Ignore default generated threats in report

[harsh02]

Hello,

I am building threat models for embedded devices and most of the generated threats by tool are not much relevant. I have my own threats library I have added in threats.json. Is there any simple way to report not show default threats of elements. That way I can show only threats I added.

Thanks!

[izar]

Did you try the --exclude flag? It is probably going to be unwieldy but might be a temporary solution. You can also replace threats.json with your own, and we have been thinking about adding a BYO capability for user libraries. Let me look into that.

[raphaelahrens]

For completenes, you can also exclude threats by adding an Assumption.

pytm/tm.py

Lines 45 to 50 in c8c0875

	web.assumptions = [
	Assumption(
	"This webserver does not use PHP",
	exclude=["INP16"],
	),
	]

But I wonder why you don't create a threat library JSON file with only your threats and then just create a report from it.
Doing it this way only your threats will be in the report.

What could be interesting is to have the ability to use multiple threat files, but this would require some code changes.

[harsh02]

Thanks for your inputs! I am only using threat library that I built now and thats working.

Yes, multiple threat library support would be useful.

[raphaelahrens]

Multiple threat libraries would require some though.
@izar should this be a new issue?

@harsh02 One last question would you be willing to share your threat library?