Frequently Asked Questions (FAQ)¶

General Questions¶

What is ThreatForest?¶

ThreatForest automates threat modeling by analyzing your project and generating comprehensive attack trees with MITRE ATT&CK mappings and mitigation strategies.

→ Learn More

What is an attack tree?¶

An attack tree visualizes attack scenarios:

• Root: High-level threat (e.g., "Data breach")
• Paths: Different attack routes
• Steps: Specific actions per path
• MITRE: Technique IDs (e.g., T1190)
• Mitigations: Defensive controls

Who should use ThreatForest?¶

ThreatForest is designed for security professionals, developers, and compliance teams:

• Security Teams - Automate threat modeling
• DevSecOps - Integrate into CI/CD
• Architects - Understand security implications
• Compliance - Document threat landscapes

Is ThreatForest free?¶

Yes, open-source under MIT License. You need LLM provider access:

• AWS Bedrock - Requires AWS account
• Anthropic/OpenAI - Requires API keys (paid)
• Ollama - Free local use

Getting Started¶

What are the prerequisites?¶

Required:

• Python 3.11 or higher
• LLM provider (AWS Bedrock, Anthropic, OpenAI, or Ollama)

Recommended:

• ThreatComposer file or documentation
• Architecture diagrams

→ Installation Guide

Can I try ThreatForest without AWS?¶

Yes! ThreatForest supports multiple providers:

• Ollama - Completely local, no cloud
• Anthropic - Direct API access
• OpenAI - Direct API access
• Google Gemini - Direct API access

Configure in the wizard or config.yaml.

Features & Functionality¶

What file formats does ThreatForest support?¶

Threat Models:

• ThreatComposer (.tc, .tc.json) ⭐ Recommended
• JSON, YAML, Markdown

Diagrams:

• PNG, JPG, PDF, Mermaid, Draw.io, PlantUML

Documentation:

• Markdown, PDF, text files

→ Preparing Your Project

Can ThreatForest analyze my existing threat model?¶

Yes! ThreatForest can:

• Import ThreatComposer workspaces
• Parse JSON/YAML/Markdown threats
• Enrich with MITRE ATT&CK mappings
• Generate attack trees
• Add mitigation recommendations

→ Input Files Guide

What is MITRE ATT&CK mapping?¶

MITRE ATT&CK is a framework of adversary tactics and techniques. ThreatForest maps each attack step to relevant techniques using:

• Semantic similarity matching
• Vector embeddings
• Confidence scoring (0.0-1.0)

This helps you understand attacks in standardized terminology and plan defenses using industry best practices.

→ How It Works

How accurate is the AI-generated content?¶

Quality depends on:

• LLM model (Claude 3.5 Sonnet recommended)
• Documentation quality
• Threat description completeness

Best practices:

• Review all outputs
• Validate MITRE mappings
• Customize mitigations
• Iterate and refine

→ Best Practices

Privacy & Security¶

Is my code sent to the LLM provider?¶

Data sent:

• Application details and architecture
• Threat descriptions
• Documentation content
• Diagram descriptions

Privacy options:

• ✅ Ollama - Complete privacy (local)
• ✅ AWS Bedrock - Enterprise data handling
• ⚠️ Others - Review provider policies

→ Data Privacy Guide

How do I protect sensitive information?¶

Troubleshooting¶

Error: 'externally-managed-environment'¶

Solution: Use pipx instead:

pipx install -e .

Error: 'Bedrock access failed'¶

Solution:

# Configure AWS credentials
aws configure

# Verify access
aws bedrock list-foundation-models --region us-east-1

# Check IAM permissions include:
# - bedrock:InvokeModel
# - bedrock:InvokeModelWithResponseStream

Very slow first run¶

Why is ThreatForest slow?¶

Performance factors:

• Model - Haiku (fast), Sonnet (balanced), Opus (slow)
• Project size - More threats = longer time
• Network - Latency to LLM provider
• Hardware - Local models need CPU/GPU

Speed optimization:

• Use AWS Bedrock or Anthropic
• Select Claude 3 Haiku for faster results
• Process threats incrementally

ThreatForest fails with "API rate limit exceeded"¶

Solutions:

• Wait and retry (automatic retry logic)
• Reduce concurrency
• Upgrade provider plan
• Switch providers

The attack trees don't match my application¶

Common causes:

• Incomplete documentation
• Generic threat descriptions
• Missing architecture context

Improvements:

• Add detailed architecture diagrams
• Include technology stack docs
• Write specific threat descriptions
• Use ThreatComposer format

→ Preparing Your Project

Dashboard Won't Open¶

Solutions:

1. Check file exists in output directory
2. Try different browser
3. Check file permissions
4. Clear browser cache (Cmd/Ctrl+Shift+R)

Graph Not Displaying¶

Solutions:

1. Enable JavaScript in browser
2. Check browser console for errors (F12)
3. Verify threatforest_data.json exists
4. Clear browser cache

Slow Dashboard Performance¶

Solutions:

1. Use filters to reduce visible threats
2. Close other browser tabs
3. Update to latest browser version
4. Reduce zoom level

Missing Threat Details¶

Solutions:

1. Regenerate analysis
2. Check data file integrity
3. Verify analysis completed successfully
4. Review state file for errors

Manual Recovery: State Corruption¶

Solution:

# Delete state file and restart
rm project/threatforest/attack_trees/.threatforest_state.json
threatforest

Manual Recovery: Partial Results¶

Solution:

# Review state file to identify completed threats
cat project/threatforest/attack_trees/.threatforest_state.json

# Resume or restart as needed
threatforest  # Will detect existing state and offer to resume

Can I customize the output format?¶

Yes! ThreatForest generates:

• Markdown - Easily customizable
• JSON - For programmatic access
• HTML - Interactive dashboard

You can modify templates and parse JSON for custom reporting.

→ Customization Guide

Integration & Advanced¶

Does ThreatForest support multiple languages?¶

Analysis is language-agnostic. ThreatForest analyzes:

• Architecture and design (not code directly)
• Threat descriptions (any language supported by LLM)
• Configuration files
• Data flow diagrams

LLM responses are in English.

Can I contribute to ThreatForest?¶

Absolutely! Contributions welcome:

• Bug reports on GitHub
• Feature requests
• Code contributions (pull requests)
• Documentation improvements

→ Contributing Guide

Still Have Questions?¶