ellipse2v/SecOpsTM Threat Analysis

Run STRIDE threat analysis with MITRE ATT&CK, CAPEC, D3FEND and CVE mapping on your architecture model or IaC configuration. Generates HTML reports, STIX 2.1 bundles, ATT&CK Navigator layers and enforces severity gates in CI.

View on GitHub

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 14, 2026
License: Apache 2.0

Pinned Snippet

workflow.ymlSHA-pinned

uses: ellipse2v/secopstm@5cc67635c1747d1c690c902b3f1e02b011d61494 # external-data-latest

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
model-file	Path to the SecOpsTM Markdown DSL model file. Ignored when terraform-path or ansible-path is set.	no	threat_model.md
terraform-path	Path to a Terraform directory or .tf file. Overrides model-file. Supports HCL source files and terraform.tfstate (v4+).	no	""
ansible-path	Path to an Ansible configuration directory. Overrides model-file.	no	""
output-format	Output format: all \| html \| json \| stix	no	all
navigator	Generate a MITRE ATT&CK Navigator layer JSON file.	no	false
attack-flow	Generate Attack Flow .afb files from GDAF scenarios.	no	false
gate	Fail the pipeline if threats at or above this severity are found. Accepted values: CRITICAL \| HIGH \| MEDIUM \| LOW \| none	no	CRITICAL
baseline	Path to a previous JSON report. When set, only NEW threats (not present in the baseline) trigger the gate — resolved threats are ignored.	no	""
accepted-risks	Path to a YAML file listing risk IDs accepted as false-positives. Matching threats are excluded from gate evaluation.	no	""
ai-config-file	Path to ai_config.yaml for LLM-enriched threat generation. Leave empty to use pytm rules only (fully offline, no API key required).	no	""
comment-on-pr	Post a threat-summary comment on the pull request.	no	true
upload-artifacts	Upload generated reports as GitHub artifacts.	no	true
artifact-name	Name for the uploaded artifact bundle.	no	secopstm-threat-report
python-version	Python version to use for running SecOpsTM.	no	3.11

Outputs

name	description
report-json	Path to the generated JSON threat report.
report-html	Path to the primary generated HTML threat report.
total-threats	Total number of threats found.
critical-threats	Number of CRITICAL severity threats.
high-threats	Number of HIGH severity threats.
medium-threats	Number of MEDIUM severity threats.
low-threats	Number of LOW severity threats.