imlucif3r/threatmax-engine repository overview

⁠ThreatMax Engine v1.0

The AI-Assisted, Diagram-First Threat Modeling Suite for IT/OT Systems.

ThreatMax Engine is a powerful web application designed to bridge the gap between architecture design and security analysis. By combining intuitive data-flow-diagramming (DFD) with automated threat intelligence mapping—including MITRE EMB3D—it empowers security analysts to identify, review, and mitigate risks in real-time.

Quick Start⁠ | Features⁠ | Configuration⁠

⁠Why ThreatMax?

• OT/ICS Focused: Specialized support for industrial protocols and MITRE EMB3D threat intelligence.
• Analyst-in-the-Loop: AI-assisted threat generation that respects human expertise—no "black box" findings.
• Real-time Collaboration: Live cursor tracking and presence sync for team-based modeling.
• Portable & Light: A single Docker image serving the UI, persistence layer, and collaboration server.

⁠Quick Start

Run the production-ready image in seconds:

docker run --rm -d -p 80:80 --name threatmax-engine imlucif3r/threatmax-engine:latest

Access the UI at: http://localhost

⁠Key Features

⁠🎨 Advanced Diagramming

• Drag-and-Drop: Easily build architectures with nodes, zones, and trust boundaries.
• Context-Aware Flows: Define directions, protocols, and technical metadata.
• Custom Stencils: Create and map stencils directly to Threat DB IDs (TIDs/MIDs).

⁠🤖 Intelligent Analysis

• Threat DB Mapping: Out-of-the-box support for MITRE EMB3D.
• AI Findings: Generate threats automatically based on your diagram, then refine them via human review.
• Compliance Ready: Dedicated fields for NIST and IEC 62443 mapping.

⁠👥 Collaboration & Presence

• Live Sync: Real-time cursor tracking and presence indicators (via WebSockets).
• Shared Workspaces: Edit models simultaneously using unique UUID permalinks.
• Model Management: Built-in naming enforcement to prevent "Untitled" model sprawl.

⁠📑 Comprehensive Exporting

• Reporting: Print to PDF or export to CSV (Excel-compatible).
• DevOps Integration: Native Azure DevOps JSON export for ticket tracking.
• Assets: High-resolution SVG/PNG exports of diagrams and threat details.

⁠Options and Configuration

⁠Persistent Storage (Recommended)

To ensure your models persist across container restarts, mount a volume to /app/data:

docker run -d -p 80:80 \
  -v threatmax-data:/app/data \
  --name threatmax-engine \
  imlucif3r/threatmax-engine:latest

⁠Environment Variables

⁠Reverse Proxy & Ingress

When running behind Nginx, Traefik, or HAProxy, ensure you enable WebSocket upgrades for the following paths:

• /ws (Collaboration/Sync)
• /api/health (Liveness/Readiness probes)

⁠📂 Included Templates

The container ships with pre-configured templates found in /app/Templates:

• Vendor Stencils: ABB,Siemens, AWS, Azure, GCP, and major Industrial/OT vendors.
• Intelligence: Example MITRE EMB3D mapping configurations.

⁠🛡️ Security Note

Collaboration links (?model=<uuid>) are capability-based. Anyone with the URL can access and edit the model. For production environments, it is recommended to run ThreatMax behind an Identity Aware Proxy (IAP), VPN, or SSO solution.