pip install threatmap
threatmap scan ./examples --output report.md --fail-on HIGH

docker run -v $(pwd):/workspace bogdynn/threatmap:2.1.0 threatmap scan /workspace --output /workspace/report.md

threatmap serve --host 0.0.0.0 --port 8000
# 또는 Docker 사용:
docker run -p 8000:8000 bogdynn/threatmap:2.1.0
# API 엔드포인트: /health, /version, /rules, /analyze

docker run -p 8000:8000 bogdynn/threatmap:2.1.0
# GraphQL 엔드포인트: http://localhost:8000/graphql
# 쿼리: health, version, rules
# 뮤테이션: analyze(content, filename, framework)

pip install threatmap

git clone https://github.com/bogdanticu88/threatmap.git
cd threatmap
pip install -e .

threatmap scan ./terraform/

threatmap scan ./terraform/ ./k8s/ ./cloudformation/ --format json --output report.json

threatmap scan ./infra/ --format html --output report.html
threatmap scan ./infra/ --format sarif --output report.sarif

threatmap scan ./infra/ --fail-on HIGH --output threat-report.md

threatmap scan ./infra/ --summary

threatmap scan ./infra/ --ascii --output report.md

# STRIDE (기본값)
threatmap scan ./infra/ --framework stride

# MITRE ATT&CK (전술 및 기술에 매핑)
threatmap scan ./infra/ --framework mitre --format json

# PASTA (자산 중심 위협 모델링)
threatmap scan ./infra/ --framework pasta --format json

### T-002 — Spoofing (CRITICAL)

Resource:   AWS::EC2::SecurityGroup.WebSecurityGroup
Property:   ingress.ssh_rdp_open
Finding:    Security group 'WebSecurityGroup' exposes SSH/RDP (port 22/3389) to 0.0.0.0/0.
Mitigation: Remove public SSH/RDP access. Use AWS Systems Manager Session Manager
            or a bastion host with IP restrictions.

flowchart LR
    Internet((Internet))
    subgraph Networking
        aws_security_group_web_sg{web_sg}
        NetworkPolicy_default_deny{default-deny}
        azurerm_network_security_group_app_nsg{app_nsg}
    end
    subgraph Compute
        aws_instance_web[web]
    end
    subgraph Kubernetes
        Namespace_myapp[myapp]
        Deployment_api[api]
        Service_api_svc[api-svc]
        Ingress_api_ingress[api-ingress]
    end
    subgraph Data
        aws_s3_bucket_app_data[(app_data)]
        aws_db_instance_app_db[(app_db)]
        azurerm_storage_account_app_storage[(app_storage)]
    end
    subgraph Security
        azurerm_key_vault_app_kv[app_kv]
    end
    subgraph Identity
        azurerm_role_assignment_app_contributor[/app_contributor/]
    end
    AWS__S3__Bucket_AppBucket -->|ref| AWS__S3__Bucket_AuditBucket
    AWS__CloudTrail__Trail_AppTrail -->|ref| AWS__S3__Bucket_AuditBucket
    Internet -->|HTTPS| Ingress_api_ingress
    style aws_security_group_web_sg fill:#ff4444,color:#fff
    style aws_s3_bucket_app_data fill:#ff4444,color:#fff
    style aws_instance_web fill:#ff8800,color:#fff
    style Deployment_api fill:#ff8800,color:#fff
    style azurerm_key_vault_app_kv fill:#ffcc00,color:#000
    style azurerm_network_security_group_app_nsg fill:#ff8800,color:#fff
    style azurerm_role_assignment_app_contributor fill:#ff4444,color:#fff

rules:
  - resource_type: "aws_s3_bucket"
    property: "force_destroy"
    expected: false
    stride: "Tampering"
    severity: "MEDIUM"
    description: "프로덕션 버킷은 force_destroy를 활성화해서는 안 됩니다."
    mitigation: "force_destroy = false로 설정하십시오."

threatmap/analyzers/
├── aws.py         # 22개 규칙 — S3, IAM, EC2, RDS, EKS, CloudTrail, KMS, Lambda
├── azure.py       # 19개 규칙 — Storage, Key Vault, NSG, RBAC, AKS, ACR, SQL
├── gcp.py         # 15개 규칙 — GCS, Firewall, Compute, Cloud SQL, GKE, IAM, KMS
└── kubernetes.py  # 17개 규칙 — workloads, RBAC, network, secrets

# .github/workflows/threat-model.yml
name: Threat Model

on: [pull_request]

jobs:
  threatmap:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"

      - name: Install threatmap
        run: pip install threatmap

      - name: Run threat model scan
        run: |
          threatmap scan ./infra/ \
            --format markdown \
            --output threat-report.md \
            --fail-on HIGH

      - name: Upload threat report
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: threat-report
          path: threat-report.md

pytest tests/ -v

pytest tests/ --cov=threatmap --cov-report=term-missing