Getting Started

Data layers

SecOpsTM relies on three data layers fetched separately:

Layer	Content	Size	Command
Security knowledge base	MITRE ATT&CK, CAPEC, D3FEND, CIS, NIST, CVE mappings	~140 MB	secopstm download-data
RAG vector store	Pre-built embeddings for AI threat generation	~200 MB	secopstm --init-rag
Fresh CVE data	Up-to-date CVE→CAPEC database (dev/contributors only)	~94 MB	clone Galeax/CVE2CAPEC

The security knowledge base is required for full STRIDE + MITRE analysis. The RAG vector store is optional and enables AI-powered threat enrichment. The CVE data bundled in the knowledge base covers 1999–2025 — clone CVE2CAPEC only if you need the absolute latest entries.

---

Installation options

Option A — Docker (recommended)

The Docker image already includes the security knowledge base. LLM inference works out of the box — just pass your API key. The RAG vector store is the only extra download (optional, ~200 MB).

# Offline threat modeling — no AI key needed
docker run -p 5000:5000 -v $(pwd)/output:/app/output \
  ellipse2v/secopstm:latest

# With LLM inference — default provider is NVIDIA NIM (free tier available)
# See https://build.nvidia.com/meta/llama-3_3-70b-instruct for a free API key
docker run -p 5000:5000 \
  -e NVIDIA_NIM_API_KEY=your_key \
  -v $(pwd)/output:/app/output \
  ellipse2v/secopstm:latest

# To switch provider or model without rebuilding, mount your own ai_config.yaml:
docker run -p 5000:5000 \
  -e GEMINI_API_KEY=your_key \
  -v $(pwd)/ai_config.yaml:/app/config/ai_config.yaml:ro \
  -v $(pwd)/output:/app/output \
  ellipse2v/secopstm:latest

# With LLM + RAG — one-time vector store download, then reuse the named volume
docker run --rm \
  -v secopstm-rag:/app/rag \
  ellipse2v/secopstm:latest \
  --init-rag

docker run -p 5000:5000 \
  -e NVIDIA_NIM_API_KEY=your_key \
  -v secopstm-rag:/app/rag \
  -v $(pwd)/output:/app/output \
  ellipse2v/secopstm:latest

Open http://localhost:5000 in your browser.

Option B — pip install

pip install SecOpsTM

# Install Graphviz (required for diagram generation)
#   Windows: https://graphviz.org/download/
#   macOS:   brew install graphviz
#   Linux:   sudo apt-get install graphviz

# Step 1 — Security knowledge base (~140 MB, required for MITRE/CVE mapping)
secopstm download-data

# Step 2 — RAG vector store (~200 MB, optional — enables AI threat enrichment)
secopstm --init-rag

# Step 3 — Start
secopstm --server

Both download-data and --init-rag are one-time steps that download from GitHub Releases and work fully offline afterwards. Re-run with --force to update.

Option C — From source (development)

git clone https://github.com/ellipse2v/SecOpsTM.git
cd SecOpsTM
pip install -e .
# external_data/ is already in the repo — no download-data step needed

To get the latest CVE entries (beyond the 1999–2025 snapshot in the repo):

# Clone the CVE2CAPEC database next to the SecOpsTM directory
git clone https://github.com/Galeax/CVE2CAPEC.git ../CVE2CAPEC
python tooling/copy_cve_data.py

Quick CLI test:

secopstm --model-file threatModel_Template/threat_model.md

Using the Web Interface (Server Mode)

The framework includes a web-based interface for interactive threat modeling, accessible from a central menu.

1. Launch the server:

   secopstm --server
   # or equivalently:
   python3 -m threat_analysis --server
   

2. Open your browser to the address shown in the console (usually http://127.0.0.1:5000/).

3. Choose a mode:

   • Simple Mode: For quick visualization and editing of system models written in Markdown. It features a live preview and supports multi-file projects through a tabbed interface, so you can edit a main model and its sub-models together.
   • Graphical Editor: A visual, drag-and-drop canvas for building system models from scratch without writing Markdown. This mode is under active development.