> For the complete documentation index, see [llms.txt](https://docs.devarmor.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devarmor.com/modules/threat-modeler/starting-a-threat-model.md).

# Starting a threat model

How to start a threat model

There are several ways to start a threat model, and you can combine them — DevArmor merges everything you provide into one coherent view of your application:

* Import an existing threat model
* Connect a code repository
* Import supporting documents and tickets
* Describe the application and its attributes manually

## Import an existing threat model

You can import an existing threat model in a JSON format into DevArmor's web application.

From the first page, click on "Import" and then upload your JSON file into DevArmor.

Here is an example of a JSON file representation of a threat model.

{% file src="/files/YYgZCvUokWjujAqpqxVE" %}

## Connect a code repository

Linking a GitHub repository lets DevArmor generate architecture directly from your code, and lets [Code Reviewer](/modules/code-reviewer.md) apply your policies to every pull request. You can scope analysis to a specific subfolder instead of the whole repository, and link multiple repositories to a single threat model to model how they connect as one system.

## Import existing documentation

You can import existing documentation and tickets to provide more context for the threat model. Supported sources include:

* Product Requirement Documents (PRDs) and release documents
* Vulnerability reports, CSPM outputs, and SAST outputs
* Architecture diagrams — including photos or scans, which DevArmor converts into an editable digital diagram automatically
* Confluence pages
* Google Docs
* Jira tasks and epics
* GitHub Wiki pages

To import documents, from the "Describe" section, select "Upload" and then upload documents.

## Describe and decompose the application

If you don't have existing documentation to import, or want to add context beyond what's in your documents and code, you can describe your application directly in the "Describe" section: what it does, who its users are, what data it handles, and how it's built. DevArmor uses this description alongside anything else you've connected — repositories, documents, diagrams — to decompose the application into components, data flows, and trust boundaries before generating its architecture.

Once DevArmor has decomposed your inputs, move on to [Verify Application Attributes](/modules/threat-modeler/verify-application-attributes.md) to review what it inferred.