# Extensibility & Customization

## Configuration Files

- **[Customizing Scoring](customizing_scoring.md)** — tune STRIDE base scores,
  severity thresholds, VOC deltas, Jaccard dedup threshold, and technique mapper
  boosts via `config/scoring_config.yaml`.
- **[Customizing Prompts](customizing_prompts.md)** — edit the LLM prompt templates
  used for STRIDE generation, Attack Flow, and RAG queries via `threat_analysis/config/prompts.yaml`.

## Model Capabilities

-   **STRIDE Threat Detection**: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege.
-   **MITRE ATT&CK Mapping**: Each STRIDE threat is mapped to one or more MITRE ATT&CK techniques and tactics.
-   **Severity Calculation**:
    -   Base scores per STRIDE category.
    -   Target multipliers per STRIDE category.
    -   Protocol-based adjustments (e.g., HTTP vs HTTPS).
-   **Diagram Generation**:
    -   DOT, SVG, and HTML diagrams with threat highlights and legends.
-   **Report Generation**:
    -   HTML report with summary, statistics, threat details, and recommendations.
    -   JSON export for integration or further analysis.
-   **Extensibility**:
    -   Add new STRIDE categories or custom threat patterns.
    -   Extend MITRE mappings.
    -   Customize severity logic.
    -   Integrate with PyTM models and features.

## PyTM-Based Extensions & Evolutions

You can use and extend all PyTM features, including:

-   **Custom Threat Patterns**: Define new threat types and detection logic.
-   **Advanced Dataflow Modeling**: Use PyTM's dataflow and element types.
-   **Integration with PyTM Plugins**: Use or develop plugins for reporting, risk scoring, or compliance.
-   **Automated Testing**: Integrate with PyTM's test harness for CI/CD.
-   **Custom Reports**: Extend the reporting module to output in any format (PDF, Excel, etc.).
-   **Visualization**: Use PyTM's or your own visualization tools for advanced diagrams.

## Data Sources

### STRIDE to CAPEC Mapping

The `threat_analysis/external_data/stride_to_capec.json` file, which provides mappings from STRIDE threats to CAPEC patterns, is generated by the `tooling/download_stride_mappings.py` script. This script parses the content from the markdown files available at [Osterling's CAPEC-STRIDE Mapping page](https://ostering.com/capec-stride-mapping/index.html).