{"$schema":"https://json-schema.org/draft/2020-12/schema","$id":"https://bowtiekreative.example/schemas/laka-security/threat-model.schema.json","title":"LAKA Threat and Control Graph","type":"object","additionalProperties":false,"required":["version","model_id","client_id","scope","nodes","edges","scenarios","review_triggers"],"properties":{"version":{"type":"string"},"model_id":{"type":"string","minLength":3},"client_id":{"type":"string","minLength":1},"title":{"type":"string"},"scope":{"type":"object","additionalProperties":false,"required":["environments","assets","authorization_id"],"properties":{"environments":{"type":"array","minItems":1,"items":{"type":"string"}},"assets":{"type":"array","minItems":1,"items":{"type":"string"}},"authorization_id":{"type":"string"},"exclusions":{"type":"array","items":{"type":"string"}}}},"assumptions":{"type":"array","items":{"type":"string"}},"nodes":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"required":["node_id","kind","name","environment","owner","criticality","trust_boundary"],"properties":{"node_id":{"type":"string"},"kind":{"type":"string"},"name":{"type":"string"},"environment":{"type":"string"},"owner":{"type":"string"},"criticality":{"type":"integer","minimum":1,"maximum":5},"classification":{"type":"string"},"trust_boundary":{"type":"string"},"internet_exposed":{"type":"boolean"},"evidence_freshness":{"type":"string"},"attributes":{"type":"object"}}}},"edges":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"required":["edge_id","from","relation","to","condition","confidence","evidence"],"properties":{"edge_id":{"type":"string"},"from":{"type":"string"},"relation":{"type":"string"},"to":{"type":"string"},"condition":{"type":"string"},"privilege":{"type":"string"},"data_class":{"type":"string"},"confidence":{"enum":["observed","inferred","hypothesized","refuted","stale"]},"evidence":{"type":"array","items":{"type":"string"}},"expires":{"type":"string"}}}},"scenarios":{"type":"array","minItems":1,"items":{"type":"object","additionalProperties":false,"required":["scenario_id","title","actor","entry_point","preconditions","attack_path","effects","volume","control_links","verification","owner","status"],"properties":{"scenario_id":{"type":"string"},"title":{"type":"string"},"actor":{"type":"string"},"entry_point":{"type":"string"},"preconditions":{"type":"array","items":{"type":"string"}},"technique_ids":{"type":"array","items":{"type":"string"}},"weakness_ids":{"type":"array","items":{"type":"string"}},"attack_path":{"type":"array","minItems":2,"items":{"type":"string"}},"effects":{"type":"array","minItems":1,"items":{"type":"string"}},"volume":{"type":"object","additionalProperties":false,"required":["magnitude","rate","direction","scope","depth","duration","frequency","acceleration","variability","detectability","reversibility","propagation","amplification","accumulation"],"properties":{"magnitude":{"type":"integer","minimum":0,"maximum":5},"rate":{"type":"string"},"direction":{"type":"string"},"scope":{"type":"array","items":{"type":"string"}},"depth":{"type":"string"},"duration":{"type":"string"},"frequency":{"type":"string"},"acceleration":{"type":"string"},"variability":{"type":"string"},"detectability":{"type":"integer","minimum":0,"maximum":5},"reversibility":{"type":"string"},"propagation":{"type":"array","items":{"type":"string"}},"amplification":{"type":"array","items":{"type":"string"}},"accumulation":{"type":"string"}}},"control_links":{"type":"array","items":{"type":"object","additionalProperties":false,"required":["control_id","relation","target","expected_effect","verification"],"properties":{"control_id":{"type":"string"},"relation":{"enum":["prevent","reduce","isolate","observe","attribute","contain","recover","prove"]},"target":{"type":"string"},"expected_effect":{"type":"string"},"verification":{"type":"string"},"failure_signal":{"type":"string"}}}},"verification":{"type":"object","additionalProperties":false,"required":["next_uncertain_edge","least_invasive_method","mode","evidence_required"],"properties":{"next_uncertain_edge":{"type":"string"},"least_invasive_method":{"type":"string"},"mode":{"enum":["inventory","passive","audit","active","change","containment","recovery"]},"evidence_required":{"type":"array","items":{"type":"string"}},"stop_conditions":{"type":"array","items":{"type":"string"}}}},"owner":{"type":"string"},"status":{"enum":["draft","current","testing","mitigated","accepted","refuted","stale"]}}}},"review_triggers":{"type":"array","minItems":1,"items":{"type":"string"}}}}