":4592,"path":4593,"stem":4594,"description":4595},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":4597,"path":4598,"stem":4599,"description":4600},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":4602,"path":4603,"stem":4604,"description":4605},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":4607,"description":4608,"path":4609,"stem":4610,"children":4611,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[4612,4616,4621,4626,4631,4636,4641,4646,4651,4656],{"title":4613,"path":4609,"stem":4614,"description":4615},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":4617,"path":4618,"stem":4619,"description":4620},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":4622,"path":4623,"stem":4624,"description":4625},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":4627,"path":4628,"stem":4629,"description":4630},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":4632,"path":4633,"stem":4634,"description":4635},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":4637,"path":4638,"stem":4639,"description":4640},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":4642,"path":4643,"stem":4644,"description":4645},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":4647,"path":4648,"stem":4649,"description":4650},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":4652,"path":4653,"stem":4654,"description":4655},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":4657,"path":4658,"stem":4659,"description":4660},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":4662,"description":4663,"path":4664,"stem":4665,"children":4666,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[4667,4670,4675,4680,4685,4690],{"title":4662,"path":4664,"stem":4668,"description":4669},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":4671,"path":4672,"stem":4673,"description":4674},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":4676,"path":4677,"stem":4678,"description":4679},"Reading the Report","\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":4681,"path":4682,"stem":4683,"description":4684},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":4686,"path":4687,"stem":4688,"description":4689},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":4691,"path":4692,"stem":4693,"description":4694},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":4696,"description":4697,"path":4445,"stem":4698,"children":4699,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","05.risk-assessment",[4700,4704,4709,4713,4718,4723,4727,4732],{"title":4701,"path":4445,"stem":4702,"description":4703},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":4705,"path":4706,"stem":4707,"description":4708},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":145,"path":4710,"stem":4711,"description":4712},"\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":4714,"path":4715,"stem":4716,"description":4717},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":4719,"path":4720,"stem":4721,"description":4722},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":4676,"path":4724,"stem":4725,"description":4726},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":4728,"path":4729,"stem":4730,"description":4731},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":2395,"path":2394,"stem":4733,"description":4734},"05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":115,"description":4736,"path":4511,"stem":4737,"children":4738,"page":-1},"The Threat Patterns module and its modelling checklist.","06.threat-patterns",[4739,4740],{"title":5,"path":4511,"stem":4513,"description":16},{"title":4741,"path":3909,"stem":4742,"description":4743},"Modelling Checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":4745,"description":4746,"path":4438,"stem":4747,"children":4748,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","07.agentic-modelling",[4749,4753,4758,4763,4768,4773,4778,4783,4788,4793,4798,4803,4808],{"title":4750,"path":4438,"stem":4751,"description":4752},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":4754,"path":4755,"stem":4756,"description":4757},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":4759,"path":4760,"stem":4761,"description":4762},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":4764,"path":4765,"stem":4766,"description":4767},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":4769,"path":4770,"stem":4771,"description":4772},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":4774,"path":4775,"stem":4776,"description":4777},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":4779,"path":4780,"stem":4781,"description":4782},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":4784,"path":4785,"stem":4786,"description":4787},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":4789,"path":4790,"stem":4791,"description":4792},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":4794,"path":4795,"stem":4796,"description":4797},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":4799,"path":4800,"stem":4801,"description":4802},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":4804,"path":4805,"stem":4806,"description":4807},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":4809,"path":4810,"stem":4811,"description":4812},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":4814,"description":4815,"path":4816,"stem":4817,"children":4818,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[4819,4823,4828],{"title":4820,"path":4816,"stem":4821,"description":4822},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":4824,"path":4825,"stem":4826,"description":4827},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":4829,"path":4830,"stem":4831,"description":4832},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748184213]