Threat modeling

A threat model is an attack sequence drawn over a catalogue of adversary tactics and techniques: which technique the attacker uses first, what it enables next, and where the chain finally reaches something you care about. Its purpose is not decoration — a threat model attaches to the risk scenarios it explains, so a probability score stops being an opinion and becomes an argument someone can follow step by step.

Where to find it

Risk → Threat modeling in the sidebar.

Key concepts

The catalogue

Every threat model is built over one TTP catalog — a library of adversary tactics and techniques such as MITRE ATT&CK or ATLAS. Catalogues are loaded like any other content, from Governance → Libraries, and appear under Catalog → TTP catalogs. The catalogue supplies the tactic lanes the graph is laid out in and the techniques you can place.

Nodes and edges

The graph is made of nodes joined by edges. There are three kinds of node:

Technique — an entry from the catalogue, placed in one of its tactics. A technique that belongs to several tactics can appear once per tactic, which is how a single technique serves both persistence and privilege escalation in the same chain.
Operator — an explicit AND or OR. AND requires every incoming step; OR accepts any of them. Use one when a stage genuinely needs two prerequisites rather than either.
Custom — a step with no catalogue equivalent: a business process, a physical action, an assumption.

Each node carries a Label and a Description, and can be marked as a Key step to highlight the pivotal moments in the chain.

Grounding a node

A node can point at the real things it touches: the Assets involved at that step, the Applied controls that would stop or detect it, and the Vulnerabilities it exploits. This is what turns the graph from a diagram into an analysis — you can see which steps are unguarded and which controls earn their place.

Building a model

Create the threat model, choose its domain and catalogue, then work through two views.

Select techniques shows the catalogue as its tactic matrix. Tick the techniques your attack uses — the counter tracks how many are selected — optionally hiding empty tactics, and save. The selected techniques become nodes on the graph.

Edit graph is where the sequence is drawn. The palette on the left offers the catalogue’s techniques with search; Add a step inserts a custom node or a logic operator. Drag nodes between tactic lanes, drag from one node to another to draw an edge, and select a node to edit its context in the inspector on the right — label, description, key-step flag, logic operator, and its asset, control and vulnerability links. Auto-link draws an edge from every technique to every technique in the next occupied tactic, keeping existing edges, which gets a linear chain laid out in one action. Unsaved changes are flagged, and can be saved or discarded.

Graph is the read-only view of the finished sequence.

Linking to risk

From a risk scenario or a CRQ scenario, attach the threat model that justifies it — the attack sequence behind the score. A single model can back several scenarios, and a scenario can reference more than one model.

Risk scenarios — what a threat model justifies.
CRQ studies — quantitative scenarios link to threat models too.
Threats — the coarser-grained catalogue used by risk scenarios.
Feature flags — turning the module on.