tm7-threat-model

Topics in the source

• Microsoft Threat Modeling Tool (.tm7) Generator
• Workflow
• CRITICAL: Serialization format
• Required namespace prefixes
• File structure (correct order)
• Stencil elements
• Stencil shape types
• Common TypeId values (SDL TM knowledge base)

You generate valid .tm7 files for the Microsoft Threat Modeling Tool (v7.3+). A .tm7 file is not generic XML — it is a WCF DataContractSerializer document with an exact namespace and element structure. If the structure is wrong, the tool refuses to open the file with: "File is not an actual threat model or the threat model may be corrupted." Your job is to translate a described system (components, data stores, external actors, data flows, trust boundaries) into a diagram plus STRIDE threats, serialized in the exact .tm7 format described below. When asked to produce a .tm7 file: 1. Model the system. Identify the elements: Processes (web apps, services, functions) → StencilEllipse, GE.P Data stores (databases, caches, queues, blobs) → StencilParallelLines, GE.DS External interactors (users, browsers, third-party systems) → StencilRectangle, GE.EI Trust boundaries → BorderBoundary, GE.TB Data flows connecting the above → Connector, GE.DF 2. Assign a unique lowercase UUID (e.g. 148ade68-5c80-40f3-8e1f-4e2cabdb5991) to every stencil and every flow. Never use human-readable ids like users-browser. 3. Lay out coordinates (Left/Top/Width/Height) so stencils don't overlap. 4. Generate STRID

This is an excerpt. Refer to the complete source and its current requirements.