Threatcl：一款威胁模型记录与归档工具

git clone https://github.com/threatcl/threatcl.git

cd threatclmake bootstrapmake build

brew install threatcl/repo/threatcl

docker run --rm -it ghcr.io/threatcl/threatcl:latest

$ threatclUsage: threatcl [--version] [--help] <command> [<args>]Available commands are:    dashboard    从现有的HCL威胁模型文件生成标记文件    dfd         从现有的HCL威胁模型文件生成数据流图PNG或DOT文件    export       将威胁模型导出为其他格式    generate     生成HCL威胁模型    list         列出HCL文件中发现的威胁模型    terraform    解析'terraform show-json'的输出    validate     验证现有的HCL Threatmodel文件    view        查看现有的HCL Threatmodel文件

$ threatcl list examples/*#  File              Threatmodel      Author1  examples/tm1.hcl  Tower of London  @xntrik2  examples/tm1.hcl  Fort Knox        @xntrik3  examples/tm2.hcl  Modelly model    @xntrik

$ threatcl validate examples/*Validated 3 threatmodels in 3 files

$ threatcl export -format=otm examples/tm1.hcl[{"assets":[{"description":"including the imperial state crown","id":"crown-jewels","name":"crown jewels","risk":{"availability":0,"confidentiality":0,"integrity":0}}],"mitigations":[{"attributes":{"implementation_notes":"They are trained to be guards as well","implemented":true},"description":"Lots of guards patrol the area","id":"lots-of-guards","name":"Lots of Guards","riskReduction":80}],"otmVersion":"0.2.0","project":{"attributes":{"initiative_size":"Small","internet_facing":true,"network_segment":"dmz","new_initiative":true},"description":"A historic castle","id":"tower-of-london","name":"Tower of London","owner":"@xntrik"},"threats":[{"categories":["Confidentiality"],"description":"Someone who isn't the Queen steals the crown","id":"threat-1","name":"Threat 1","risk":{"impact":0,"likelihood":null}}]},{"assets":[{"description":"Lots of gold","id":"gold","name":"Gold","risk":{"availability":0,"confidentiality":0,"integrity":0}}],"mitigations":[{"attributes":{"implemented":true},"description":"A large wall surrounds the fort","id":"big-wall","name":"Big Wall","riskReduction":80}],"otmVersion":"0.2.0","project":{"attributes":{"initiative_size":"Small","internet_facing":true,"new_initiative":false},"description":"A .. fort?","id":"fort-knox","name":"Fort Knox","owner":"@xntrik"},"threats":[{"categories":["Confidentiality"],"description":"Someone steals the gold","id":"threat-1","name":"Threat 1","risk":{"impact":0,"likelihood":null}}]}]

threatcl generate interactive

threatmodel "Tower of London" {  description = "A historic castle"  author = "@xntrik"  attributes {    new_initiative = "true"    internet_facing = "true"    initiative_size = "Small"  }  information_asset "crown jewels" {    description = "including the imperial state crown"    information_classification = "Confidential"  }  usecase {    description = "The Queen can fetch the crown"  }  third_party_dependency "community watch" {    description = "The community watch helps guard the premise"    uptime_dependency = "degraded"  }  threat {    description = "Someone who isn't the Queen steals the crown"    impacts = ["Confidentiality"]    expanded_control "Guards" {      description = "Trained guards patrol tower"      risk_reduction = 75    }  }  data_flow_diagram_v2 "dfd name" {    // ... see below for more information  }}