threat

ArchiMate / Open Group Equivalent: Threat Event / Risk Vector (Security Architecture Aspect)

Represents a security threat, adversary attack vector, or threat vector categorized under threat modeling taxonomies (such as STRIDE).

Visual Styling

To apply custom icons, borders, or colors to threats, use a Style Rule (e.g. style threat where likelihood == "Critical" { icon "alert-triangle" custom_css "fill: #450a0a;" }).

---

Syntax

threat <id> "<Display Name>" {
    description "<text>"
    owner "<team>"
    tags ["tag1", "tag2"]
    category "Spoofing" | "Tampering" | "Repudiation" | "Info Disclosure" | "DoS" | "Privilege Escalation"
    likelihood "Critical" | "High" | "Medium" | "Low" | "Very Low"
    impact "Critical" | "High" | "Medium" | "Low" | "Very Low"
    risk_rating "Critical" | "High" | "Medium" | "Low" | "Very Low"
    probability <number_0_to_1>
    mitigation_status "Open" | "Mitigated" | "Accepted"

    relationships { ... }
}

---

Properties

Property	Type	Allowed Values	Description
description	string	Free text	Attack scenario narrative and prerequisites
owner	string	Free text	Responsible security triage owner
tags	string[]	Array of strings	Categorization tags (e.g. tags ["stride", "api-sec"])
category	enum	"Spoofing", "Tampering", "Repudiation", "Info Disclosure", "DoS", "Privilege Escalation"	STRIDE threat classification
likelihood	enum	"Critical", "High", "Medium", "Low", "Very Low"	Likelihood of exploitation
impact	enum	"Critical", "High", "Medium", "Low", "Very Low"	Severity of architectural damage
risk_rating	enum	"Critical", "High", "Medium", "Low", "Very Low"	Combined risk score
probability	number	0.0 to 1.0	Quantitative probability estimate
mitigation_status	enum	"Open", "Mitigated", "Accepted"	Current resolution state

---

Allowed Relationship Verbs & Targets

Verb	ArchiMate / Security Relation	Allowed Target Entity Types
targets	Exploitation	capability, process, system, app, component, infrastructure, data_object, actor, agent, trust_boundary
governed_by	Governance	policy, standard

---

Complete Example

threat threat_sql_injection "SQL Injection Attack" {
    description "Adversary injects malicious SQL statements via unescaped search parameters"
    category "Tampering"
    likelihood "High"
    impact "Critical"
    risk_rating "Critical"
    probability 0.35
    mitigation_status "Mitigated"
    tags ["owasp-top-10", "injection"]

    relationships {
        this targets app_customer_portal "Targets legacy search endpoint"
        this targets data_customer_record "Aims to exfiltrate customer records"
        this governed_by pol_appsec_standards
    }
}