Curate the attack patterns the risk analyst retrieves for every review, and browse the MITRE ATLAS and OWASP libraries it cites by id.

Knowledge base holds everything the risk analyst reads that is not your data. It is split by how the analyst uses each part:

Group	Section	How the analyst uses it
Retrieval corpora	Attack patterns	Embedded and refreshed every 15 minutes; the closest enabled cards are pulled into the prompt of every review
Reference libraries	MITRE ATLAS, OWASP	Looked up by id when a verdict names a technique, risk or control, so the citation is verified against the loaded release. Never bulk-loaded into a prompt

What do I need?

Licence: Enterprise
Role: admin_userviewer

Prerequisites

You are signed in as an admin_user or the superadmin. A viewer may read every section and change nothing.
For the reference libraries: the gateway has loaded the shipped ATLAS and OWASP snapshots at boot. A superadmin can reload them from the section header.

Curate the attack patterns

The Attack patterns section holds the cards every review reasons against — techniques, and the benign shapes that look like them. Nothing here is written from any user's data.

Withdraw a card that over-fires

Find the card and switch Enabled off.

It leaves the analyst's prompt on the next refresh. This is a toggle rather than a delete because withdrawing a card is a statement about this deployment's data, not an edit of the published source — and it is allowed for every origin, official cards included.

Add your own

Select New entry, or Import JSON for a list of them.

An import answers with created, updated, skipped and refused counts. It never walks over a card a person wrote here: an id collision is skipped and named, never fatal.

Warning

Cards marked Official restate MITRE ATLAS, OWASP or deepteam. They cannot be edited or removed here — a 409 — and a correction ships as a new payload. Cards that arrived in a payload (bootstrap) also refuse deletion, because the next import would recreate them, enabled.

Browse a reference library

MITRE ATLAS opens on the matrix of the loaded release: tactics as columns, techniques and sub-techniques beneath them. Typing in the search box or choosing a facet switches to search, which also reaches the mitigations and case studies the matrix has no column for. Select any id to open its full entry.

OWASP lists the six pinned documents — the LLM and agentic Top 10s, the ML Top 10, the AI Exchange and their crosswalks — and searches across them the same way. An OWASP entry links to the ATLAS techniques it maps to, and the ATLAS sheet opens on top.

Both libraries are read-only. Every id an analyst verdict cites resolves here, so a link in a review or an analysis opens the same entry.

Verify

Switch a card off on Attack patterns. Its Enabled switch stays off after a refresh, and the next review that runs no longer cites it.
Open MITRE ATLAS and select a technique id from the matrix. The sheet shows its tactics, mitigations and case studies.
Open a review on Risk Analysis and select a cited id. The same sheet opens.

If it fails

Could not change the entry or Import refused on Attack patterns — most often a 409 on an official or bootstrap card. Disabling it is always allowed.
No ATLAS release is loaded or No OWASP release is loaded — the boot loader has not run. A superadmin can select Reload in the section header; ids in verdicts stay plain text until it completes.
This feature (risk.llm_review) is not included in the installed license tier. — an Enterprise key. The page is hidden below that licence.

Next steps

Risk analysis and LLM reviews — the reviews that retrieve these cards and cite these libraries.
Ask the AI Analyst — the same analyst, answering your questions.

Knowledge base