documentation

[jeremyng123]

Hi devs!

Thank you so much for this repo. i have been looking for a tool that can automate a threat model designing and integrate it into a ci/cd

Threagile seems to be designed to target such needs.

However, i am trying to look for documentations for using the tool but unable to find a link for that.

May I ask that you direct me to a documentation page for using such tools?

[jamfwright]

I second this request. Great documentation will lead to great adoption of this tool. Threagile is quite good and I've already spent several hours with it this week to determine if my company can adopt the tool as part of our regular operations.

The biggest shortcomings of missing documentation with this tool that I've noticed so far:

1. It's hard to truly know what contexts will change depending on what I choose during configuration. Maybe it's intended to be more vague in order to be more flexible - but I'd like to know what to expect based on configuration adjustments. For example - in the technical assets section I can set an asset to be multi tenant or not. What does this mean? Not everything is cloud, but I think cloud first. Or does it mean multiple users can access? Or multiple data types stored? Or multiple organizations can process data on this asset? I have no idea :) It's hard to feel really good about a threat model when I can't explain the configuration choices.
2. Docker - I love it but the command line provided doesn't work, I had to make some adjustments for write permissions. It's also unclear to me as to how to create new rules and insert them into the docker container (or maybe there is another way?) I do appreciate the ability to leverage docker though.

The tool is very good and I see that this can be useful to many people and organizations. The IDE integratio is first class and really reduces the amount of time to create a new model. Proper documentation is really going to bring this project up a notch, making it more easily adopted. The time spent learning by testing was costly - but I'm glad I did it.

Maybe too visionary - but having a library of assets that can be called to auto-populate all child models would be super. Maybe that would be a different tool.

[srcnuzn]

I've also just started evaluating Threagile for our company. First impression is great, but a more detailed documentation explaining available options in schema.json would be highly appreciated.

[joreiche]

We are working on adding and updating documentation. in the meantime, Threagile has built-in commands that list available options:

• list-risk-rules
• list-model-macros
• list-types

I think list-types is what you are looking for.