The Diagram canvas opens after you complete a project Survey and click Continue to diagram. Upon opening, the canvas is blank.

Icons, representing project components selected in the Survey, become visible when you click Generate a diagram. After generating a diagram on the canvas, you can edit, share, or lock it.

The canvas allows you to save the diagram, go back to the survey, or continue to the project summary page.

The Diagram tool offers three sets of control found on the canvas.

After generating a diagram with system components selected in the Survey, you can add more components to the canvas based on the needs of your threat modeling process. See the full list of built-in components here.

To add a component on the Diagram canvas, follow the steps below.

Right-click the component to see more options: Connect, Group, Label, and Delete.

Trust zones represent a specified area of a threat model diagram within which all components and connectors have the same level of trust. Logically, there is a common security level within a threat modeling trust zone. One software component inside a trust zone considers other elements within the same zone to have its own level of integrity and confidentiality.

To add a trust zone on the Diagram canvas, follow the steps below.

Right-click the zone to see more options: Connect, Label, Border, Color, and Delete.

Nested trust zones

Trust zones within a threat model diagram can have the same level of trust, implying that components within those trust zones also share the same level of trust. SD Elements supports the nesting of trust zones as a way to illustrate a common level of integrity and confidentiality.

Support for nested zones allows organizations to consistently ensure threat model diagrams generated using SD Elements accurately display the software architecture.

You can add a zone to another zone by right-clicking into the context menu or by way of a keyboard shortcut (Ctrl+g for Windows or Cmd+g for macOS). You can also ungroup nested zones with these same methods.

Connectors illustrate how data moves through a system.

To add a connector on the Diagram canvas, follow the steps below.

Right-click the connector to see more options: Style, Label, Flip, and Delete.

Text boxes provide a way to add notes to a diagram for purposes of sharing context with the diagram audience. This way, collaborative information is preserved when no one is available to walk the audience through a diagram.

You can add a text box to a diagram through the toolbar pallette or by pressing t on your keyboard as a shortcut.

The threats list page is available in the project diagram where you have the ability to do the following: - Search for threats based on the title or threat ID - Filter for threats based on: - CAPEC ID: Where applicable, threats are mapped to CAPEC attack patterns. - STRIDE methodology: Where applicable, threats are mapped to a STRIDE category. - Component: Where applicable, threats are tied to their relevant components. - Severity: Countermeasure severity level. - Identify the related Countermeasures and Weaknesses for that specific threat: - Assign users to the countermeasure - Mark the status of associated countermeasures