Flexible Threat Modeling Made Simple
Meet Custom Analysis Profiles™, your go-to feature for tailored threat modeling and rule integration as part of the ONEKEY platform. Create personalized threat rules, prioritize CVEs, and manage false positives effortlessly. Align your analysis with your security policies and risk management strategies, ensuring a seamless fit with your business needs.
Streamline Your Threat Management
Adapt your security approach with customized rules that focus on what’s important for your business. All in one platform.
Automated, Tailored Threat Rules
Easily integrate product data and automate status assignments for detected vulnerabilities. Use OQL to create detailed rules that reflect your unique security needs, and keep track of changes with complete audit trails. View your custom analysis in a dialogue format, making it easy to review and adjust as needed.
Save Time with Custom Automation
Create and apply custom rules directly from the CVE or zero-day issue pages. With a few clicks, you can set up automated actions for detected vulnerabilities, reducing manual work and speeding up your triage process. Save valuable time and resources by focusing only on the most relevant issues for your business.
Manage False Positives and Risks
Eliminate noise and stay focused with advanced filtering and rule settings. Automatically prioritize or suppress certain CVEs based on their relevance to your product. This level of control helps you manage false positives effectively, ensuring that your team can concentrate on true threats without distraction.
Optimize Your Security Workflow
Your Custom Analysis Routine
.avif)
Use the Analysis Profile page or create rules directly from CVE and issue pages. Specify your requirements on our platform with OQL to ensure your analysis reflects your security priorities and risk management strategy.
Automatically assign statuses to detected vulnerabilities based on your predefined rules. Reduce manual effort and streamline your triage process with rules that match your specific needs.
Use detailed reports from our platform to review your analysis and adjust rules as needed. View evidence and status assignments for each CVE to understand why certain vulnerabilities were flagged or filtered out.
Continuously refine your threat models and rules as your products and security needs evolve. Update your analysis profiles regularly to maintain alignment with your current risk landscape.
See the Custom Analysis Profile Feature in Action
Discover how personalized threat modeling can transform your vulnerability management. Create effective and efficient security models within a single-platform solution tailored to your organization.
FAQs
Find answers to common questions about product cybersecurity, compliance, regulatory requirements, and security throughout the product lifecycle.
How does ONEKEY provide end-to-end tools for software threat analysis?
ONEKEY covers the path from binary to decision: unblob extraction, component detection, SBOM generation, CVE matching against NVD and OSV, static code analysis for zero-days, and Automated Impact Assessment. Analysis Profile rules in OQL then encode your own threat model, setting statuses and enrichment fields automatically after every analysis.
How does ONEKEY support custom analysis and detection rules for firmware?
ONEKEY supports custom rules on two levels. Analysis Profile rules written in OQL automatically assess detected CVEs and security issues, setting status, severity, VEX justification, Environmental CVSS or SSVC after every analysis. The User CVE DB adds your own vulnerability entries, defined via Package URL or CPE, which are matched against firmware components like built-in CVEs.
How does ONEKEY tailor threat analysis to my product's threat model?
Analysis Profile rules translate your threat model into automatic assessments. For a device without local access, for example, all CVEs with a LOCAL attack vector can be excluded automatically. Rules can be scoped to specific firmware, adjust severity or Environmental CVSS, and run after every analysis. Manual assessments always take precedence, and the audit trail records each change.
Can ONEKEY replace custom-built detection software?
Yes, for firmware security analysis. ONEKEY covers extraction, SBOM generation, CVE matching, static code analysis for zero-days and Automated Impact Assessment out of the box. Company-specific logic moves into OQL rules and custom CVE entries. The REST and GraphQL APIs plus CI/CD integration connect the platform to existing build and ticketing workflows.
How does ONEKEY support threat modeling for embedded products?
ONEKEY supplies the facts a threat model for embedded products is built on and applies the model to every analysis. The firmware analysis delivers the SBOM, exposed services, hardcoded credentials and missing binary hardening as attack-surface data. Analysis Profile rules then encode the threat model in OQL and assess every new CVE consistently against it.
What are Analysis Profiles in ONEKEY?
Analysis Profiles are rule sets in ONEKEY that assess detected CVEs and security issues automatically. Each rule combines a firmware scope, an OQL query and an action such as status, severity, VEX justification, Environmental CVSS or SSVC. Rules run after every analysis, cascade from top to bottom and can be tested with a dry run before use.
One Solution, Many Benefits
Automated SBOM Generation from the Binary
ONEKEY identifies software components in firmware and builds or enriches an SBOM. Compliance teams get a stronger basis to understand third-party software and track it across versions. The inventory also supports vulnerability and regulatory workflows.
CVE Prioritization Based on Your Actual Firmware
A component-level CVE match does not always mean a vulnerability affects the product. ONEKEY evaluates firmware evidence to find relevant vulnerabilities. It filters findings that seem not affected. Teams focus remediation and compliance on real product risk.
Post-Deployment Firmware Monitoring with the Digital Cyber Twin
Risk keeps changing after a product ships, as new CVEs appear and firmware versions vary across markets. ONEKEY’s Digital Cyber Twin gives you a living security view of every version, so you can compare releases and spot affected products.
