Threat
Represents a threat identified during threat modeling.
Contents
- anchor
-
The DFD element this threat is anchored to.
Type: ThreatAnchorShape object
Required: No
- comments
-
Optional customer comment on the threat.
Type: String
Required: No
- createdAt
-
The date and time the threat was created, in UTC format.
Type: Timestamp
Required: No
- createdBy
-
Who created this threat.
Type: String
Valid Values:
CUSTOMER | AGENTRequired: No
- evidence
-
The source code files supporting the threat.
Type: Array of ThreatEvidenceShape objects
Required: No
- impactedAssets
-
The specific assets affected by the threat.
Type: Array of strings
Required: No
- impactedGoal
-
The security goals affected by the threat.
Type: Array of strings
Required: No
- prerequisites
-
The conditions required for the threat to be exploitable.
Type: String
Required: No
- recommendation
-
The recommended mitigation guidance for this threat.
Type: String
Required: No
- severity
-
The severity level of the threat.
Type: String
Valid Values:
CRITICAL | HIGH | MEDIUM | LOW | INFORequired: No
- statement
-
The natural-language threat statement.
Type: String
Required: No
- status
-
The current status of the threat.
Type: String
Valid Values:
OPEN | RESOLVED | DISMISSEDRequired: No
- stride
-
The STRIDE categories applicable to this threat.
Type: Array of strings
Valid Values:
SPOOFING | TAMPERING | REPUDIATION | INFORMATION_DISCLOSURE | DENIAL_OF_SERVICE | ELEVATION_OF_PRIVILEGERequired: No
- threatAction
-
What the threat source can do.
Type: String
Required: No
- threatId
-
The unique identifier of the threat.
Type: String
Required: No
- threatImpact
-
The direct consequence of the threat action.
Type: String
Required: No
- threatJobId
-
The unique identifier of the threat model job that produced the threat.
Type: String
Required: No
- threatSource
-
The actor or origin of the threat.
Type: String
Required: No
- title
-
A short title summarizing the threat.
Type: String
Required: No
- updatedAt
-
The date and time the threat was last updated, in UTC format.
Type: Timestamp
Required: No
- updatedBy
-
Who last updated this threat.
Type: String
Valid Values:
CUSTOMER | AGENTRequired: No
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
