<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-threat-library-management
description: >-
  Build and maintain organizational threat libraries that catalog known threats, attack patterns, and mitigations as reusable templates, enabling consistent threat modeling across teams and projects.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - threat-library
  - threat-catalog
  - reusable-templates
  - capec
  - cwe
  - knowledge-management
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1059", "T1078", "T1053"]
---

# Implementing Threat Library Management

## Overview

Threat library management creates organizational repositories of known threats, attack
patterns, and proven mitigations as reusable templates. This technique covers library
construction, CAPEC/CWE integration, template management, and cross-project reuse.

Mode: `[MODE: ARCHITECT]` — Organizational threat knowledge management.

## Prerequisites

- Access to MITRE CAPEC and CWE databases
- Previous threat model outputs for seeding the library
- Version-controlled repository for library storage
- Python 3.10+

## Key Concepts

### Library Structure

| Component | Description | Source |
|-----------|-------------|--------|
| Threat Entries | Cataloged threats with metadata | Internal assessments |
| Attack Patterns | Reusable CAPEC-aligned patterns | MITRE CAPEC |
| Weakness Catalog | CWE-mapped software weaknesses | MITRE CWE |
| Mitigation Templates | Proven control implementations | Security team |
| Applicability Rules | When to apply specific threats | Architecture patterns |

### Threat Entry Schema

Each entry includes:
- **ID**: Unique identifier (e.g., TL-001)
- **Category**: STRIDE/LINDDUN classification
- **CAPEC**: Related attack pattern IDs
- **CWE**: Related weakness IDs
- **Applicability**: Architecture patterns where this applies
- **Mitigations**: Proven controls with implementation guidance
- **Confidence**: How well-validated is this threat

### Library Maturity Model

| Level | Description | Characteristics |
|-------|-------------|-----------------|
| 1 — Ad Hoc | No shared library | Each team builds from scratch |
| 2 — Defined | Central catalog exists | Shared repository, basic search |
| 3 — Managed | Curated and maintained | Regular updates, quality reviews |
| 4 — Optimized | Integrated into tooling | Auto-suggested in threat models |

## Workflow

### Step 1: Initialize Threat Library

```bash
node scripts/agent.js --action init --output threat-library.json
```

### Step 2: Import from Standards

```bash
# Import CAPEC attack patterns
node scripts/agent.js --action import --source capec --output threat-library.json

# Import CWE weaknesses
node scripts/agent.js --action import --source cwe --output threat-library.json
```

### Step 3: Add Custom Entries

```bash
node scripts/agent.js --action add --library threat-library.json --entry entry.json
```

### Step 4: Search and Export

```bash
# Search library by keyword or category
node scripts/agent.js --action search --library threat-library.json --query "injection"

# Export relevant threats for a specific architecture
node scripts/agent.js --action export --library threat-library.json --arch web-api
```

## Verification

- [ ] Library initialized with standard threat catalogs (CAPEC, CWE)
- [ ] Custom threats added from internal assessments and incidents
- [ ] Each entry has CAPEC/CWE cross-references where applicable
- [ ] Mitigation templates include implementation guidance
- [ ] Library searchable by category, technology, and architecture pattern
- [ ] Regular review cadence established for library maintenance

## References

- [MITRE CAPEC](https://capec.mitre.org/)
- [MITRE CWE](https://cwe.mitre.org/)
- [OWASP Threat Modeling](https://owasp.org/www-community/Threat_Modeling)
- [Threat Modeling Manifesto](https://www.threatmodelingmanifesto.org/)
