<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-data-flow-mapping
description: >-
  Map and document data flows across systems, networks, and third parties to
  identify processing activities, trust boundary crossings, and compliance gaps
  for GDPR Article 30 records and threat modeling inputs.
domain: cybersecurity
subdomain: data-security
tags:
  - data-flow-mapping
  - gdpr-article-30
  - dpia
  - threat-modeling
  - data-lineage
  - trust-boundaries
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1048"]
---

# Performing Data Flow Mapping

## Overview

Map and document data flows across systems, networks, and third parties to
identify processing activities, trust boundary crossings, and compliance gaps
for GDPR Article 30 records and threat modeling inputs.

Mode: `[MODE: PRIVACY]` — Performing Data Flow Mapping.

## Prerequisites

| Requirement | Details |
|---|---|
| Refer to technique-specific requirements in the workflow section | Required |
| Data classification taxonomy with sensitivity levels | Required |
| Appropriate platform access for target environment | Required |
| Log aggregation and SIEM integration | Required |
| Change management process for policy deployment | Required |

## Key Concepts

Refer to the CLI commands and workflow sections for detailed implementation guidance.

### CLI Commands

```bash
node scripts/agent.js --action discover --input /tmp/input.json \
  --output /tmp/output.json

node scripts/agent.js --action map --input /tmp/input.json \
  --output /tmp/output.json

node scripts/agent.js --action diagram --input /tmp/input.json \
  --output /tmp/output.json
```

## Workflow

### Step 1: Prepare Input Data

Gather and format input data for the target action.

### Step 2: Execute Analysis

```bash
node scripts/agent.js --action discover --input /tmp/input.json \
  --output /tmp/output.json
```

### Step 3: Review Findings

Analyze output for gaps, violations, or anomalies.

### Step 4: Remediate

Address identified issues according to severity.

### Step 5: Monitor

Deploy continuous monitoring for ongoing compliance.

## Detection

```yaml
title: Data Flow Mapping Detection
id: d3d84a76-391c-42b1-a31c-ecf6bcbfb0f7
status: experimental
description: Detects suspicious activity related to performing data flow mapping techniques in data security context
logsource:
  category: file_access
  product: windows
detection:
  selection:
    TargetFilename: "*suspicious*"
  condition: selection
level: medium
tags:
  - attack.t1048
  - attack.exfiltration
falsepositives:
  - Data loss prevention tools scanning files during classification
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Data Flow Mapping Detection | windows/file_access | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1048 |

## Verification

- [ ] All target assets inventoried and analyzed
- [ ] Policy violations identified and documented
- [ ] Remediation actions tracked to completion
- [ ] Continuous monitoring alerts configured
- [ ] Compliance evidence archived for audit
- [ ] Periodic review schedule established
- [ ] Findings reported to stakeholders

## References

- [NIST SP 800-53 — Security and Privacy Controls](https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final)
- [CIS Controls](https://www.cisecurity.org/controls)
- [MITRE ATT&CK](https://attack.mitre.org/)
- [GDPR](https://gdpr-info.eu/)
