[{"data":1,"prerenderedAt":1479},["ShallowReactive",2],{"page-\u002Fthreat-report\u002Freading-the-report":3,"navigation":1162},{"id":4,"title":5,"body":6,"description":1147,"extension":1148,"meta":1149,"navigation":1157,"path":1158,"seo":1159,"stem":1160,"__hash__":1161},"docs\u002F04.threat-report\u002F02.reading-the-report.md","Reading the Report",{"type":7,"value":8,"toc":1121},"minimark",[9,13,26,46,51,58,192,205,210,218,222,226,233,237,247,271,278,282,296,299,316,320,337,341,344,348,355,440,448,452,455,534,543,547,550,584,588,595,627,631,640,643,771,774,778,787,827,830,848,852,855,1005,1013,1039,1043,1057,1078,1082],[10,11,5],"h1",{"id":12},"reading-the-report",[14,15,16,17,21,22,25],"p",{},"The Threat Report turns a generated snapshot of your model into a set of focused views you switch between in place — no page reloads, no navigating away. This guide shows you how the report is laid out, how to move around it, and the shared visual language (severity, data sensitivity, the model map, ATT&CK chips) that every view reuses. It then walks the two views you'll start in most often: ",[18,19,20],"strong",{},"Posture"," and ",[18,23,24],{},"Boundary Crossings",". Coverage, Reachability, and the findings ledger each have their own guide, linked at the end.",[27,28,29],"blockquote",{},[14,30,31,34,35,39,40,45],{},[18,32,33],{},"Prerequisite."," You need a generated snapshot. If the report greets you with ",[36,37,38],"em",{},"\"No snapshot has been generated for this report yet,\""," generate one first — see ",[41,42,44],"a",{"href":43},"\u002Fthreat-report\u002Fgetting-started","Getting Started",".",[47,48,50],"h2",{"id":49},"the-layout-at-a-glance","The layout at a glance",[14,52,53,54,57],{},"The report is a single screen titled ",[18,55,56],{},"Threat Report",". From top to bottom:",[59,60,61,80,98,180,186],"ol",{},[62,63,64,67,68,71,72,75,76,79],"li",{},[18,65,66],{},"The scope banner."," Pinned above everything else. It carries model-wide caveats — a stale snapshot, missing boundaries, under-analyzed high-value elements, unclassified data — and the ",[18,69,70],{},"Generate"," \u002F ",[18,73,74],{},"Recreate"," action. You read the caveats here ",[36,77,78],{},"before"," you read any numbers.",[62,81,82,85,86,90,91,21,94,97],{},[18,83,84],{},"The model summary line + export."," A small line reads ",[87,88,89],"code",{},"N components · M boundaries",", with ",[18,92,93],{},"Export JSON",[18,95,96],{},"Export HTML"," buttons on the right.",[62,99,100,103,104],{},[18,101,102],{},"The tab strip"," (a segmented control). One click switches the view below it. The tabs are:",[105,106,112],"div",{"className":107,"tabIndex":109,"role":110,"ariaLabel":111},[108],"table-frame",0,"region","Table: The layout at a glance",[113,114,115,128],"table",{},[116,117,118],"thead",{},[119,120,121,125],"tr",{},[122,123,124],"th",{},"Tab",[122,126,127],{},"What it answers",[129,130,131,141,151,161,170],"tbody",{},[119,132,133,138],{},[134,135,136],"td",{},[18,137,20],{},[134,139,140],{},"What's my overall exposure right now? (the default landing view)",[119,142,143,148],{},[134,144,145],{},[18,146,147],{},"Coverage & Gaps",[134,149,150],{},"Which attack techniques do my controls actually address?",[119,152,153,158],{},[134,154,155],{},[18,156,157],{},"Reachability",[134,159,160],{},"Which modeled flow routes lead from outside to my crown jewels?",[119,162,163,167],{},[134,164,165],{},[18,166,24],{},[134,168,169],{},"Where does data leave or enter a security boundary?",[119,171,172,177],{},[134,173,174],{},[18,175,176],{},"Residual Risk",[134,178,179],{},"The full ledger of open and dispositioned findings.",[62,181,182,185],{},[18,183,184],{},"The breadcrumb \u002F filter row."," Appears only when one or more filters are active. Each filter shows as a removable chip.",[62,187,188,191],{},[18,189,190],{},"The active view."," The single scrolling region for the tab you're on.",[27,193,194],{},[14,195,196,199,200,204],{},[18,197,198],{},"The Component Profile is not a tab."," It opens as an overlay dialog whenever you click an element link anywhere in the report (a finding's element, a flow, a boundary). Closing it returns you to exactly where you were. See ",[41,201,203],{"href":202},"#moving-around-the-report","Moving around"," below.",[206,207,209],"h3",{"id":208},"exporting","Exporting",[14,211,212,214,215,217],{},[18,213,93],{}," downloads the snapshot as structured data; ",[18,216,96],{}," downloads a self-contained page you can share or archive. Both export the snapshot you're currently viewing — generate or recreate first if the banner says it's stale.",[47,219,221],{"id":220},"moving-around-the-report","Moving around the report",[206,223,225],{"id":224},"switching-views","Switching views",[14,227,228,229,232],{},"Click any tab in the strip. The view swaps in place; your scroll position in the new view starts at the top. A manual tab click is always an ",[36,230,231],{},"unfiltered"," view — switching tabs clears any active filter chips, so you never carry one view's filter into another by accident.",[206,234,236],{"id":235},"the-component-profile-overlay","The Component Profile overlay",[14,238,239,240,243,244,246],{},"Most things in the report are clickable: a finding's element name, a flow, a crossed boundary, a ranked residual risk. Clicking one opens the ",[18,241,242],{},"Component Profile"," as a dialog over the current view, labelled with a small ",[87,245,242],{}," eyebrow and the element's name.",[248,249,250,253,264],"ul",{},[62,251,252],{},"The view underneath stays mounted, so when you close the dialog you land back exactly where you were — same scroll position, same expanded rows, same selections.",[62,254,255,256,259,260,263],{},"Close it with the ",[18,257,258],{},"✕"," in the dialog header, by pressing ",[18,261,262],{},"Esc",", or by clicking outside it.",[62,265,266,267,270],{},"A link to a neighbouring element ",[36,268,269],{},"inside"," the profile re-targets the same dialog rather than stacking a second one.",[14,272,273,274,45],{},"For what the profile shows, see ",[41,275,277],{"href":276},"\u002Fthreat-report\u002Fworking-with-findings","Working with Findings",[206,279,281],{"id":280},"filters-and-breadcrumb-chips","Filters and breadcrumb chips",[14,283,284,285,288,289,292,293,295],{},"When a filter is active, it appears as a chip in the breadcrumb row beneath the tab strip, showing the current view's name and each chip (for example ",[87,286,287],{},"band: High"," or ",[87,290,291],{},"open only","). Remove a filter by clicking the ",[18,294,258],{}," on its chip.",[14,297,298],{},"Two rules govern how filters combine:",[248,300,301,307],{},[62,302,303,306],{},[18,304,305],{},"Same kind is single-select."," Picking a second value of the same kind (for example a different severity band) replaces the first.",[62,308,309,312,313,45],{},[18,310,311],{},"Different kinds combine with AND."," A band filter and an \"open only\" filter together narrow to ",[36,314,315],{},"open findings in that band",[206,317,319],{"id":318},"deep-linking-from-posture","Deep-linking from Posture",[14,321,322,323,325,326,329,330,333,334,336],{},"Every statistic on the ",[18,324,20],{}," view is a link. Clicking one jumps you to the right detailed view ",[36,327,328],{},"already filtered",". Click a ",[18,331,332],{},"high"," exposure tile, for example, and you land in ",[18,335,176],{}," filtered to the high band, with that filter shown as a removable chip. This is the fastest way to move from \"something looks off\" to \"here are the exact findings.\"",[47,338,340],{"id":339},"the-shared-visual-language","The shared visual language",[14,342,343],{},"These four building blocks mean the same thing in every view. Learn them once.",[206,345,347],{"id":346},"severity-bands","Severity bands",[14,349,350,351,354],{},"Findings are sorted into five bands by their exposure score (a 0–10, CVSS-like number used purely for triage ordering — ",[36,352,353],{},"not"," a risk rating). Colour carries the band.",[105,356,359],{"className":357,"tabIndex":109,"role":110,"ariaLabel":358},[108],"Table: Severity bands",[113,360,361,374],{},[116,362,363],{},[119,364,365,368,371],{},[122,366,367],{},"Band",[122,369,370],{},"Score",[122,372,373],{},"Reading",[129,375,376,389,400,412,424],{},[119,377,378,383,386],{},[134,379,380],{},[18,381,382],{},"critical",[134,384,385],{},"9–10",[134,387,388],{},"Highest-priority exposures.",[119,390,391,395,398],{},[134,392,393],{},[18,394,332],{},[134,396,397],{},"7–8.9",[134,399],{},[119,401,402,407,410],{},[134,403,404],{},[18,405,406],{},"medium",[134,408,409],{},"4–6.9",[134,411],{},[119,413,414,419,422],{},[134,415,416],{},[18,417,418],{},"low",[134,420,421],{},"below 4",[134,423],{},[119,425,426,431,434],{},[134,427,428],{},[18,429,430],{},"unknown",[134,432,433],{},"no score",[134,435,436,437,439],{},"A finding with no score reads ",[18,438,430],{}," — never \"low\".",[27,441,442],{},[14,443,444,447],{},[18,445,446],{},"Why \"unknown\" matters."," An unscored finding is not a safe one — it's an unmeasured one. The report never quietly files it under \"low\".",[206,449,451],{"id":450},"data-sensitivity","Data sensitivity",[14,453,454],{},"Data carried by a flow is labelled with its classification. The report orders these by sensitivity but, like severity, never blends them into a single number.",[105,456,459],{"className":457,"tabIndex":109,"role":110,"ariaLabel":458},[108],"Table: Data sensitivity",[113,460,461,470],{},[116,462,463],{},[119,464,465,468],{},[122,466,467],{},"Label",[122,469,373],{},[129,471,472,482,491,500,510,524],{},[119,473,474,479],{},[134,475,476],{},[18,477,478],{},"Restricted",[134,480,481],{},"Most sensitive.",[119,483,484,489],{},[134,485,486],{},[18,487,488],{},"Confidential",[134,490],{},[119,492,493,498],{},[134,494,495],{},[18,496,497],{},"Internal",[134,499],{},[119,501,502,507],{},[134,503,504],{},[18,505,506],{},"Public",[134,508,509],{},"Least sensitive.",[119,511,512,517],{},[134,513,514],{},[18,515,516],{},"unclassified data",[134,518,519,520,523],{},"Data is in motion but not classified — a ",[18,521,522],{},"modeling gap",", surfaced as a flag, not a safe state.",[119,525,526,531],{},[134,527,528],{},[18,529,530],{},"no data",[134,532,533],{},"The flow carries no data items.",[27,535,536],{},[14,537,538,539,542],{},"Unclassified data crossing a boundary reads ",[18,540,541],{},"unknown \u002F unclassified",", never \"low\". It's flagged so you classify it, not so you can ignore it.",[206,544,546],{"id":545},"the-model-minimap","The model minimap",[14,548,549],{},"A small, faithful map of your model — it uses your real diagram layout, not an auto-layout — that appears as a building block inside several views (it is not a view of its own). On it:",[248,551,552,558,564,578],{},[62,553,554,557],{},[18,555,556],{},"Shapes encode type."," Processes and most nodes render as dots\u002Fcircles; external entities as rectangles; data stores in the two-line store convention.",[62,559,560,563],{},[18,561,562],{},"Highlights show focus."," The element(s) or route currently in focus are highlighted in cyan and drawn slightly larger; a highlighted route also lights up the connecting flow line. Crown jewels show in red, entry points in amber.",[62,565,566,569,570,573,574,577],{},[18,567,568],{},"It enlarges."," A compact map sits in a side pane with hover tooltips for labels; the ",[18,571,572],{},"expand"," button (top-left of the map) opens a larger ",[18,575,576],{},"Model overview"," dialog with full shapes and always-on labels.",[62,579,580,583],{},[18,581,582],{},"It can be interactive."," In some views, clicking a node on the map selects it.",[206,585,587],{"id":586},"attck-technique-chips","ATT&CK technique chips",[14,589,590,591,594],{},"Next to findings you'll see small monospace chips like ",[87,592,593],{},"T1190",". Each is a MITRE ATT&CK technique identifier and a launcher — nothing more.",[248,596,597,615],{},[62,598,599,600,603,604,607,608,611,612,45],{},"Click a chip to open the shared ",[18,601,602],{},"technique dialog",", which shows the technique's id and ",[18,605,606],{},"name",", its ",[18,609,610],{},"Tactics",", and a cleaned-up ",[18,613,614],{},"description",[62,616,617,618,620,621,624,625,45],{},"A chip is deliberately ",[36,619,353],{}," shaded by coverage. It tells you ",[36,622,623],{},"which"," technique a finding maps to, never whether you're defended against it — that accounting lives only in ",[18,626,147],{},[47,628,630],{"id":629},"the-posture-view","The Posture view",[14,632,633,635,636,639],{},[18,634,20],{}," is the default landing view and the only one that aggregates. It rolls everything up at a glance — but it deliberately shows ",[18,637,638],{},"no single risk score and no coverage percentage",". It segregates signals rather than blending them, so nothing flattering hides behind an average.",[14,641,642],{},"What you'll see, top to bottom:",[248,644,645,651,672,701,736,749,761],{},[62,646,647,650],{},[18,648,649],{},"A caveat line."," Stating that this is modeled \u002F design-asserted posture as of generation — not live telemetry or a scan — and that findings are not rolled into one score.",[62,652,653,656,657,660,661,664,665,668,669,671],{},[18,654,655],{},"Live exposures"," — outlined tiles, one per severity band that has live exposures, showing the count. A finding is ",[18,658,659],{},"live"," when it is untriaged ",[18,662,663],{},"or"," affirmed — an affirmed finding (shown with a ",[18,666,667],{},"\"Confirmed\""," tag) is a reviewed-and-confirmed risk, so it still counts as live residual risk. Only the muting dispositions drop a finding from this count. Click a tile to open ",[18,670,176],{}," filtered to that band. If there are none, the view says so honestly (distinguishing \"all findings dispositioned\" from \"nothing is modeled\").",[62,673,674,677,678,681,682,681,685,681,688,681,691,681,694,697,698,700],{},[18,675,676],{},"Coverage"," (when the coverage data is available) — tier-segregated lines (",[87,679,680],{},"DIRECT-prevent",", ",[87,683,684],{},"DIRECT-detect",[87,686,687],{},"Mitigation",[87,689,690],{},"D3FEND (broad\u002Finferred)",[87,692,693],{},"uncovered",[87,695,696],{},"soft\u002Funmapped","). Never a percentage, never a \"Covered: N\". Each line links to the ",[18,699,147],{}," matrix.",[62,702,703,706,707,681,710,681,713,716,717,719,720,722,723,725,726,681,729,732,733,45],{},[18,704,705],{},"Open \u002F dispositioned \u002F boundary-crossing counts"," — clickable stats (",[87,708,709],{},"N open",[87,711,712],{},"N dispositioned",[87,714,715],{},"N boundary crossings carrying data or posture",") that deep-link into their views. Clicking ",[87,718,709],{}," opens ",[18,721,176],{}," filtered to ",[87,724,291],{},". Warning markers ride alongside when they apply: ",[87,727,728],{},"⚠ N stale",[87,730,731],{},"· none dispositioned yet",", and ",[87,734,735],{},"⚠ N compensating-control claims with no control present",[62,737,738,741,742,745,746,748],{},[18,739,740],{},"Crown-jewel reachability"," (when reachability is available) — for example ",[36,743,744],{},"\"2 of 5 crown jewels reachable from external entry.\""," Click to open ",[18,747,157],{},". If no crown jewels or no external entry are modeled, it says so plainly rather than showing a flattering \"0 reachable\".",[62,750,751,754,755,757,758,45],{},[18,752,753],{},"Defense-in-depth"," — a separate positive line counting controls present on elements with no live exposure. It is explicitly ",[36,756,353],{}," folded into any coverage measure. Data elements are left out of it, as the coverage view leaves them out: Data is off the grid, and a data item's own controls are listed beside it in ",[41,759,147],{"href":760},"\u002Fthreat-report\u002Funderstanding-coverage#data-exposures-off-the-grid-but-disclosed",[62,762,763,766,767,770],{},[18,764,765],{},"Top residual risks"," — the ranked open findings, each row showing its severity band, name, the element it sits on, and an ",[87,768,769],{},"⛉ uncovered"," flag where no supporting control is present. Click a row to open that element's Component Profile.",[14,772,773],{},"Use Posture as a launchpad: scan the tiles and stats, then click straight through to the view that holds the detail.",[47,775,777],{"id":776},"the-boundary-crossings-view","The Boundary Crossings view",[14,779,780,782,783,786],{},[18,781,24],{}," lists every place a data flow crosses a security boundary. Each crossing carries ",[18,784,785],{},"two layers",":",[248,788,789,812],{},[62,790,791,792,795,796,799,800,803,804,807,808,811],{},"A ",[18,793,794],{},"declared policy line"," — the flow's declared source-zone ",[87,797,798],{},"↦"," target-zone, checked against your data-flow policy. Zones are the ones you ",[18,801,802],{},"declared"," (an administrative decision the report never recomputes); a verdict says the model ",[36,805,806],{},"as drawn"," encodes an illegal crossing — ",[18,809,810],{},"declared intent, not verified enforcement",", and never a claim the flow cannot happen.",[62,813,814,815,818,819,822,823,826],{},"The ",[18,816,817],{},"structural membranes"," below it — described as ",[18,820,821],{},"EXIT"," (data leaves a boundary) or ",[18,824,825],{},"ENTER"," (data enters one). This is containment, not a trust comparison.",[14,828,829],{},"The view has two panes:",[248,831,832,842],{},[62,833,834,837,838,841],{},[18,835,836],{},"A pinned minimap"," on the left that stays visible while the list scrolls. Click any crossing in the list to highlight its flow's endpoints and route on the map; use ",[18,839,840],{},"clear"," to deselect.",[62,843,844,847],{},[18,845,846],{},"The crossing list"," on the right.",[206,849,851],{"id":850},"reading-a-crossing","Reading a crossing",[14,853,854],{},"Each crossing is grouped by flow so its full containment story stays intact. For each one you'll see:",[248,856,857,867,943,960,993],{},[62,858,859,862,863,866],{},[18,860,861],{},"The flow name and its endpoints"," (",[87,864,865],{},"source → target","). All three are links that open the relevant Component Profile.",[62,868,869,872,873,876,877,71,880,883,884,887,888,891,892],{},[18,870,871],{},"The declared policy line"," — ",[87,874,875],{},"declared [SOURCE-ZONE] ↦ [TARGET-ZONE]",", with the domain relationship (",[87,878,879],{},"same-domain",[87,881,882],{},"cross-domain",") and, for control-plane flows, ",[87,885,886],{},"management plane",". ",[18,889,890],{},"Allowed crossings stay silent"," — just the muted zone-pair, never a green \"pass\". A crossing that breaks policy gets a left accent bar and one word:\n",[248,893,894,900,921,930,936],{},[62,895,896,899],{},[18,897,898],{},"VIOLATION"," — an illegal crossing (e.g. an EXPOSED boundary reaching directly into a RESTRICTED one, or a cross-domain hop into RESTRICTED).",[62,901,902,905,906,909,910,913,914,917,918,45],{},[18,903,904],{},"WARNING"," — a valid crossing that is missing a declared conduit (",[87,907,908],{},"conduit: missing","): required for cross-domain and external\u002Fpartner ",[36,911,912],{},"ingress",", recommended for management-plane (control-plane) flows. Outbound data ",[36,915,916],{},"leaving"," to the internet is judged as data-out: through a declared conduit it stays a warning (the report asks you to confirm the egress is intended); with no approved channel it is a ",[18,919,920],{},"violation",[62,922,923,926,927,929],{},[18,924,925],{},"ADVISORY"," — a soft \"review this\" (e.g. a below-RESTRICTED control-plane service writing into a RESTRICTED workload, or a RESTRICTED workload initiating an outbound flow). A plain workload calling a RESTRICTED management service (an app fetching from a secrets manager, shipping logs to a SIEM) is the expected hub-and-spoke shape and is ",[36,928,353],{}," flagged.",[62,931,791,932,935],{},[87,933,934],{},"conduit: error"," token marks a declared conduit that authorizes an illegal crossing — a conduit never legalizes a violation.",[62,937,938,939,942],{},"Conduits are ",[18,940,941],{},"zone-level",": a conduit declared from one boundary to another also covers crossings between their child boundaries (it inherits down the tree, on both the source and the peer side), so you don't declare one per pod. Inheritance is downward only — a conduit on a child never covers its parent's crossings.",[62,944,945,948,949,951,952,954,955,957,958,45],{},[18,946,947],{},"A sensitivity chip"," — the highest classification the flow carries (",[18,950,478],{}," … ",[18,953,506],{},"), or ",[18,956,516],{},", or ",[18,959,530],{},[62,961,962,965,966,288,968,970,971],{},[18,963,964],{},"The membranes pierced"," — one line per crossed boundary, tagged ",[18,967,821],{},[18,969,825],{},", with the boundary name (also a link). Against each boundary, two muted context markers may appear:\n",[248,972,973,983],{},[62,974,975,978,979,982],{},[18,976,977],{},"⚠ live on boundary"," — the crossed boundary has live exposures (a ",[36,980,981],{},"weakening"," signal: the crossing is easier).",[62,984,985,988,989,992],{},[18,986,987],{},"✓ boundary control"," — the crossed boundary has a covering control (a ",[36,990,991],{},"hardening"," signal: the crossing is costlier).",[62,994,995,872,998,21,1001,1004],{},[18,996,997],{},"On-flow posture",[87,999,1000],{},"flow: N live",[87,1002,1003],{},"flow control present"," where the flow itself carries exposures or a control.",[27,1006,1007],{},[14,1008,1009,1010,1012],{},"The membrane markers are context, never a red\u002Fgreen verdict and never coverage. The policy verdict is about the model ",[36,1011,806],{}," — a declared-intent check, not proof the flow is (or isn't) enforced.",[14,1014,791,1015,1018,1019,1022,1023,1026,1027,1030,1031,1034,1035,1038],{},[18,1016,1017],{},"conduit-error"," panel appears above the list when any declared conduit authorizes an illegal crossing (including ",[36,1020,1021],{},"dead"," conduits with no matching flow). Legally-declared conduits with no matching modeled flow appear in a muted ",[18,1024,1025],{},"dead intent"," list at the bottom (with their justification; a blank one reads ",[36,1028,1029],{},"unreviewable",") — worth a review, never a failure. A collapsed ",[18,1032,1033],{},"zone-tiers legend"," near the top explains the chips. Crossings are ranked ",[18,1036,1037],{},"verdict-severity first"," — a violation surfaces to the top even when the flow carries no classified data.",[206,1040,1042],{"id":1041},"honest-empty-and-under-modeled-states","Honest empty and under-modeled states",[14,1044,1045,1046,1049,1050,1053,1054,45],{},"Boundary Crossings never shows a reassuring blank. If no boundaries or no flows are modeled, it says the analysis isn't applicable. Crossings that are ",[18,1047,1048],{},"allowed and carry no data, no exposures, and no controls"," collapse into a single muted ",[18,1051,1052],{},"\"under-modeled\""," tail — present, never dropped, never counted as a clean result. A summary line at the top reads ",[87,1055,1056],{},"N flows pierce membranes · N violations · N warnings · N under-modeled",[27,1058,1059],{},[14,1060,1061,1064,1065,1067,1068,1071,1072,1074,1075,45],{},[18,1062,1063],{},"Where zoning advisories go."," Per-boundary zoning notes (an unclassified boundary, an under-protected asset holder, a management plane on an exposed tier, shared-domain cross-tier coupling) are ",[36,1066,353],{}," per-crossing, so they don't clutter this view — they appear as a compact, un-scored ",[18,1069,1070],{},"zoning advisories"," block in the ",[18,1073,176],{}," ledger. See ",[41,1076,277],{"href":1077},"\u002Fthreat-report\u002Fworking-with-findings#zoning-advisories",[47,1079,1081],{"id":1080},"where-to-go-next","Where to go next",[248,1083,1084,1094,1100,1111],{},[62,1085,1086,1090,1091,1093],{},[41,1087,1089],{"href":1088},"\u002Fthreat-report\u002Funderstanding-coverage","Understanding Coverage"," — read the ",[18,1092,147],{}," matrix and what each tier really claims.",[62,1095,1096,1099],{},[41,1097,157],{"href":1098},"\u002Fthreat-report\u002Freachability"," — trace flow routes from external entry to your crown jewels.",[62,1101,1102,1104,1105,1107,1108,1110],{},[41,1103,277],{"href":276}," — the ",[18,1106,176],{}," ledger and the ",[18,1109,242],{}," in depth.",[62,1112,1113,1117,1118,1120],{},[41,1114,1116],{"href":1115},"\u002Fthreat-report","Threat Report overview"," · ",[41,1119,44],{"href":43}," — generating and refreshing the snapshot.",{"title":1122,"searchDepth":1123,"depth":1123,"links":1124},"",3,[1125,1129,1135,1141,1142,1146],{"id":49,"depth":1126,"text":50,"children":1127},2,[1128],{"id":208,"depth":1123,"text":209},{"id":220,"depth":1126,"text":221,"children":1130},[1131,1132,1133,1134],{"id":224,"depth":1123,"text":225},{"id":235,"depth":1123,"text":236},{"id":280,"depth":1123,"text":281},{"id":318,"depth":1123,"text":319},{"id":339,"depth":1126,"text":340,"children":1136},[1137,1138,1139,1140],{"id":346,"depth":1123,"text":347},{"id":450,"depth":1123,"text":451},{"id":545,"depth":1123,"text":546},{"id":586,"depth":1123,"text":587},{"id":629,"depth":1126,"text":630},{"id":776,"depth":1126,"text":777,"children":1143},[1144,1145],{"id":850,"depth":1123,"text":851},{"id":1041,"depth":1123,"text":1042},{"id":1080,"depth":1126,"text":1081},"Navigating the report, the shared visual language, and the Posture and Boundary Crossings views","md",{"category":1150,"position":1123,"tags":1151},"documentation",[1152,1153,1154,1155,1156],"threat-report","reporting","navigation","posture","boundary-crossings",true,"\u002Fthreat-report\u002Freading-the-report",{"title":5,"description":1147},"04.threat-report\u002F02.reading-the-report","r2AFpTgiWC5Ecyr-tD5DesE1ZfH8d-KmClqVazHDs3Q",[1163,1218,1253,1308,1331,1374,1389,1459],{"title":1164,"description":1165,"path":1166,"stem":1167,"children":1168,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[1169,1173,1178,1183,1188,1193,1198,1203,1208,1213],{"title":1170,"path":1166,"stem":1171,"description":1172},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":1174,"path":1175,"stem":1176,"description":1177},"Quick Start","\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":1179,"path":1180,"stem":1181,"description":1182},"Building Your First Model","\u002Fplatform\u002Fbuilding-your-first-model","01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":1184,"path":1185,"stem":1186,"description":1187},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":1189,"path":1190,"stem":1191,"description":1192},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":1194,"path":1195,"stem":1196,"description":1197},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":1199,"path":1200,"stem":1201,"description":1202},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":1204,"path":1205,"stem":1206,"description":1207},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":1209,"path":1210,"stem":1211,"description":1212},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":1214,"path":1215,"stem":1216,"description":1217},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":1219,"description":1220,"path":1221,"stem":1222,"children":1223,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[1224,1228,1233,1238,1243,1248],{"title":1225,"path":1221,"stem":1226,"description":1227},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":1229,"path":1230,"stem":1231,"description":1232},"Installing the BYODt Deployment","\u002Fbyodt-cloud\u002Finstallation","02.byodt-cloud\u002F01.installation","Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy",{"title":1234,"path":1235,"stem":1236,"description":1237},"Configuring the BYODt Deployment","\u002Fbyodt-cloud\u002Fconfiguration","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":1239,"path":1240,"stem":1241,"description":1242},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":1244,"path":1245,"stem":1246,"description":1247},"Connecting the BYODt Deployment to the Cloud","\u002Fbyodt-cloud\u002Fcloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":1249,"path":1250,"stem":1251,"description":1252},"Troubleshooting the BYODt Deployment","\u002Fbyodt-cloud\u002Ftroubleshooting","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":1254,"description":1255,"path":1256,"stem":1257,"children":1258,"page":-1},"Dethereal","The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[1259,1263,1268,1273,1278,1283,1288,1293,1298,1303],{"title":1260,"path":1256,"stem":1261,"description":1262},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":1264,"path":1265,"stem":1266,"description":1267},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":1269,"path":1270,"stem":1271,"description":1272},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":1274,"path":1275,"stem":1276,"description":1277},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":1279,"path":1280,"stem":1281,"description":1282},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":1284,"path":1285,"stem":1286,"description":1287},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":1289,"path":1290,"stem":1291,"description":1292},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":1294,"path":1295,"stem":1296,"description":1297},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":1299,"path":1300,"stem":1301,"description":1302},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":1304,"path":1305,"stem":1306,"description":1307},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":56,"description":1309,"path":1115,"stem":1310,"children":1311,"page":-1},"The residual-risk report over a threat model: reading it, filtering it and exporting it.","04.threat-report",[1312,1315,1319,1320,1324,1328],{"title":56,"path":1115,"stem":1313,"description":1314},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":1316,"path":43,"stem":1317,"description":1318},"Getting Started with the Threat Report","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":5,"path":1158,"stem":1160,"description":1147},{"title":1321,"path":1088,"stem":1322,"description":1323},"Understanding Coverage and Gaps","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":1325,"path":1098,"stem":1326,"description":1327},"Reachability and Flow Routes","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":277,"path":276,"stem":1329,"description":1330},"04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":1332,"description":1333,"path":1334,"stem":1335,"children":1336,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[1337,1341,1346,1351,1355,1360,1364,1369],{"title":1338,"path":1334,"stem":1339,"description":1340},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":1342,"path":1343,"stem":1344,"description":1345},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":1347,"path":1348,"stem":1349,"description":1350},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":44,"path":1352,"stem":1353,"description":1354},"\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":1356,"path":1357,"stem":1358,"description":1359},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":5,"path":1361,"stem":1362,"description":1363},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":1365,"path":1366,"stem":1367,"description":1368},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":1370,"path":1371,"stem":1372,"description":1373},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":1375,"description":1376,"path":1377,"stem":1378,"children":1379,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[1380,1384],{"title":1381,"path":1377,"stem":1382,"description":1383},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":1385,"path":1386,"stem":1387,"description":1388},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":1390,"description":1391,"path":1392,"stem":1393,"children":1394,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[1395,1399,1404,1409,1414,1419,1424,1429,1434,1439,1444,1449,1454],{"title":1396,"path":1392,"stem":1397,"description":1398},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":1400,"path":1401,"stem":1402,"description":1403},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":1405,"path":1406,"stem":1407,"description":1408},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":1410,"path":1411,"stem":1412,"description":1413},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":1415,"path":1416,"stem":1417,"description":1418},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":1420,"path":1421,"stem":1422,"description":1423},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":1425,"path":1426,"stem":1427,"description":1428},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":1430,"path":1431,"stem":1432,"description":1433},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":1435,"path":1436,"stem":1437,"description":1438},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":1440,"path":1441,"stem":1442,"description":1443},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":1445,"path":1446,"stem":1447,"description":1448},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":1450,"path":1451,"stem":1452,"description":1453},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":1455,"path":1456,"stem":1457,"description":1458},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":1460,"description":1461,"path":1462,"stem":1463,"children":1464,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[1465,1469,1474],{"title":1466,"path":1462,"stem":1467,"description":1468},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":1470,"path":1471,"stem":1472,"description":1473},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":1475,"path":1476,"stem":1477,"description":1478},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748184880]