Agile Threat Modeling Toolkit
Threagile (see threagile.io for more details) is an open-source toolkit for agile threat modeling:
It allows to model an architecture with its assets in an agile fashion as a YAML file directly inside the IDE. Upon execution of the Threagile toolkit all standard risk rules (as well as individual custom rules if present) are checked against the architecture model. You can find more information about model schema here.
The tool have various commands and is highly configurable via flags and config.
We know that modifying yaml file via text editor may be tough and to simplify it we introduced:
Custom risk rules can be written as YAML scripts without compiling Go code. See the script language reference, the guide for writing custom risk rules, and how to test your scripts.
Efforts on UI are ongoing and there are few attempts to do it although that is far from being ready.
Here may be useful use cases on how others are using the tool and may be helpful to simplify onboarding of Threagile tool for your team.
The easiest way to execute Threagile on the commandline is via its Docker container:
docker run --rm -it threagile/threagile --help
Which will give you an output with possible flags that can be used with Threagile.
…
The information about releases can be found at releases page.
You are very welcome to contribute into the project in any way. If you'd like to add new feature or fix the bug in the code base please follow contribution guide.
Otherwise please create GitHub discussion or issue and contributors will find some time to respond.
No open issues yet, or sync has not completed.