Before diagrams become available to use in projects, administrators must enable the feature. This is a one-time operation and also requires that you enable Reusable Components.

We have a beta where diagrams generate Threats, Weaknesses and Countermeasures. In order to access this functionality, you turn it on via the API with the ENABLE_ACORN feature flag, as a user with permissions to turn on feature flags.

The diagrams feature is now activated and available for use in this SD Elements instance.

Diagrams supplement the Survey. Diagramming activities are optional, and survey answers that correspond to an element on a diagram will be pre-populated.

To create a threat model diagram, follow the steps below.

You can edit a threat model diagram after creating it. The canvas offers various controls to manipulate both the diagram and the canvas itself.

To edit a diagram on the Diagram canvas, follow the steps below.

The diagram is immediately updated with your changes.

To share a diagram with others, follow the steps below.

Locking and unlocking a diagram involves locking or unlocking the associated Project Survey. By extension, locking or unlocking a Survey locks or unlocks its corresponding diagram.

Your diagram is carried over with subsequent releases of your project in SD Elements. As your codebase evolves, so will your Project Survey, and along with it, your threat modeling diagram. See Create a release project for more information.

By default, the diagrams feature is enabled. You can disable the diagram feature in SD Elements by completing the following steps. In 2023.4, a beta feature for diagrams provides the ability to generate Threats, Weaknesses, and Countermeasures from a saved diagram.

Diagrams are now disabled and are no longer a part of the Project Survey workflow.

You can surface threats in the threat model diagram and what weaknesses and countermeasures they’re made up of, in the UI or the API. Threats are comprised of weaknesses and are solved by countermeasures.

Threats help you understand the 'Why' behind countermeasures that are being worked on in an effort to better inform and prioritize security requirements. Threats also ensure that security teams are prioritizing the right work to have a positive impact on their security posture. Threats are visible on the right hand side of the threat model diagram.

Threats Feature Flag Threats can be hidden on the diagram canvas and at the project level for customers who customize the majority of their content. This allows you to prevent having empty threats pages in the project surfaced to customers.

Threats, Weaknesses, and Countermeasures

Threats have a many-to-many relationship to Weaknesses, with multiple Weaknesses able to make up a threat.

How are threats applied to a project?

Threats are applied to a project when you have saved the diagram canvas. Threats associated with the components used on the diagram canvas will be present in the Threats button or Threats list page. If you have saved the survey, before navigating to the diagram, the threats button will display threats coming from the survey answers. Specifically, threats whose match conditions align with those of the the survey answers you have selected.

Where does Threat status come from?

Threat status comes from the Countermeasure status:

The following is a comprehensive list of built-in components available for threat model diagrams as of SD Elements v2022.2.