Tutorial: Build a Threat Model

1. Assets

STRIDE analysis inspects AssetNodes; describe what is worth protecting first.

using Beep.Skia;
using Beep.Skia.Security;

var manager = new DrawingManager();

var db = new AssetNode { X = 60, Y = 80, Width = 200, Height = 90, AssetName = "Customer database" };
var api = new AssetNode { X = 340, Y = 80, Width = 200, Height = 90, AssetName = "Public API" };
manager.AddComponent(db);
manager.AddComponent(api);

2. Controls and vulnerabilities

var waf = new ControlNode { X = 340, Y = 240, Width = 200, Height = 80, Label = "WAF" };
var vuln = new VulnerabilityNode { X = 60, Y = 240, Width = 200, Height = 80, Label = "Unpatched DB", Cve = "CVE-2024-0001" };
manager.AddComponent(waf);
manager.AddComponent(vuln);

manager.ConnectComponents(api, waf);
manager.ConnectComponents(db, vuln);

3. Run STRIDE

The analyzer produces a threat per asset with category, mitigation and severity.

var analyzer = new StrideAnalyzer();
analyzer.Analyze(manager.GetComponents());

foreach (var threat in analyzer.Threats)
    Console.WriteLine($"[{threat.Category}] {threat.AssetName}: {threat.Threat} ({threat.Severity})");

4. Score with DREAD

Each threat already carries a DreadScore; you can also score threat nodes directly or in bulk from severity/likelihood pairs.

foreach (var threat in analyzer.Threats)
    Console.WriteLine($"{threat.Threat}: {threat.Dread.Average:0.0} ({threat.Dread.RiskLevel})");

5. Map to MITRE ATT&CK

foreach (var technique in MitreAttackLibrary.ForStrideCategory(StrideAnalyzer.StrideCategory.Tampering))
    Console.WriteLine($"{technique.Id} {technique.Name} ({technique.Tactic})");

var specific = MitreAttackLibrary.Find("T1190");
Console.WriteLine($"lookup: {specific}");

Materialize the threats as nodes on the canvas so they can be reviewed and linked to controls (the sample does exactly that).