Matching Patterns

MP-CcBrR

Finds a Base Station connected to a backhaul Core Network and providing a RAN, both of which are part of a Cellular Network.
MP-RrBcC

Finds a BaseStation providing a RAN and connected to a core network both of which are part of a cellular network.
MP-PCNRWI

Finds router providing a Public Cellular Network accessible from the World, along with the Internet which should also be accessible from the World.
MP-PCN

Finds a Public Cellular Network.
MP-MPCNS

Finds a Public Cellular Network to which is connected a Mobile Host (or a Virtual Host running on it) located in a Space.
MP-L3cCrC

Finds a core router providing a core network backhaul for a cellular network, connected to an IP subnet that is not part of the cellular network.
MP-FCNS

Finds a Cellular Network to which is connected a Fixed Host (or a Virtual Host running on it) located in a Space.
MP-PcCN

Finds a process controlling a cellular network and an associated RAN.
MP-CrCcL3

Finds a core router providing a core network backhaul for a cellular network, connected to an IP subnet that is not part of the cellular network.
MP-CN-R

Finds a cellular network that is not provided by a router.
MP-CNR

Finds a cellular network provided by a router.
MP-CNHS

Finds a core network implementing a cellular network accessible from a space in which there is a device connected to but not providing the cellular network.
MP-CNCN

Finds a Cellular Network implemented by a Core Network.
MP-CScGcCS

Finds a Physical Host connected between two distinct Cellular networks, both in the same space.

MP-HuirPsD

Finds Human interacting (possibly remotely) with a process that serves data. This conflicts with domain model assumptions.
MP-HuirPeOD

Finds a human interacting (possibly remotely) with a process that enables user access to some Data.
MP-HuirPeO-ID-p

Finds a human interacting (possibly remotely) with a process that enables user access to some Data, but does not process the data.
MP-HuirPeUD

Finds a human interacting (possibly remotely) with a process that enables user update of some Data.
MP-HuirPeUD-a

Finds a human interacting (possibly remotely) with a process that enables user update of some Data, but does not yet amend the data.
MP-HuirPr-iD-cD

Finds Human interacting remotely with a Process that receives Data, but does not create any output, and the Human does not enter the Data.
MP-HuirPr-vD-cC-iHu-DS

Finds Human interacting remotely with a Process that receives Data that is not viewed by the Human, and which is not created by any process, stored on any Host, nor input by any Human.
MP-Hui-uD

Finds a Human entering Data, but not implied by an amends relationship.
MP-RDuRDuS-uR

Finds a remote desktop using remotely another remote desktop which is using remotely a third process that is not yet remotely used by the first.
MP-Huv-iD-P

Finds a Human viewing but not entering Data, where the Data is not Spam, and there is no interactive process mediating the interaction.
MP-Huv-uD

Finds a Human viewing Data, but not implied by an amends relationship.
MP-HuWES

Finds a Human using a web browser to access email.
MP-PpD+noDU

Finds a Process that is processing Data, where the Process has a self-referential noDU link indicating it should not be processing data.
MP-RDuHP-iPL-RAS

Finds a Host running a Process that is not a remote access service or reverse proxy, but is used remotely by a Remote Desktop client, not mediated by a collocated remote access service, nor by a reverse proxy.
MP-HuirPeI-OD-p

Finds a human interacting (possibly remotely) with a process that enables user entry of some Data, but does not process the data.
MP-RDuRTuS-uR

Finds a remote desktop using remotely a remote terminal which is using remotely a third process that is not yet remotely used by the first.
MP-HuuD

Finds a Human interactively amending Data, where this is expressed as a single relationship.
MP-HuirPeID

Finds a human interacting (possibly remotely) with a process that enables user entry of some Data.
MP-HuirPeI-OD-p-cC-iHu-DS

Finds a human interacting (possibly remotely) with a process that enables user access to some Data, but does not process the data, and where the Data is not an input from any user, an output of any process, and is not stored, i.e., the data has no source.
MP-HuirPaD+eUI-O

Finds Human interacting (possibly remotely) with a process that amends (creates and receives) data, and enables user input but not output of the data.
MP-HuirPc-iD-rC-vHu-DS

Finds a Human interacting (possibly remotely) with a process that creates data, where the data is not stored on any host, used by any process nor viewed by any user, and the Human does not enter the Data.
MP-CP

Finds a solo Control Process.
MP-D

Finds a solo Data asset that is not unsolicited email.
MP-HHuWE

Finds a Human using both an email client and a web browser on the same host.
MP-HHuWSMS

Finds a Human using both an SMS client and a web browser on the same host.
MP-HIP-Hu

Finds a host running an interactive process that doesn't have a user.
MP-HuaUD

Finds a Human interactively amending Data, where this is expressed as a single relationship and labelled as having been asserted.
MP-HuaVD

Finds a Human interactively viewing Data, where this is expressed as a single relationship and labelled as having been asserted.
MP-HuHWES

Finds a Human using a web browser running on a host to access email.
MP-HuaID

Finds a Human interactively entering Data, where this is expressed as a single relationship and labelled as having been asserted.
MP-HuiPiDCHS

Finds a user interacting directly with a process to enter data using a console host located in a space.
MP-HuiCHDtS-AC

Finds a human interacting with a console host and a desktop service running on a remote host, where the user does not interact with a desktop client that uses the desktop service.
MP-HuirIPp-iD

Finds Human interacting (possibly remotely) with an Interactive Process that processes Data, where the Human does not enter the Data.
MP-HuirIPaD

Finds Human interacting remotely with an Interactive Process that amends data.
MP-HuirIPp-xD

Finds Human interacting (possibly remotely) with an Interactive Process that processes Data, where the Human does not interact with the Data.
MP-HuirEc-rD

Finds a Human interacting (possibly remotely) with an Editor that creates but does not receive Data.
MP-HuiRACHSPiD

Finds a user entering data via remote interaction with a process using a remote access client on a console host located in a space.
MP-HuirEr-vD-cC-iHu-DS

Finds Human interacting remotely with an Editor that receives Data that is not viewed by the Human, and which is not created by any process, stored on any Host, nor input by any Human.

MP-PodCnD

Finds Data stored on a Container provisioned by a Pod.
MP-KPxCLnSA

Finds a Pod managed by K8S or equivalent, hosting a remote access service running in and controlling a Container, and used by a client from outside the K8S cluster.
MP-KPxCuScP

Finds a Pod managed by K8S or equivalent, hosting an unprivileged service in a Container, which controls another service accessed by a client from outside the K8S cluster.
MP-KPxCuuSI

Finds a Pod managed by K8S or equivalent, hosting an unprivileged service in a Container, accessed by a client from outside the K8S cluster.
MP-KPxMLnSA

Finds a Remote Access Service that runs on and controls a K8s Master node that runs a K8s API Server, connected via a Subnet to a K8s Worker cluster, and used by a client from outside the K8S cluster.
MP-KPxWLnSA

Finds a Remote Access Service that runs on and controls a K8s Worker node, connected via a Subnet to a Master that runs a K8s API Server, and used by a client from outside the K8S cluster.
MP-MWHLS

Finds K8s Master and Worker nodes on the same (cluster) host, and connected to the same subnet.
MP-MWPodLS2

Finds a Pod running on a K8s Worker connected via a Logical Subnet to a K8s Master, which can also access an overlay on the Logical Subnet.
MP-PodCnP

Finds a Process hosted by a Container provisioned by a Pod.
MP-VH-LnS

Finds a Virtual Host that is not controlled by any process.
MP-PodDCC-M

Finds a Pod managed by a Data Centre that has a Cluster, but there is no Master node provisioned on the Cluster.
MP-PodDCMC-W-H

Finds a K8s Pod with no Host managed by a Data Centre that has a Cluster with a K8s Master, where the Data Centre does not yet have a K8s Worker cluster.
MP-PodHaH

Finds a Pod provisioned by a Host that is above another Host.
MP-PodHhPH

Finds a Pod provisioned by a Host that has a PhysicalHost.
MP-PodMP

Finds a solo Pod.
MP-PodP-Cn

Finds a Pod containing a Process but with no intervening Container.
MP-SHVH

Finds a Virtual Host provisioned on a Simple Host that is not a Pod.
MP-KPxCazSI

Finds a Pod managed by K8S or equivalent, hosting an unprivileged service in a Container, accessed for authorization purposes by a client from outside the K8S cluster.
MP-PodCnPD

Finds a Container running a Process that handles Data stored on the associated Pod.
MP-KPxCaaSI

Finds a Pod managed by K8S or equivalent, hosting an unprivileged service in a Container, accessed for authentication purposes by a client from outside the K8S cluster.
MP-Pc-hSHLnS

Finds a Process controlling a Shell Host that runs a Remote Access Service, but the Shell Host is not a Pod and not the Process host.
MP-HumPC-Hu

Finds an unmanaged Container of a Process managed by a Human.
MP-KIP-S

Finds an Ingress proxy mediating access to a service, but not controlled by any other process.
MP-Ct

Finds a solo Container.
MP-CtDS

Finds a Container that stores a copy of Data (which is actually not allowed).
MP-CtHhPH

Finds a Container provisioned by a Host that has a PhysicalHost.
MP-CtH-iP

Finds a container provisioned by a Host that is not a Pod.
MP-DCCM-A

Finds a Data Centre with a Cluster on which is provisioned a Pod management Master node that does not yet host an API Server.
MP-DCCMCAP

Finds a process controlling a data centre hosting a K8s master node running a K8s API server and Ingress proxy.
MP-DCCM-P

Finds a Data Centre with a Cluster on which is provisioned a Pod management Master node that does not yet host an Ingress reverse proxy.
MP-DCCt-Pod

Finds a Container managed directly by a Data Centre and not via a Pod.
MP-CtHaH

Finds a Container provisioned by a Host that is above another Host.
MP-DCPHM

Finds a K8s Master whose physical host is in a Data Centre.
MP-DCPHW

Finds a K8s Worker whose physical host is in a Data Centre.
MP-DCPS-Pod

Finds a Process hosted directly on a Data Centre, but not contained by a Pod managed by the Data Centre.
MP-DCVHC

Finds a DataCentre containing a Cluster, and a Virtual Host.managed by the Data Centre rather than being provisioned on a Host.
MP-HCt

Finds a host provisioned by a container.
MP-Hum-iH-AC

Finds a human remotely managing a host but lacking a suitable connection to its management service.
MP-Hum-iHRAS

Finds a human managing but not interacting with a host that is not a Pod and has a root privileged remote access service.
MP-DCMW-LS

Finds a K8s Master and Worker on the same (cluster) Host in a Data Centre, where the Master and Worker are not on any common subnet.
MP-Hum-iSH-LnS

Finds a Human managing but not interacting with a Shell Host, where there is no process controlling the host.

MP-HuWESDF

Finds a Human using a web browser to access email, including URLs contained in emails.
MP-HuWSMSDF

Finds a Human using a web browser and an SMS client on the same host, accessing URLs from SMS messages via the browser.
MP-PaD-DS

Finds a process that alters (read and write) output data where there is not yet a DataCopy relating to the data.
MP-PaDH-DS-Hu-DA

Finds a Process that is amending data of which there is no copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no data access associated with this Process and Data.
MP-PaDH-DS-Hu-DP

Finds a Process that is amending data of which there is no copy stored on the same host, where the Process is not enabling a user to enter the data, and there is as yet no data pool anywhere associated with this Data.
MP-PaDSH-Hu-DP

Finds a Process that is amending data of which there is a copy stored on the same host, where the Process is not enabling a user to amend the data, and there is as yet no Data Pool associated with the Data.
MP-Pc-rDH-DS-Hu-DP

Finds a Process that is creating data of which there is no copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no Data Pool associated with the Data.
MP-PcPuDS-V

Finds two distinct processes accessing the same stored copy of data not encrypted with keys from a vault, one of which reads the data (processes it as a necessary input).
MP-Pc-rDH-DS-Hu-DA

Finds a Process that is creating data of which there is no copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no data access associated with this Process and Data.
MP-Pc-rDSH-Hu-DP

Finds a Process that is creating data of which there is a copy stored on the same host, where the Process is not enabling a user to enter the data, and there is as yet no Data Pool associated with the Data.
MP-PDADAV

Finds a Process creating a data asset controlled by a vault.
MP-HuWEDF

Finds a Human using a web browser that is receiving a data flow from an email service.
MP-PDF

Finds a Data Flow (excluding Spam), plus source and destination processes, plus optionally the users responsible for the two processes. The destination process is matched twice so it can be referred to in either role.
MP-PcPr-uDS-V

Finds two distinct processes accessing the same stored copy of data not encrypted with keys from a vault, one of which receives the data (processes it as an input) but does not depend on it.
MP-Hui-vDSPH-DP

Finds a Human entering Data by interacting (possibly remotely) with a Process that processes the Data, of which there is a copy on the same Host, where there is as yet no Data Pool associated with the data.
MP-HuiRACv-iDFCHS

Finds a user interacting directly with a process to view data using a remote access client on a console host located in a space.
MP-Hui-vDPH-DS-DA

Finds a Human entering Data by interacting (possibly remotely) with a Process that processes the Data, of which there is no copy on the same Host, and there is as yet no Data Access associated with this Process and Data.
MP-HuaD-DS

Finds a Human that alters (views and inputs) data where there is not yet a DataCopy relating to the data.
MP-HuaDPH-DS-DA

Finds a Human amending Data by interacting (possibly remotely) with a Process that processes the Data, of which there is no copy on the same Host, and as yet no Data Access associated with this Process and Data.
MP-HuaDPH-DS-DP

Finds a Human amending Data by interacting (possibly remotely) with a Process that processes the Data, of which there is no copy on the same Host, and as yet no Data Pool anywhere associated with this Data.
MP-HuaDRAC-DA

Finds a Human amending Data remotely via a Remote Access Client, where there is no Data Access asset for access to the Data by the RAC.
MP-HuaDSPH-DP

Finds a Human amending Data by interacting (possibly remotely) with a Process that processes the Data, of which there is a copy on the same Host, where there is as yet no Data Pool associated with the data.
MP-HuiPv-iDFCHS

Finds a user interacting directly with a process to view but not enter data using a console host located in a space, where the data comes from an inbound data flow.
MP-HuiPv-iD-FCHS

Finds a user interacting directly with a process to view but not enter data using a console host located in a space, where the data does not comes from a data flow.
MP-PDFIDADFI

Finds a Process that receives a flow of Data from a data store or source that it does not get from local storage, and forwards it towards a data consumer. The Process is matched twice, so it can be referred to by either role name.
MP-HuirPD

Finds a Human interacting (possibly remotely) with a Process that is using Data.
MP-HuirPiD-DF-DS

Finds Human interacting (possibly remotely) with and entering Data via a Process, which does not just store or forward the data.
MP-HuirPiDF

Finds a (possibly remote) user of an interactive process that enters data sent from the process in a data flow.
MP-HuirPiDS

Finds a (possibly remote) user of an interactive process that inputs data stored from the process in a local data copy.
MP-HuirPvDF

Finds a (possibly remote) user of an interactive process that views data received by the process in a data flow.
MP-HuirPvDS

Finds a (possibly remote) user of an interactive process that views data loaded by the process from a local data copy.
MP-HuirPv-iD

Finds a (possibly remote) user of an interactive process that views but does not update data created by the process.
MP-Hui-vDPH-DS-DP

Finds a Human entering Data by interacting (possibly remotely) with a Process that processes the Data, of which there is no copy on the same Host, where there is as yet no Data Pool associated with the data.
MP-PDFODADFO

Finds a Process that receives a flow of Data from a data producer that it does not get from local storage, and forwards it towards a data store. The Process is matched twice, so it can be referred to by either role name.
MP-PDO-DI

Finds a Process that creates Data as output, possibly by getting it from an interactive user, but does not use the same Data as input.
MP-PDF-V

Change from: Finds a Data Flow protected by keys from a vault, plus the data flow source and destination processes. The destination process is matched twice so it can be referred to in either role.
MP-Pr-cDSH-Hu-DP

Finds a Process that is receiving data of which there is a copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no Data Pool associated with the Data.
MP-PSDP

Finds a Process that serves stored Data.
MP-PsDSH-DP

Finds a Process serving (but not processing) Data stored on its own local Host, and the corresponding Data Copy, where there is no data pool associated with the same data.
MP-PuDFDI

Finds a data flow to a process that needs the data as input, plus optionally the process manager.
MP-RUIDO

Finds a Process that enables remote user input.
MP-RUODI

Finds a Process that enables remote user output.
MP-Pr-cDH-DS-Hu-DA

Finds a Process that is receiving data of which there is no copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no data access associated with this Process and Data.
MP-ScDDPDADS-cz

Finds a Data Asset controlled by a vault which is outbound from a Process and fulfilled by an uncontrolled inbound Data Asset, and where the Process does not get tokens from the vault.
MP-ScDSPDIcD

Finds a Data Asset controlled by a vault which is input to a Process that creates output.
MP-ScDSPDI-DD

Finds a Data Asset controlled by a vault which is input to a Process, but does not fulfil any outbound data asset.
MP-SDUDADS

Finds a Service enabling access for a Data Use, where the Service writes to a local Data Copy.
MP-SDUDSDA

Finds a Service enabling access for a Data Use, where the Service reads from a local Data Copy.
MP-StoPDA

Finds a Stakeholder operating a Process that accesses Data.
MP-HsACDS-V

Finds a stored copy of Data on a Host that is not encrypted using keys from a vault, plus location contexts in which the host is accessible.
MP-ScDSPDADD-cz

Finds a Data Asset controlled by a vault which is inbound to a Process and used to fulfil an uncontrolled outbound Data Asset, and where the Process does not get tokens from the vault.
MP-PpDADA-V

Finds a Process processing data to create a data asset, which is not encrypted by keys from a vault.
MP-PmDFO-kDADFO

Finds a Process that forwards flowing data from one or more sources but not from local storage in the direction of a data store or source, plus the associated Data and Data Access assets. The forwarding Process is matched twice, so it can be referred to by either role name.
MP-PmDFODADFO-k

Change from: Finds a Process that forwards flowing data from one or more sources but not from local storage in the direction of a data store or source, plus the associated Data and Data Access assets. The forwarding Process is matched twice, so it can be referred to by either role name.
MP-PDI

Finds a Process that uses Data as input, or displays it to an interactive user.
MP-PDI+DO-DS-S

Finds a Process that uses Data as input, or displays it to an interactive user, where the data is not stored anywhere, and there is no process that enables and controls the Data access, but there is a process creating the data.
MP-PDI+DS-S

Finds a Process that uses Data as input, or displays it to an interactive user, where there is at least one stored copy of the data, but there is no process that enables and controls the Data access.
MP-PDIDDF-DA

Finds a Process using Data as input that contains a Data Field, but fulfilled by no data asset that includes the field.
MP-PDI-Hu

Finds a Process that uses Data as input and does not have an interactive user.
MP-PDO

Finds a Process that creates Data as output, or gets it from an interactive user.
MP-PDO+DS-S

Finds a Process that creates Data as output, or gets it from an interactive user, where there is at least one stored copy of the data, but there is no process that enables and controls access.
MP-PDOScDD-DS

Finds a Data Asset controlled by a vault which is output from a Process, and not fulfilled by any inbound data asset.
MP-PDR

Finds a Process acting as a Data Relay.
MP-PHHDS

Finds a Physical Host located in a Space, plus data stored on the host or on a virtual host running there, plus optionally a user of the physical host.
MP-P-iDFDI

Finds a data flow to a process that uses the data as input, where the data does not come from an interactive user, plus optionally the process manager. The Process is matched twice, so it can be referred to by either role name.
MP-PmDFIDADFI

Finds a Process that forwards flowing data from one or more sources but not from local storage in the direction of a data consumer, plus the associated Data and Data Access assets. The forwarding Process is matched twice, so it can be referred to by either role name.
MP-PmDFIDADFI-k

Change from: Finds a Process that forwards flowing data from one or more sources but not from local storage in the direction of a data consumer, plus the associated Data and Data Access assets. The forwarding Process is matched twice, so it can be referred to by either role name.
MP-PmDFI-kDADFI

Finds a Process that forwards flowing data from one or more sources but not from local storage in the direction of a data consumer, plus the associated Data and Data Access assets. The forwarding Process is matched twice, so it can be referred to by either role name.
MP-PmDFODADFO

Finds a Process that forwards flowing data from one or more sources but not from local storage in the direction of a data store or source, plus the associated Data and Data Access assets. The forwarding Process is matched twice, so it can be referred to by either role name.
MP-PDFV

Change from: Finds a Data Flow protected by keys from a vault, plus the data flow source and destination processes. The destination process is matched twice so it can be referred to in either role.
MP-HsACDS

Finds a stored copy of Data on a Host, plus location contexts in which the host is accessible.
MP-P-uDFDI

Finds a data flow to a process that uses the data as input without depending on the data, plus optionally the process manager. The Process is matched twice, so it can be referred to by either role name.
MP-HP-uDS-VDI

Finds a stored data input not encrypted with keys from a vault to a process, which does not depend on the data, plus the process and data host and optionally the host and process managers.
MP-HDBDSDF

Finds a Host running a DB process acting as a Stored Data Pool for a Data Flow to a destination process, and optionally the DB Process and Host managers.
MP-HDBsD-V

Finds a Host of a Database that is serving locally stored Data that is not encrypted with keys from a vault.
MP-HDCDF

Finds a Data Flow for which there is a Data Cache on the Host of a sending or receiving process.
MP-HDS

Finds a stored copy of Data on a Host, and its Physical Host.
MP-HDSV

Finds a copy of Data encrypted with a key from a vault, stored on a Host, and its Physical Host.
MP-HDS-V

Finds a copy of Data not encrypted with a key from a vault, stored on a Host, and the Physical Host where this is deployed.
MP-HDBDRDF

Finds a Host running a DB process acting as a Data Relay for a Data Flow to a destination process, and optionally the DB Process and Host managers.
MP-HPDAcDS

Finds a Host running a Process that CRUD creates locally stored Data, plus optionally the host and process managers.
MP-HPDADS2dDO

Finds a Host running a Process that writes to a local stored Data Copy, and sources data from two distinct data producers.
MP-HPDADS-crudu

Finds a Host storing a Data Copy fulfilled by a local process that does not CRUD update the data copy.
MP-HPDADSDU

Finds a Host storing a Data Copy fulfilled by a Data Access that sources data from a Data Update (from a process on any Host).
MP-HPDAuDS

Finds a Host running a Process that CRUD updates locally stored Data, plus optionally the host and process managers.
MP-HPDDR+DS+DFfi-fiDF

Finds Host running a Process relaying Data which is stored somewhere in the system, where Data flows to the relay from a data store, but is not sent from the relay.
MP-HPDDR+DS-DA2

Finds Host running a Process relaying Data which is stored somewhere in the system, where there is no flow of data through the relay.
MP-HPDADF

Finds a Host running a Process that sends a Data Flow to a destination process, plus the associated Data and Data Access assets, and optionally the Process and Host managers.
MP-HD-aHD-DS

Finds a Host that stores Data but has no Data Copy yet, and is not in a virtualisation stack above another Host that stores the same data.
MP-DUDA-eS

Finds a service controlling access to a data access, which is fulfilled by a data use that is not yet controlled by any process.
MP-DSPDF-VDB

Finds a DB serving data obtained via a data flow from a remote data store, where the stored data is not encrypted with keys from a vault.
MP-CSDF-VdDA2

Finds two process participating in a data flow not encrypted with keys from a vault.
MP-D+DS-cP-iHu

Finds a Data asset that is not email and is not created by any process or user input, but is stored on at least one host. Such Data would need to be static for this situation to make sense.
MP-DADS

Finds a Data Access fulfilling a Data Copy.
MP-DADU-eS

Finds a service controlling access to a data access, which fulfils a data use that is not yet controlled by any process.
MP-DAllDS

Finds all stored copies of a Data asset.
MP-DA-VDBs-pDA

Finds a DB processing data queries using a data asset, which is not encrypted with keys from a vault.
MP-DAVPDA

Finds a Process consuming a data asset controlled by a vault.
MP-DA-VPpDA

Finds a Process processing data using a data asset, which is not encrypted by keys from a vault.
MP-DBsDRDF-V

Finds a DB serving data that is stored on a separate Host and supplied to the DB in a data flow, not encrypted with keys from a vault.
MP-HPuDS-VDI

Finds a stored data input needed by a process that is not encrypted with keys from a vault, plus the process and data host and optionally the host and process managers.
MP-DBs-pDADA-V

Finds a DB processing queries to create a data asset, which is not encrypted by keys from a vault.
MP-DCDFcV

Finds a Data Flow controlled by a key Vault for which there is a Data Cache.
MP-D-DS-cP-iHu

Finds a Data asset that is not email and is not created by any process or user input, and not stored on any host. Such Data is neither dynamic nor static, and since it must be one or the other, it must be an error.
MP-DSDA

Finds a Data Access fulfilled by a Data Copy.
MP-DSPDFVDB

Finds a DB serving data obtained via a data flow from a remote data store, where the stored data is encrypted with keys from a vault.
MP-HPDDR+DS-DFfo+foDF

Finds Host running a Process relaying Data which is stored in the system, where Data flows from the relay to a data store, but is not received from any data producer.
MP-HPDDR-DS+DFfi-fiDF

Finds Host running a Process relaying Data which is not stored in the system, where Data flows to the relay from a data producer, but is not sent from the relay.
MP-HDBsDV

Finds a Host running a Database process that serves a stored DataCopy encrypted with keys from a vault, and the associated DataPool.
MP-HPDFDADS

Finds a Host running a Process that receives an incoming Data Flow and writes the data to local storage, plus optionally the host and process managers.
MP-HPmDFDAcDS

Finds a Host running a Process that CRUD creates locally stored Data from one or more incoming flows, plus optionally the host and process managers.
MP-HPmDFDAcDS-k

Finds a Host running a Process that CRUD creates locally stored Data not encryptable with keys from a vault from one or more incoming flows, plus optionally the host and process managers.
MP-HPmDF-kDAcDS

Finds a Host running a Process that CRUD creates locally stored Data from one or more incoming flows, not decryptable with keys from a vault, plus optionally the host and process managers.
MP-HPsACDAdDS

Finds a Host running a Process that CRUD deletes locally stored Data, plus any location context for access to the Host with the rights of the Process, and optionally the Host and Process managers.
MP-HPsACDOdDS-V

Finds a Host running a Process that CRUD deletes locally stored Data not encrypted using keys from a vault, which it produces as output, plus any location context for access to the Host with the rights of the Process, and optionally the Host and Process managers.
MP-HPsACd-pDS-V

Finds a host running a Process with write/delete access (crudd) to a locally stored data copy not controlled by a key vault, which it does not process (i.e., it serves the data), plus the data access asset representing the data deserialization, the access contexts for the process on this host, any data fields included in the stored data, and optionally the host manager.
MP-HPsACdpDS-V

Finds a host running a Process with write/delete access (crudd) to a locally stored data copy not controlled by a key vault, which it also processes, plus the data access asset representing the data deserialization, the access contexts for the process on this host, any data fields included in the stored data, and optionally the host manager.
MP-HPsACDSrDI

Finds a Host running a Process that CRUD reads a locally stored copy of Data it uses as input, plus any location context for access to the Host with the rights of the Process, and optionally the Host and Process managers.
MP-HPsACr-pDS-V

Finds a host running a Process with read access (crudr) to a locally stored data copy not controlled by a key vault, which it does not process (i.e., it serves the data), plus the data access asset representing the data deserialization, the access contexts for the process on this host, any data fields included in the stored data, and optionally the host manager.
MP-HPsACrpDS-V

Finds a host running a Process with read access (crudr) to a locally stored data copy not controlled by a key vault, which it also processes, plus the data access asset representing the data deserialization, the access contexts for the process on this host, any data fields included in the stored data, and optionally the host manager.
MP-HPsD-DS

Finds a Process serving (but not processing) Data and the process host, where there is no copy of the data stored on the same host, and no DataAccess asset between Process and Data.
MP-HPsDPDFDS

Finds a Host that stores a copy of Data served by and sent to a Process on the same Host, plus the associated Data Flow and Data Pool.
MP-HPDDR-DS-DA2

Finds Host running a Process relaying Data which is not stored in the system, where there is no flow of data through the relay.
MP-HPuDSDI

Finds a stored data input needed by a process, plus the process and data host and optionally the host and process managers.
MP-HP-uDSDI

Finds a stored data input to a process, which does not depend on the data, plus the process and data host and optionally the host and process managers.
MP-HP-iDSDI

Finds a stored data input to a process, which is not reviewed and updated by a user, plus the process and data host and optionally the host and process managers.
MP-HP-iDS

Finds a Host running a process that stores a local copy of data that it did not get from a user, plus optionally the host and process managers.
MP-HPsDPDSDF

Finds a Host that stores a copy of Data served by and sent from a Process on the same Host, plus the associated Data Flow and Data Pool.
MP-HP-iDOdDS

Finds a Host running a Process that has the right to delete locally stored Data which it computes as output (i.e. not coming from a user), plus optionally the host and process managers.
MP-HP-iDODF

Finds a Host running a Process that creates (not from user input) a Data Flow to a destination process, plus the associated Data and Data Output assets, and optionally the Process and Host managers.
MP-HPDFDAuDS

Finds a Host running a Process that CRUD updates locally stored Data by saving an incoming Data Flow, plus optionally the host and process managers.
MP-HPDFDI

Finds a Host running a Process that receives an incoming Data Flow and uses it as input, plus optionally the host and process managers. The Process is matched twice, so it can be referred to by either role name.
MP-HPDF-VDAuDS

Finds a Host running a Process that CRUD updates locally stored Data, by saving an incoming Data Flow not encrypted with keys from a vault, plus optionally the host and process managers.
MP-HPDF-VDI

Change from: Finds a Host running a Process that receives an incoming Data Flow not encrypted with keys from a vault, and uses it as input, plus optionally the host and process managers. The Process is matched twice, so it can be referred to by either role name.
MP-HPDOcDS-V

Finds a Host running a Process that CRUD creates locally stored Data not encrypted with keys from a vault, which it produces as output, plus optionally the host and process managers.
MP-HPDODF-V

Finds a Host running a Process that creates (possibly from user input) a Data Flow not encrypted with keys from a vault, to send to a destination process, plus the associated Data and Data Output assets, and optionally the Process and Host managers.
MP-HPDFDAuDS-V

Finds a Host running a Process that CRUD updates locally stored Data not encrypted with keys from a vault by saving an incoming Data Flow, plus optionally the host and process managers.
MP-HPDSDA-crudr

Finds a Host storing a Data Copy that fulfils a Data Access by a Process on the same Host, where there is no CRUDR relationship between the Process and Data Copy.
MP-HPDSDADF

Finds a Host storing a Data Copy that is read and sent in a data flow by a Process on the same Host, plus optionally the Host and Process managers.
MP-HPDSDADF-V

Finds a Host storing a Data Copy that is read and sent in a data flow not encrypted with keys from a vault by a Process on the same Host, plus optionally the Host and Process managers.
MP-HPDS-fDI-DO-DFI

Finds a Host with a stored Data Copy, running a Process that has a Data Input asset for the same Data that is not yet fulfilled by the stored Data Copy, which is also not fulfilled by an incoming data flow, and where the process does not have a Data Output asset (i.e. the Data Access is not a Data Update).
MP-HPDS-VDADF

Finds a Host storing a Data Copy not encrypted with keys from a vault, that is read and sent in a data flow by a Process on the same Host, plus optionally the Host and Process managers.
MP-HPeD

Finds a Host for a Process that creates and appends to locally stored Data.
MP-HPDOuDS-V

Finds a Host running a Process that CRUD updates locally stored Data not encrypted with keys from a vault, which it produces as output, plus optionally the host and process managers.

MP-PDO-gDAnDF-i

Finds a process creating data, the data access asset (a data output) fulfilling the output data asset, the data is not spam, the process does not ignore a data field, and the data asset needs this field but does not yet include it.
MP-Pc-rDSH-S-Hu-DA

Finds a Process that is creating data of which there is a copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no data access associated with this Process and Data, and no Data Pool at this Host associated with the Data.
MP-Pc-rDSH+S-Hu-DA

Finds a Process that is creating data of which there is a copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no data access associated with this Process and Data, but there is at least one Data Pool at this Host associated with the Data.
MP-PaDSH-S-Hu-DA

Finds a Process that is amending data of which there is a copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no data access associated with this Process and Data, and no Data Pool at this Host associated with the Data.
MP-PaDSH+S-Hu-DA

Finds a Process that is amending data of which there is a copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no data access associated with this Process and Data, but there is at least one Data Pool at this Host associated with the Data.
MP-HuaDSPH-S-DA

Finds a Human amending Data by interacting (possibly remotely) with a Process that processes the Data, of which there is a copy on the same Host, where there is no Data Pool associated with the data at that Host and as yet no Data Access associated with this Process and Data.
MP-Hui-vDSPH+S-DA

Finds a Human entering Data by interacting (possibly remotely) with a Process that processes the Data, of which there is a copy on the same Host, where there is a Data Pool associated with the data at that Host but as yet no Data Access associated with this Process and Data.
MP-HuaDSPH+S-DA

Finds a Human amending Data by interacting (possibly remotely) with a Process that processes the Data, of which there is a copy on the same Host, where there is a Data Pool associated with the data at that Host but as yet no Data Access associated with this Process and Data.
MP-HSDADPPDXP-Hu-DP

Finds a service with a data access to which there is a data path from a non-interactive process not at the end of the path, that exchanges data with a third process from which there is no data path to the same data access, where all three processes have the same host.
MP-HSDADPDXP-Hu-DP

Finds a service with a data access at the end of a data path process that exchanges data with a second process from which there is no data path to the same data access, where both processes have the same Host.
MP-HPrD-DS-DA

Finds a host running a Process relaying but not processing Data, where there is no associated data access asset, and no data copy stored on the process host.
MP-PDP

Finds a Process that implicitly or explicitly serves Data.
MP-Hui-vDSPH-S-DA

Finds a Human entering Data by interacting (possibly remotely) with a Process that processes the Data, of which there is a copy on the same Host, where there is no Data Pool associated with the data at that Host and as yet no Data Access associated with this Process and Data.
MP-PIP-S

Finds a Process that uses stored data as input and the data has no other source.
MP-RevDFfDP2P

Finds an inbound (reverse) data flow to a process on a data path leading to that process.
MP-Pr-cDSH-S-Hu-DA

Finds a Process that is receiving data of which there is a copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no data access associated with this Process and Data, and no Data Pool at this Host associated with the Data.
MP-PSDP-S

Finds a Process that serves stored Data that has no other source.
MP-PTDR

Finds a temporary data relay asset and the associated process and data.
MP-RA-fDCSDD

Finds a remote access client acting as a data source, which does not yet have a source of data, but has a data channel to a service that can act as a data destination.
MP-RA-fDCSDS

Finds a remote access client acting as a data destination, that has no data source, but with an end-to-end data channel to a service that may act as a possible data source.
MP-RevDFf2DP2P

Finds an inbound Data Flow from one (longer) data path to a second (shorter) data path, and a data path which is a subset of the first, and of which the second is a subset, plus the two adjacent processes at the end of that in between data path.
MP-RevDFtDP2P

Finds an inbound (reverse) data flow from a process on a data path leading from that process.
MP-SDADPDXP-Hu-DP

Finds a non-interactive service at the end of a data path that exchanges data with a second process from which there is no data path to the same data access.
MP-SDADPDXPRAC-DP

Finds a service at the end of a data path that exchanges data with a second process from which there is no data path to the same data access, and there is a remote access client using remotely both processes.
MP-SDADPDXRAC-DP

Finds a service at the end of a data path that exchanges data with a remote access client from which there is no data path to the same data access.
MP-SDADPPDXP-Hu-DP

Finds a service with a data access to which there is a data path from a non-interactive process that exchanges data with a third process which is not the service and from which there is no data path to the same data access.
MP-SDADPPDXPRAC-DP

Finds a service with a data access to which there is a data path from a process that exchanges data with a third process which is not the service and from which there is no data path to the same data access, and there is a remote access client using remotely the second and third processes.
MP-SDADPPDXRAC-DP

Finds a service with a data access to which there is a data path from a process that exchanges data with a remote access client which is not the service and from which there is no data path to the same data access.
MP-HPDO-fDS-DA

Finds a Host running a Process that creates locally stored Data which it produces as output, but where the Data Output asset does not fulfil the stored copy, and is not a source of data for any other Data Access that fulfils the stored copy.
MP-Pr-cDSH+S-Hu-DA

Finds a Process that is receiving data of which there is a copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no data access associated with this Process and Data, but there is at least one Data Pool at this Host associated with the Data.
MP-HDSPDIfdDA-DP-f

Finds a data input that is a destination for data from some other source and used by a process whose host stores a copy of the data, which is not fulfilled by any Data Access with the same data source.
MP-DAO-iDADInDF-n

Finds an output data asset fulfilling (via a data access) an input data asset that needs a field contained in the data, where the data is not spam, and the output asset does not yet need or include this field.
MP-FwdDFtDP2P

Finds an outbound (forward) data flow to a process on a data path leading to that process.
MP-DADSDCSDD-f

Finds an active data channel carrying a forward flow that ends at a data destination that is itself a data source, and the channel beyond that source to another destination on the same data path.
MP-DAOiDADInDF-i

Finds an output data asset that includes a field contained in the data fulfilling (via a data access) an input data asset that needs the field, where the data is not spam, and the input data asset does not yet include the field.
MP-DAPDADF-g

Finds a Process receiving Data that contains a Data Field, via a Data Asset, where the data is not spam, the process does not ignore the field, and the data asset does not already include the field.
MP-DC1

Finds a solo Data Channel.
MP-DC2TDRfDP2

Finds an active forward (output) data channel leading to a transparent data relay from which another active channel continues along the same data path.
MP-DC2TDRrDP2

Finds an active reverse (input) data channel leading to a transparent data relay from which another active channel continues along the same data path.
MP-HDS2DPfDA

Finds a Host with a stored copy of data at which there are two processes, one of which writes to the data, and a data source for this.
MP-DC2xrDA2

Finds a reverse Data Channel from a Data Destination that extends another Data Channel to a Data Source.
MP-DC3-x

Finds a data channel which extends a second channel which extends a third channel, but the first channel does not yet extend the third.
MP-DC3xf-xf

Finds an active forward data channel that extends a second channel that extends a third channel (meaning there are transparent relay processes between the channels), but the first channel does not yet extend the third.
MP-DC3xr-xr

Finds an active reverse data channel that extends a second channel that extends a third channel (meaning there are transparent relay processes between the channels), but the first channel does not yet extend the third.
MP-DCDFDF

Finds a Data Flow containing a Data Field for which there is a Data Cache.
MP-DDDCDP2oDS

Finds a Data Desination for which there is an untried Data Channel to a next Process, which uses a Data Path that extends another Data Path to another Process, and where no previously found process is a data source.
MP-DDDCDS2P

Finds a Data Source fulfilling a Data Destination, where neither is a reverse relay, with an active reverse data channel to the destination and a data channel from the source, plus the associated processes and data paths.
MP-DC2xfDA2

Finds a forward Data Channel from a Data Source that extends another Data Channel to a Data Destination.
MP-DD-fDCSDS

Finds a data destination, a data access from which that is a possible destination, that has a data channel to a relay process from which there is another channel back along the same data path to a source that does not yet have the same possible data destionation.
MP-DI-fDCSDS

Finds a data input client acting as a data destination, that is not acting as a data pool, with an end-to-end data channel to a service that may act as a possible data source.
MP-DO-fDCSDD

Finds a data output process that acts as a data source, which does not yet have a source of data, but has a data channel to a service that can act as a data destination.
MP-DP1

Finds a solo Data Path.
MP-DP3-x

Finds a data path which extends a second path which extends a third path, but the first path does not yet extend the third.
MP-DSDAfDD-fS

Finds a DataDestination with no data source but a possible data source that itself has a source, and a data channel to the possible data source from a data relay that is also a possible data source but itself has no source.
MP-DSDCDD2P

Finds a forward flow Data Channel for a source Data Asset that fulfils a destination Data Asset fulfilled by the source, where neither is tagged as a forward relay, plus the process assets and the data paths from the source and to the destination, in which the former is an extension of the latter.
MP-DSDCDP2oDD

Finds a Data Source for which there is a Data Channel to a next Process, which uses a Data Path that extends another Data Path to another Process, and where no previously found process is a data destination.
MP-DSDDF-Hu-P

Finds a Data Copy of a Data asset containing a Data Field, where the data is not spam, and is not created by any process nor provided by any user.
MP-DSD-iDF

Finds a Data asset containing a Data Field, where the data is not spam, with a stored Data Copy that does not include the field.
MP-DSDPS

Finds a data path from a process to a service, where the process is a source of the data.
MP-DDDPS

Finds a Data Path from a Process that is a Data Destination to a Service.
MP-FwdDFf2DP2P

Finds an outbound Data Flow from one (longer) data path to a second (shorter) data path, and a data path which is a subset of the first, and of which the second is a subset, plus the two adjacent processes at the end of that in between data path.
MP-FwdDFfDP2P

Finds an outbound (forward) data flow from a process on a data path leading to that process.

MP-Se-sD-sD

Finds a Sensor that is sensing sense data.
MP-Se-sD

Finds a Sensor that is not sensing data.
MP-SesD

Finds a Sensor and its sensed Data.
MP-SePDsFF

Finds a Sensor with its onboard process and data, plus all flows of this data from the process (i.e., out of the sensor), at least one of which must be involved in the pattern.
MP-SePDmFF

Finds a Sensor with its onboard process and data, plus all flows of this data from the process (i.e., out of the sensor), all of which must be involved in the pattern.
MP-SePD

Finds a Sensor with its onboard process and data.
MP-SHuTh-Hu

Finds a Human managing a Space in which an unmanaged Thing is located.
MP-Se-cD-cD

Finds a Sensor with onboard control data controlling it.
MP-PuSe

Finds a client Process that reads data from an IoT Sensor, along with its onboard simple communication Process and Data.
MP-PuCo

Finds a client Process that updates an IoT Controller, along with its control input Data and onboard communication Process.
MP-PrSe

Finds a client Process that receives data from an IoT Sensor, along with its onboard simple communication Process and Data.
MP-Pp-uSe

Finds a client Process that polls (but does not read) an IoT Sensor, along with its onboard simple communication Process and Data.
MP-HuiCo

Finds the control input for an IoT Controller, which is being used interactively by a Human.
MP-Pa-uCo

Finds a client Process that amends (but does not update) an IoT Controller, along with its control input Data and onboard communication Process.
MP-PcSe

Finds a client Process that alters control input to an IoT Sensor, along with its onboard simple communication Process and Data.
MP-Co

Finds a Controller and optionally its human manager.
MP-Co-cD-cD

Finds a solo Controller that is bieng controlled by onboard control data.
MP-CoPDS

Finds a Controller with its stored control input data.
MP-DcTh

Finds an IoT Thing and its control input Data.
MP-CoPD

Finds a Controller and its control input data, and optionally a human manager.
MP-HuiSe

Finds the control input and sensed output for an IoT Sensor, which is being used interactively by a Human, plus the interactive process that creates the output.
MP-HuiThaS-S

Finds a Human that has access to a space and uses an IoT Thing which has no specified location.
MP-HumThP-m

Finds a Human managing a Thing with an unmanaged onboard process.
MP-IoT-cD

Finds a solo IoT Thing that does not have onboard control data.
MP-DScSePDmFF

Finds a Sensor with its onboard process and output data, and its stored copy of control input data, plus all flows of this data from the process (i.e., out of the sensor), all of which must be involved in the pattern.

MP-HuDSHoJoSt

Finds a Host that is storing Data relating to a Human data subject who is not the Host operator, plus optionally the actual Operator and the Jurisdiction for the Host.
MP-JuSS

Finds space subject to a jurisdiction which is the entrance to another space that has no jurisdiction.
MP-JuPHS

Finds a host that is or runs on a physical host located in a space subject to a jurisdiction.
MP-JuHP

Finds a host subject to a jurisdiction that is hosting a process.
MP-HuDSH-St

Finds a Host storing Data related to a Human, where the host is not operated by the human, and it has no data controller.
MP-HuDP-St

Finds a Process that is using Data relating to a Human data subject, but there is no data controller defined.
MP-HuDSH-J

Finds a Host for which there is no Jurisdiction that is storing Data related to a Human who is not the operator of the Host.
MP-HuDP-J

Finds personal data used by a Process that is not controlled by the data subject, and is not subject to a well defined jurisdiction.
MP-HuDoPS-o

Finds a Service that serves data relating to a Human data subject, along with its host and operator, and data processing operated by the subject that uses this Service.
MP-Hu-aDoPS-o

Finds a Service that serves data relating to a Human data subject who may be a child, along with its host and operator, and data processing operated by the subject that uses this Service.
MP-DSHuoO

Finds personal data being communicated across a border, to a process that is an intermediary (not the final destination) and optionally has an operator organisation.
MP-DFHuoO

Finds personal data being transferred across a border to a process that optionally has an operator organisation.
MP-HuDPoJoSt

Finds a Process using Data relating to a Human who is not the Process operator, plus optionally the process Operator and Jurisdication.

MP-L1SSg2

Finds a gateway between two distinct layer 1 subnets (i.e. Bluetooth or USB connections), along with the forward and return path segments via the gateway.
MP-L1SSg2AC

Finds a gateway between two distinct layer 1 subnets (i.e. Bluetooth or USB connections), along with the forward and return path segments via the gateway, and a context in which the gateway is connected to both subnets.
MP-L3cGc-rL1

Finds a Physical Host gateway on an IP subnet with a paring connection from a USB or Bluetooth device, all in the same space.
MP-L3cGrL1

Finds a USB/Bluetooth device connected from an IP subnet to a Host, all in the same space.
MP-LTethSg2

Finds a gateway from a Host via a layer 1 subnet (i.e., Bluetooth or USB) connection and a tethered gateway to an IP subnet, along with the forward and return path segments via the gateway.
MP-LTethSg2AC

Finds a Host connected via a layer 1 subnet (i.e., Bluetooth or USB) connection and a tethered gateway to an IP subnet, plus the forward and reverse path segment via the gateway, and a context in which the gateway is connected to both subnets.
MP-LTRevSg2AC

Finds a Host connected via a layer 1 subnet (i.e., Bluetooth or USB) connection and a reverse tethered gateway to an IP subnet, and the forward path segment via the gateway, and a context in which the gateway is connected to both subnets.
MP-UHDSrP

Finds Data stored on a USB Device paired with a USB Host running a service for the Data, where the data is used by a Process running on some other host that doesn't use any other process capable of providing the data.
MP-UHDrP-S

Finds Data stored on a USB Device paired with a USB Host that does not also store the data, where the data is used by a Process running on a third distinct host.
MP-UHS

Finds a USB Host located in a Space.
MP-UPc-rGrUP

Finds a USB hub between a USB device and a USB host (it provides the USB Pair from the USB Host, but not to the USB device).
MP-UPrGc-rUP

Finds a USB hub between a USB host and a USB device (it provides the USB Pair from the USB Host, but not to the USB device).
MP-USBD-S

Finds Data stored on a USB device where there is no local process serving the data or creating it from scratch.
MP-UHDpP-S

Finds Data stored on a USB Device paired with a USB Host which is running a process using the Data, and the Data is not also stored on the USB Host.
MP-L1rGcL3

Finds a Bluetooth or USB device connected from a host to an IP subnet, all in the same space.
MP-LTRevSg2

Finds a gateway from a Host via a layer 1 subnet (i.e., Bluetooth or USB) connection and a reverse tethered gateway to an IP subnet, and the forward path segment via the gateway.
MP-HUSBTHS-S

Finds a Host in a Space that accepts pairing via USB with a TrivialHost that has no location.
MP-L1c-rGcL3

Finds a physical host with a pairing connection from a distinct host that is also connected to an IP subnet, all in the same space. This is a PC on a network that has a link to a USB or Bluetooth device.
MP-BPcGcBP

Finds a Bluetooth device paired with two other devices.
MP-HBImSG

Finds a pair of hosts pairing via Bluetooth, and the spaces in which the pair operates.
MP-HBISG

Finds a pair of hosts pairing via Bluetooth in a Space.
MP-HBTTHS-S

Finds a Host in a Space that accepts pairing via Bluetooth with a TrivialHost that has no location.
MP-HL1HS

Finds two distinct hosts in a space connected via a Bluetooth or USB pair, the associated location access contexts, and optionally the manager of the local host.
MP-HpBRH

Finds two Physical Hosts that are paired over Bluetooth.
MP-HL1H

Finds two hosts connected via a Bluetooth or USB pair, and the space in which this connection is established, the interface connecting with one of them, and optionally the manager of that host.
MP-HuiHBTTH-Hu

Finds a TrivialHost with no manager, paired via Bluetooth with another host used by a Human.
MP-HuiHUSBTH-Hu

Finds a TrivialHost with no manager, paired via USB with another host used by a Human.
MP-HUISG

Finds a pair of hosts pairing via USB, and the space in which they are located.
MP-HumHBTTH-Hu

Finds a TrivialHost with no manager, paired via Bluetooth with another host managed by a Human.
MP-HumHUSBTH-Hu

Finds a TrivialHost with no manager, paired via USB with another host managed by a Human.
MP-HumTHS

Finds a Human managing a Trivial Host located in a space.
MP-HpURH

Finds two Physical Hosts that are paired over USB.

MP-PCPHLSS

Finds a Process location access context and the related process, host and space and one related subnet.
MP-PHHPS

Finds a process running on a host that can be accessed from a space.
MP-PcWH

Finds a WiFiLAN and its local implementation, plus a controlling process.
MP-PH

Finds a solo physical host, and optionally its manager.
MP-PH2

Finds a process with two distinct hosts.
MP-PHdH

Finds a host that has a physical host (but is not the physical host).
MP-PHHS

Finds a host that directly is or indirectly has a physical host in a space, and all connected logical subnets accessible from that space.
MP-PS-iH

Finds a solo Physical Subnet that is not a hotspot.
MP-PHS

Finds a Physical Host located in a Space, and optionally the host manager and interactive user.
MP-PH-S

Finds a physical host that is not located in any space.
MP-PHS-iC

Finds a Physical Host that is not a Cluster located in a Space, and optionally the host manager and interactive user.
MP-PHS-iP

Finds a Physical Host that is not a Personal Device located in a Space, and optionally the host manager and interactive user.
MP-PMHHS

Finds a non-trivial Process running on a host whose physical host is a Mobile Console Host that may be located in a Space, plus associated process network access contexts from that Space, and optionally an interactive Process user.
MP-PnH

Finds a Process with no Host.
MP-PC-LnS

Finds a physical Cluster that is not controlled by any process.
MP-RAC

Finds a remote access client.
MP-PHLSS

Finds a host that has or directly is a physical host in a space and is connected to a logical subnet accessible from that space (other than an abstract hotspot).
MP-PccP

Finds two processes, each of which controls the other. This is the simplest case of a cyclic authentication dependency, which is a logical impossibility.
MP-IpH

Finds a Host providing an Internet class subnet.
MP-MHcIS

Finds a Mobile Console Host in a Public Space connected to the Internet.
MP-RACuHRASP-iPL

Finds a host running a process that is not a reverse proxy or a remote access service, and a remote access service that uses the process, and is used by a remote access client.
MP-HummH-e

Finds a human without access to email who is managing at least one host, but not interacting with any host.
MP-HumPH-m

Finds an unmanaged host running a process that has a manager.
MP-HumP-StSt

Finds a Human managing a Process, where the Human is not an employee, and the Process has no operator.
MP-HuoH-m

Finds a Human operating an unmanaged Host.
MP-HuPCH

Finds a Human interacting with a Process that is not a Remote Access Service running on an Interactive Host.
MP-HuSP

Finds a human user interacting with a smartphone which is a personal device with no other users.
MP-HuwStmH-St

Finds a Human working for an Employer, who manages a Host that has no other operator.
MP-HuwStmP-St

Finds a Human working for an Employer, and managing a Process that has no operator.
MP-IcP

Finds a Process controlling an Internet class subnet.
MP-InternetMP

Finds an Internet class network.
MP-HumH-StSt

Finds a Human who does not work for anyone else, managing a Host that has no operator.
MP-LnSuP-H

Finds a login service using a process where the two do not have the same Host.
MP-LS

Finds a solo Logical Subnet.
MP-LS-iH

Finds a solo Logical Subnet.
MP-LS-prH

Finds a Logical Subnet not provided by any host.
MP-MHC

Finds a solo Mobile Console Host.
MP-MHHS

Finds a Host whose physical host is a Mobile Console Host in a Space, where it can access at least one Logical Subnet (this pattern contains only multiple network access contexts), plus optionally an interactive user and system manager.
MP-RACuP-iP

Finds a Remote Access Client using a Process that is not a reverse proxy.
MP-TH

Finds a solo trivial host, and optionally the host manager, an interactive user, and any related access contexts.
MP-RAS

Finds a remote access service.
MP-StH

Finds a stakeholder operating a Host.
MP-StHP

Finds a Stakeholder operating a Host that runs a Process.
MP-StSPH-St

Finds a Private Space operated by a Stakeholder where a Fixed Host with no operator is located.
MP-StS-St

Finds a Private Space operated by a Stakeholder where access is not controlled by any stakeholder.
MP-Sv-LnS

Finds a Server that is not controlled by any process.
MP-THGP

Finds a trivial host running a general process.
MP-TP

Finds a solo trivial process.
MP-WHmWS

Finds a WiFi hotspot with at least one local implementation.
MP-WiFiSSoH

Finds a WiFi subnet accessible from a Space, the network it implements, and optionally the host providing the subnet and service controlling access to it.
MP-WmPH

Finds a solo World asset (i.e. the inferred global public space), in which at least one Host is assumed to be (due to having no other defined location).
MP-WpHS-aF

Finds a mobile host or virtual host running on it, in a space, providing a WiFi LAN which is not accessible from any space, and providing no other WiFiLAN accessible in its space.
MP-WpHSH-aF

Finds a mobile host or virtual host running on it, in a space, providing a WiFi LAN which is a hotspot, and no other WiFiLAN accessible in its space.
MP-WS-H

Finds a solo WiFiLAN that is not an abstract hotspot.
MP-WSSH

Finds a Wired Subnet provided by a Gateway host accessible from a Space, and optionally the process controlling access and the manager of the gateway.
MP-WSS-HP

Finds a Wired Subnet accessible from a Space, where there is no gateway specified as the subnet provider, and no controlling Process.
MP-WSSH-P

Finds a Wired Subnet with no controlling process, provided by a Gateway host accessible from a Space, and optionally the manager of the Gateway.
MP-HumHSt

Finds a Human managing a Host and their employer.
MP-StDC

Finds a stakeholder operating a data centre.
MP-RACuRHRASP-iPL

Finds a host running a process that is not a reverse proxy or a remote access service, and a remote access service that uses the process, where both are used remotely by a remote access client.
MP-SHuPH-Hu

Finds a Human managing a Space in which an unmanaged Fixed Host is located.
MP-SHP

Finds a Process running on a shell Host, and optionally the interactive process user and host manager.
MP-Rr

Finds a solo Router.
MP-Rr-LnS

Finds a Router that is not controlled by any process.
MP-RSSH

Finds a Radio Subnet provided by a Gateway Host accessible from a Space, and optionally the service controlling access to it and the gateway manager.
MP-RSS-HP

Finds a Radio Subnet accessible from a Space, and the subnet it implements locally, where there is no gateway specified as the subnet provider and no controlling Process.
MP-RSSH-P

Finds a Radio Subnet with no controlling process, provided by a Gateway host and accessible from a Space, plus optionally the manager of the Gateway.
MP-RTuHP-iPL-RAS

Finds a Host running a Process that is neither a remote access service nor a reverse proxy, but is used remotely by a Remote Terminal client, not mediated by a collocated remote access service, nor by a reverse proxy.
MP-RTuP-hCLI

Finds a Remote Terminal that uses a Process that has no CLI and is not a remote access service nor a proxy, plus the Process host.
MP-RTurP-hCLI

Finds a Remote Terminal that remotely uses a Process that has no CLI and is not a remote access service nor a proxy, plus the Process host.
MP-RTuRTuS-uR

Finds a remote terminal using remotely another remote terminal which is using remotely a third process that is not yet remotely used by the first.
MP-SH

Finds a Shell Host (i.e. a host that allows user commands with the rights of the administrator or some user/process).
MP-SHAC

Finds a Shell Host plus optionally its manager, and an associated access context.
MP-SHACPmAC

Finds a process running on a shell host in a space and the host location access context, with all related process location and network access contexts where the host is normally in that location or connected to that network.
MP-SHGP

Finds a simple host running a general process.
MP-SHLnSACPmAC

Finds a remote access service controlling a process running on a shell host in a space, and a location access context to the remote access service, related process access contexts and optionally the process manager.
MP-SHmACPAC

Finds a process running on a shell host in a space, and a location access context to the process, related host access contexts and optionally the host manager.
MP-SHmACRLnSAC

Finds a remote access service controlling a shell host in a space, and a location access context to the process, related host access contexts and optionally the host manager.
MP-SH-mHu

Finds a Shell Host that has no manager.
MP-SHP-iT

Finds a non-trivial Process running on a shell Host, and optionally the interactive process user and host manager.
MP-HumHP-iT

Finds a Human managing a host running a non-trivial process, and optionally an interactive process user.
MP-HuiPCHS

Finds a Human interacting with a Process running on a fixed Host located in a space, plus associated process access contexts.
MP-HumHoSt

Finds a Human managing a Host, and an optional employer of the Human.
MP-HACPmAC

Finds a process running on a host in a space and the host location access context, with all related process location and network access contexts.
MP-HACPmNC

Finds a process running on a host in a space and the host location access context, with all related process network access contexts.
MP-HCHLSS

Finds a Host location access context and the related host and space and one related subnet.
MP-Hc-pN-hP

Finds a Host connected to but not providing an Abstract Subnet, which controlled by a Process not running on the Host.
MP-HcWHS

Finds a WiFiLAN hotspot and its local implementation in a Space, and a host connected to the hotspot in that space.
MP-HHu2d

Finds a host with two distinct interactive users.
MP-H-iR-iMCHIUS

Finds a Host that is not a Router or a Mobile Console Host in a Public Space connected to the Internet.
MP-HAC

Finds a Host in a Space with the associated access context, with optionally its manager, and all related access contexts.
MP-HL3S

Finds a host connected to an L3 subnet, and an associated network access context, plus optionally the host manager.
MP-HLS

Finds a Host connected to a LogicalSubnet.
MP-Hm2dHu

Finds a host and two distinct humans that manage the host.
MP-HmAC

Finds a solo Host plus all location access contexts, and optionally the host manager and interactive user.
MP-HmACPAC

Finds a process running on a host in a space and an associated process location access context, plus related host access contexts and optionally the host manager and process user.
MP-HmNCPAC

Finds a process running on a host in a space and an associated process location access context, plus related process network access contexts.
MP-HP

Finds a Process and its Host, and optionally the host manager and the interactive user of the process.
MP-HPAC

Finds a non-trivial Process running on a Host in a Space and the associated process access context, plus optionally the host manager, the interactive process user, and all related access contexts.
MP-HLnSP-hCLI

Finds a Login Service and a Process used by it on the same Host that does not have a CLI.
MP-GH

Finds a General Host (i.e. a host that can run arbitrary processes).
MP-FpLSS

Finds a Logical Subnet which is provided by a Fixed Host (or a Virtual Host running on it) located in a Space.
MP-FcLSS

Finds a Logical Subnet to which is connected a Fixed Host (or a Virtual Host running on it) located in a Space.
MP-AC

Finds a solo AuthClient.
MP-AS

Finds a solo authentication/authorisation service.
MP-C

Finds a Host that represents a virtual or physical cluster.
MP-CcuS

Finds a client accessing a service and controlling access to the same service (which should never happen).
MP-CH

Finds a solo Fixed Console Host.
MP-CHS

Finds a Console Host located in a Space, with associated access contexts and optionally an interactive user and system manager.
MP-CHS-iP

Finds a Console Host located in a Space, with associated access contexts and optionally an interactive user and system manager, where the device is not a personal device.
MP-CuSHS

Finds a Host that is not a Cluster running both a Client and a Service used by the Client, in a Space.
MP-DC

Finds a solo Data Centre.
MP-DC-C

Finds a Data Centre with no server cluster of its own.
MP-DCH

Finds a Physical Host resourced by a Data Centre.
MP-DCLS

Finds a DataCentre connected to an Abstract Subnet, and a Router located in the DataCentre.
MP-DCpLS

Finds a DataCentre providing a LogicalSubnet.
MP-DC-R

Finds a Data Centre without its own Router.
MP-DCVHRS-H

Finds a Host that is physically in a DataCentre and connected to a WiFi LAN that is not provided by any host.
MP-DCVHWS-H

Finds a Host that is physically in a DataCentre and connected to a Wired LAN that is not provided by any host.
MP-DCWH-LS

Finds a Data Centre with a router and wired network, in which is located another Fixed Host not connected to or providing any subnet.
MP-HPHLS-S

Finds a logical subnet to which is connected a host that directly is or indirectly has a physical host, but the subnet is not accessible from any space where the host can be located. Note that there must be at least one host location, so this threat should not detect inferred routers implementing abstract subnets.
MP-HP-iT

Finds a non-trivial Process and its Host, and optionally the host manager and the interactive user of the process.
MP-H

Finds a solo Host, with optionally its manager(s) and interactive user(s).
MP-HprL3SAC

Finds a Layer 3 LogicalSubnet provided by a Host, along with an associated network access context.
MP-HuiHRAC

Finds a Human interacting with a host that runs a remote access client.
MP-HuiHS

Finds a Human interacting with a Host located in a space.
MP-HuiHSt

Finds a Human interacting with a Host, and their employer.
MP-HuimH-e

Finds a human without access to email who is interacting with at least one console host.
MP-HuiPCH

Finds a Human interacting with a Process running on a fixed console host.
MP-HumHP-im

Finds a Human managing a host running a process which has neither a manager nor an interactive user.
MP-HuiPDaS-S

Finds a Human that has access to a space and uses a Personal Device which has no specified location.
MP-HuiPH-Hu

Finds a Human interacting with a Personal Host that has no manager.
MP-HuiPH-iD

Finds a Human interacting with a Personal Host, where there is no self-referential link indicating that the device is shared with other users.
MP-HuiPoSt

Finds a Human using an interactive Process (but not a login shell), and an optional employer of the Human.
MP-HuiPSt

Finds a Human interacting directly with a Process, along with their employer and their contexts for accessing the Process.
MP-HuirP

Finds a Human remotely interacting with a Process.
MP-HuirRACP

Finds a Human interacting remotely with a Process via a Remote Access Clent which remotely uses the Process.
MP-HumCH

Finds a Human managing a Fixed Console Host.
MP-HumCHS-iP

Finds a Human managing a Host located in a space via the console, where the host is not a personal device.
MP-HumH

Finds a Human managing a Host.
MP-HPmAC

Finds a Process and its Host with associated access contexts, and optionally the host manager and the interactive user of the process.
MP-HuiHPSP

Finds a Human interacting with a Process running on an interactive Host located in a private space.
MP-HuiHP-m

Finds a Human interacting with an unmanaged Process running on a Host.
MP-HuiPCHS-iP

Finds a Human interacting with a Process running on a Host which is not their personal device, located in a space, plus associated process access contexts.
MP-HprLSAC

Finds a LogicalSubnet provided by a Host and an associated network access context.
MP-HprLS

Finds a LogicalSubnet provided by a Host.
MP-HuiHP

Finds a Human interacting with a Process running on a Host.
MP-HPsAC

Finds a Process and its Host with any associated location access contexts, and optionally the host manager and the interactive user of the process.
MP-HRASuPcC

Finds a host running a remote access service that launches a process which is used by a client that it also controls, implying the client forwards credentials to the process.
MP-HRASuPCcS

Finds a host running a remote access service that launches a process which is used by a client where both it and the client are controlled by the same authenticator, implying the client forwards credentials obtained from the authenticator to the process.
MP-HRASuPcS

Finds a host running a remote access service that launches a process which uses a service by which it is also controlled, implying that the process uses forwarded credentials to access the service.
MP-HsAC

Finds a solo Host plus any of its location access contexts, and optionally the host manager and interactive user.
MP-HsACP

Finds a Process and its Host, plus any location contexts allowing access to the host, and optionally the host manager and interactive process user.
MP-HuE

Finds a human interacting with an email client.
MP-HRASuPScS

Finds a host running a remote access service that launches a process which uses a service, where the service and the process are controlled by the same authenticator, implying that the process accesses the service using a token shared with it by a client.
MP-HuHE2AC

Finds a human interacting directly with an email client running on a host in a space, plus the associated location access context, and related process access contexts corresponding to the subnet connections of the host.
MP-Hui2H

Finds a physical Host with two distinct interactive users.
MP-HuiCHLnS-AC

Finds a human interacting with a console host and a login service running on a remote host, where the user does not interact with a terminal client that uses the login service.
MP-HuiDH

Finds a Human interacting with a Dumb Host (which is not possible).
MP-HuiHAC

Finds a Human interacting with a host that runs an authentication client.
MP-HuiH-Hu

Finds a Human interacting with a Host that has no manager.
MP-HuiHoSt

Finds a Human interacting with a Host but not with any of its processes, and optionally their employer.
MP-HuHE

Finds a human interacting directly with an email client running on a host.

MP-L3SSg2AC

Finds a gateway from an IP subnet to a distinct IP subnet, along with the forward and (open) return path segments via the gateway, and a context in which the gateway is connected to both subnets.
MP-NoH

Finds an open network path not via the Internet from a remote attacker subnet to (but not via) a Host connected to a local subnet, and the associated network interface and access context, plus the location contexts for the host being on that subnet, and optionally the host manager.
MP-L3SSg2AC-b

Finds a gateway from one IP subnet to an IP subnet, along with the segment asset representing the route via the gateway, and a context in which the gateway is connected to both subnets, where this route is not blocked by default.
MP-L3SSg2-b

Finds a gateway from one IP subnet to a second IP subnet, along with the segment asset representing the route via the gateway, where this route is not blocked by default.
MP-LoH

Finds a Host in a context where it is connected to a Layer 2 Logical Subnet, and the associated network interface, plus all contexts where it is connected to the same subnet (there may be others), and optionally the host manager.
MP-LPLS2NSg2

Finds a route between subnets through a gateway where NAT is used on the return path, and a logical path traversing the forward segment.
MP-LPsLS

Finds a Logical Subnet at the start of a Logical Path.
MP-NPLS

Finds a Network Path that starts and ends on the same subnet, i.e. it uses no gateways.
MP-WScMcWS

Finds a Mobile Host connected between two distinct Wired LANs, both in the same space.
MP-RIoH

Finds an open network path to the Internet from (but not via) a Host connected to a local subnet, and the associated network interface and access context, plus the location contexts for the host being on that subnet, and optionally the host manager.
MP-RNoH

Finds an open network path not via the Internet to a remote attacker subnet from (but not via) a Host connected to a local subnet, and the associated network interface and access context, plus the location contexts for the host being on that subnet, and optionally the host manager.
MP-RoH

Finds an open network path from a remote attacker L3 subnet to (and not via) a Host in a space connected to a local subnet, and the associated network interface, plus the contexts in which the host is so connected (there must be at least one), and optionally the host manager.
MP-RScGcRS

Finds a Physical Host connected between two distinct WiFi subnets, both in the same space.
MP-Sg

Finds a gateway host between two subnets, plus the logical segments representing routes between the subnets via this gateway.
MP-SgHfILS

Finds a Logical Segment via a Host routing from a Logical Subnet, and the Interface between the Host and Logical Subnet.
MP-SgHtILS

Finds a Logical Segment via a Host routing to a Logical Subnet, and the Interface between the Host and Logical Subnet.
MP-L3SSg2+b

Finds a gateway from one IP subnet to a second IP subnet, along with the segment asset representing the route via the gateway, where this route is blocked by default.
MP-NPmLSmSg

Finds a Network Path that traverses at least one Logical Segment, plus the Logical Subnet(s) it visits (in this pattern there should be more than one).
MP-L3SSg2

Finds a gateway from an IP subnet to a distinct IP subnet, along with the forward and (open) return path segments via the gateway.
MP-DDoH

Change from: Finds an open network path from the Internet to (but not via) a Host connected to a local subnet, and the associated network interface and access context, plus the location contexts for the host being on that subnet, and optionally the host manager.
MP-L3rGc-rL3

Finds a Host connected from an IP subnet it provides to a second, distinct IP subnet that it does not provide, both in the same space, where neither subnet is a hotspot.
MP-GdHRS

Finds a gateway providing a radio subnet to which a distinct host is connected, and optionally a process controlling access to the radio subnet, which in this case implements an abstract network (hotspot or cellular network), i.e. there is an implements relationship to a distinct abstract subnet.
MP-GdHRSi

Finds a gateway providing a radio subnet to which a distinct host is connected, and optionally a process controlling access to the radio subnet, which in this case does not implement a separate abstract network (hotspot or cellular network), i.e. it has a self-referential implements relationship.
MP-GdHWS

Finds a gateway providing a wired subnet to which a distinct host is connected, and optionally a process controlling access to the subnet.
MP-HIoH

Finds a Host connected to the Internet, and the associated network Interface, plus optionally the host manager.
MP-HLoH

Finds a Host with optional system manager, connected to a Layer 2 Logical Subnet, and the associated network Interface, and a second, distinct host on the same subnet.
MP-HRoH

Finds a Host with optional system manager, connected to a Layer 3 Logical Subnet (but not the Internet), and the associated network Interface, and a second, remote host on the same subnet.
MP-L3rGrL3

Finds a Host providing two distinct IP subnets both in the same space.
MP-HSRSoGS

Finds a host located in a space connecting to a radio subnet that is not a hotspot, plus optionally the controlling host and service for the subnet.
MP-HRSGSoS

Finds a host connecting to a radio subnet that is not an abstract hotspot, a gateway host located in a space that is providing the radio subnet, and optionally a service that controls access to the radio subnet.
MP-HWSGSoS

Finds a host connecting to a wired network it does not provide, a gateway host located in a space that is providing the network, and optionally the gateway host manager, and a service that controls access to the network.
MP-I

Finds a solo Interface, plus the associated host and subnet (which is not a hotspot) and optionally the host manager.
MP-ILSA

Finds an Interface connecting to a Logical Subnet that implements an Abstract Subnet that is not the same as the Logical Subnet.
MP-INC

Finds a solo Interface, plus the associated host, subnet, and a host network access context where the interface is connected.
MP-IoH

Finds an open network path from the Internet to (but not via) a Host connected to a local subnet, and the associated network interface and access context, plus the location contexts for the host being on that subnet, and optionally the host manager.
MP-L3c-rGc-rL3

Finds a Host connected from an IP subnet to a second distinct IP subnet, both in the same space, where neither is a hotspot and neither is provided by the gateway.
MP-L3c-rGrL3

Finds a Host connected from an IP subnet it does not provide to a second, distinct IP subnet that is provided by the Host, both in the same space, where neither subnet is a hotspot.
MP-HSWSoGS

Finds a host located in a space connecting to a wired subnet it does not provide, plus optionally the host manager, and the gateway and service controlling the subnet.

MP-HuDPS-io

Finds a Stakeholder operating a Process that is using Data relating to a Human data subject via a controlling Service, where the subject does not operate either the Process or the controlling Service.
MP-IoT-Hu

Finds a solo IoT Thing that does not relate to a Human data subject. Not used at present, but reserved for a future extension.
MP-HurTh-S-m

Finds a Thing relating to a Human, plus onboard data and processing, where there is no manager and no specified location.
MP-HurThcD

Finds control input to an IoT Thing related to a Human.
MP-HurSesD

Finds Data produced as output by a Sensor related to a Human.
MP-HurH-StSt

Finds a Human who does not work for anyone else, with a related personal device that has no operator.
MP-HuDPoS-i

Finds Stakeholder operating a Process that is using Data relating to a Human data subject via a controlling Service, where the subject operates the Service but not the Process.
MP-HuwStrH-St

Finds a Human working for an Employer, with a personal device that has no other operator.
MP-Hu-aDPoS-i

Finds Stakeholder operating a Process that is using Data relating to a Human data subject who may be a child via a controlling Service, where the subject operates the Service but not the Process.
MP-Hs

Finds a solo Health Sensor.
MP-H-Hu

Finds a Host that has no interactive user, no manager, and does not relate to any user.
MP-D-Hu-Th

Finds a solo Data asset which is not spam, not created by a Sensor or stored on an IoT Thing, and does not relate to a human subject.
MP-DHuDF

Finds a data asset relating to a human along with a flowing copy of the data.
MP-DHuDC

Finds a data asset relating to a human along with a stored copy of the data.
MP-Hu-aDPS-io

Finds a Stakeholder operating a Process that is using Data relating to a Human data subject who may be a child via a controlling Service, where the subject does not operate either the Process or the controlling Service.

MP-HuDFTCS

Finds a Human using a Web Browser that accesses via at least one IP subnet a Service that does not use a separate authenticator service, where the browser consumes a data flow viewed but not updated by the user, plus the data access and client channel assets associated with the data use and client-service commnication.
MP-SSCLS

Finds a service and its host and a service channel from a client via a logical subnet to which the host is connected, plus the associated network context.
MP-HuDSrXSS

Finds human using a web browser that uses a service with a host and host manager, where the browser also uses locally stored data not entered nor updated by the user, plus optionally the service manager.
MP-HuDSsXSS

Finds a web browser accessing a service which is using stored input, plus the service host and manager.
MP-HuDSTCS

Finds a Human using a Web Browser that accesses via at least one IP subnet a Service that does not use a separate authenticator service, where the browser consumes a locally stored data input viewed but not updated by the user, plus the data access and client channel assets associated with the data use and client-service commnication.
MP-HuHW2ACE

Finds a Human using a web browser running on a host to access email, when the host is located in a space, plus the associated host location access context and process contexts in which access to the webmail service is possible using networks to which the host is connected when in that location.
MP-HuiHCCC-nS

Finds a Human using a Host to run a Process that is a Client of a Service, where the Client is authenticated by the Service.
MP-HuiHrCCC-nS

Finds a Human using a Host running a Remote Access Client used to access a Process that is a Client of a Service, where the Client is authenticated by the Service.
MP-HuirRACSPH

Finds a Human interacting remotely with a Process via a Remote Access Clent, plus the Process Host, collocated Remote Access Service, and the Client Channel between the Remote Access Client and the Remote Access Service.
MP-CSL1H2

Finds a client and service whose hosts are paired, plus their interfaces to the pair.
MP-HumCCC-nS

Finds a User managing a Client that uses and authenticates directly with a Service, plus the ClientChannel between them, their hosts, and optionally the service and service host managers.
MP-HuoStCCCS

Finds a User of an interactive Client (not a transparent proxy) using a Service they do not manage, plus the ClientChannel and Client and Service hosts, and optionally the employer of the user and manager of the service.
MP-HuRACP

Finds a human interacting with a remote access client on a local host that is remotely using a process that is not a proxy.
MP-HuSAPmSC

Finds a service attack path from a subnet, plus the associated service process, host and manager, with service channels via the attack path.
MP-HuSC

Finds a service channel representing a privileged communication path to a service, plus the associated service process and service host, and the service and service host managers.
MP-HuStCCCS

Finds a User of an interactive Client using a Service they do not manage, plus the ClientChannel and Client and Service hosts, the employer of the user and optionally the manager of the service.
MP-ImSCf

Finds an interface between a host and a logical subnet where at least one service channel goes from that interface.
MP-LnSc-uP

Finds a Remote Access Service controlling access to a process that does not use the service.
MP-LnSucP-pS

Finds a remote access service using a process to which it forwards credentials, where that process does not need those credentials to access another service.
MP-HuDFsXSS

Finds a human using a web browser that accesses a service which is using inflowing data and whose host has a manager, plus optionally the service manager.
MP-HuiSP

Finds a Human interactively using a reverse proxy (which is not normally permitted).
MP-HuDFrXSS

Finds human using a web browser that uses a service with a host and a host manager, where the browser receives from another process (not the service) data not created by either the browser or its user, plus the client channel between the browser and the service which must go via an IP subnet, and optionally the service manager.
MP-DDoS

Finds a service with which at least one client communicates via the Internet.
MP-HuCAPmSC

Finds a client attack path from a subnet, plus the associated client, service process, host and manager, with service channels via the client attack path.
MP-CSL3H

Finds a client channel whose client and service are collocated on a cluster host that is accessible in a space, and an L3 Subnet connecting to the cluster.
MP-CuPnS-U

Finds a client accessing a process that directly or indirectly uses a service, where the process shares or forwards client credentials and sends them to the service, and there is no link saying the client is sending shared credentials to the service.
MP-CuPuSCC

Finds a client accessing a service indirectly, via one intermediary which communicates directly with both, plus the auth channels between client and service and between each and the intermediary process.
MP-CuPvnS

Finds a client accessing a process that is in a credential forwarding chain with a service used indirectly by the client (i.e., the service is at the end of the chain).
MP-CuPvSCC

Finds a client accessing a service indirectly, where there is more than one intermediary, plus the first intermediary adjacent to the client, and channels between client and service and between the client and this intermediary process.
MP-CuvS

Finds a client indirectly accessing a process via a credential sharing/forwarding chain.
MP-CvPuSCC

Finds a client accessing a service via more than one intermediary, plus the last intermediary adjacent to the service, and channels between client and service and between this intermediary process and the service.
MP-CvPvSCC

Finds a client accessing a service via at least two intermediaries, and two intermediaries that are adjacent, and the channels between client and service and between these two intermediary processes.
MP-CzS-CC

Finds a client providing authorization claims to a remote service, where there is no client channel linking the two.
MP-CzSzP

Finds a client sending an authorization token to a service which uses a separate OAuth-style process to validate and exchange the token.
MP-LSmSC

Finds a Logical Subnet and all service channels via that subnet.
MP-DFDSCS

Finds a DataFlow via a DataStep that flows via a ClientChannel in the direction client to service.
MP-DFDSSC

Finds a DataFlow via a DataStep that flows via a ClientChannel in the direction service to client.
MP-DFrXSS

Finds human using a web browser that uses a service with a host, where the browser receives from another process (not the service) data not created by either the browser or its user , plus the client channel between the browser and the service which must go via an IP subnet, and optionally the service and service host managers.
MP-DFsXSS

Finds a human using a web browser that accesses a service running on a Host and using inflowing data, along with optional host and service managers. The data flow destination is matched twice so it can be referred to in CSGs using different role names.
MP-DoS

Finds a service with its host, and a service attack path to the service from a (possibly remote) subnet, and all the interfaces to which traffic would flow along this attack path.
MP-DSrXSS

Finds human using a web browser that uses a service with a host, where the browser also uses locally stored data not entered or updated by the user, along with optional host and service managers.
MP-DSsXSS

Finds a human using a web browser that accesses a service running on a host and using stored input data, along with optional host and service managers.
MP-HLSISC

Finds a host connecting to a logical subnet that is not a hotspot, by authenticating to a controlling service.
MP-HPsACdDSCCV

Finds a host running a Process with write/delete access (crudd) to a locally stored data copy, plus the data access asset representing the data deserialization, and a channel to a key vault that controls the stored data, plus any data fields included in the data copy and used by the process, the process access contexts (a non-unique sufficient match), and optionally the process host manager.
MP-HPsACrDSCCV

Finds a host running a Process with read access (crudr) to a locally stored data copy, plus the data access asset representing the data deserialization, and a channel to a key vault that controls the stored data, plus any data fields included in the data copy and used by the process, the process access contexts (a non-unique sufficient match), and optionally the process host manager.
MP-HuCCC-nS

Finds the User of an interactive Client using a Service not managed by the same user and not using a separate authenticator, with a Client Channel between them, plus the client and service hosts and optionally the service manager.
MP-NPSCCAP

Finds an off-channel Client Attack Path via Network Path into a Service Channel.
MP-PDFFA

Finds a Data Flow, its source and destination processes, a related data use element at the source, and optionally the two process managers.
MP-OSAPLaS

Finds a host connected to an L2 subnet running a service, an open service attack path from the subnet to the service, plus all location access contexts in which the service is accessible via this path, and optionally the managers of the service and its host.
MP-ScDACDACCDF-c

Finds a data flow to a service from an indirect client, where the client creates the data flow from an inbound data asset controlled by a vault, which does not control the outbound data flow.
MP-ScDASDACCDF-c

Finds a data flow from a service requested by an indirect client, where the service creates the data flow by decrypting an inbound data asset controlled by a vault, which does not control the outbound data flow.
MP-SCDS

Finds a client and service plus the associated client channel where there is a data step from the service to the client.
MP-SCLPLSg

Finds a service channel via a logical path that traverses a logical segment, plus the interfaces used by the segment.
MP-SCLPvLS

Finds a service channel via a logical path that visits a subnet.
MP-SCLSg

Finds a service channel that traverses a logical segment, along with the inbound and outbound interfaces to the segment host.
MP-SCmCAP

Finds a client and service connected by a service channel plus all associated client attack paths from subnets in the channel.
MP-SCmCP

Finds a client and service connected by a service channel, plus all client paths associated with that service channel.
MP-SCmSg

Finds a Service Channel traversing at least one logical segment, plus its Client and Service, and network interfaces.
MP-SCCHNPLS-lI

Finds a Service Channel via a Logical Path from a Client, the Client Host, Subnet and Interface, where the Service Channel has no last interface.
MP-SCNSg

Finds a Service Channel traversing a NAT segment, and the subnets on either side.
MP-SCsAPtI

Finds an Attack Path from a subnet at the start of a Service Channel, the path from which is a subpath of the Service Channel path, a gateway segment visited along that path, and the subnet and interface on the attacker side of that gateway.
MP-SgACmSC

Finds a logical segment between two subnets, plus the associated gateway host and its inbound and outbound interfaces, an access context in which the segment is active, and all assocated service channels.
MP-SgmSC

Finds a logical segment between two subnets, plus the associated gateway host and its inbound and outbound interfaces, and all assocated service channels.
MP-SOCAP

Finds a service channel linked with an open client attack path from a logical subnet to the service process, where there is no closed service attack path to the service from the same logical subnet.
MP-SP

Finds a reverse proxy process.
MP-SPNaLnS

Finds a host running a remote access service accessed by a reverse proxy, plus the associated client channel, the location and network contexts in which this can happen, and optionally the managers of the client proxy, service and service host.
MP-SPNaS

Finds a host running a service accessed via a reverse proxy, plus the associated client channel, contexts in which the service can be accessed, and optionally the managers of the client proxy, service and service host.
MP-SPuS

Finds a reverse proxy directly using a service.
MP-SSClIAP

Finds a service channel from a last interface to a service process via an attack path.
MP-SCpSg

Finds a Service Channel that traverses no logical segments, plus its Client and Service, and network interfaces.
MP-OCAPNaS

Finds a service and its host accessed by a client via the associated client channel on an open client attack path from a logical subnet where messages from the attacker can be distinguished from those from the client, plus all the associated service process contexts and interfaces from which client messages come, and optionally the client user and the service and service host managers.
MP-SCCAP

Finds a service channel linked with a closed client attack path from a logical subnet to the service process.
MP-SC

Finds a client and service connected by a service channel, and optionally the service manager.
MP-OSAPNaS

Finds a host running a service, an open service attack path to the service from a logical subnet, the location access contexts where the service is accessible via this attack path, and optionally the managers of the service and its host.
MP-PCaFCSCCC

Finds a client channel via a service channel which is accessible to a client in a process context.
MP-PCaTSSCAP

Finds an attack path path via a service channel on which a service is accessible in a process context.
MP-PCaTSSCCC

Finds a client channel via a service channel which gives access to a service in a process context.
MP-PccCuS

Finds a client using a service for application or authentication, not via a remote access service, where both client and service are controlled by the same process.
MP-PCCPCCS-i

Finds a reverse proxy accessing another reverse proxy that uses a service, via the associated client channels, and optionally the second reverse proxy manager, where there is no credential sharing between the reverse proxies and back-end service.
MP-PcHpmS

Finds a Process in the role of transparent Proxy to at least one Service, and controlling a Host.
MP-PcLSpmS

Finds a Process in the role of transparent Proxy to at least one Service, and controlling a Logical Subnet.
MP-Pc-pPpmS

Finds a Process in the role of transparent Proxy for at least one Service, controlling another Process (not one of those Services).
MP-SCAPvLS

Finds a Host running a Service connected to a Subnet visited by a Service Channel via an Attack Path to the Service Process.
MP-Pc-uCucmS

Finds a process controlling but not receiving forwarded credentials from a client that is forwarding credentials to other back-end services.
MP-PnPnS-U

Finds a client using a service with shared or forwarded credentials, where the service uses another service in the same way, and there is no link yet indicating that the client and the second service are in a credential sharing chain.
MP-Pu-pPucmS

Finds a client that forwards credentials to at least one service, and uses another process as a service without doing the same.
MP-RACvSPHRASP-iPL

Finds a host running a process that is not a reverse proxy or a remote access service, and a remote access service that uses the process, and is used via a reverse proxy chain by a remote access client.
MP-RDvSPDtS

Finds a remote desktop client using a reverse proxy chain that provides access to a remote desktop service.
MP-RDvSPHP-iPL-RAS

Finds a Host running a Process that is neither a remote access service nor a reverse proxy, but is used remotely via a reverse proxy chain by a Remote Desktop client, not mediated by a collocated remote access service.
MP-RDvSPIP

Finds a remote desktop client using a reverse proxy chain that provides access to an interactive process.
MP-RTvSPCP

Finds a remote terminal client using a reverse proxy chain that provides access to a console (command line interactive) process.
MP-RTvSPHP-iPL-RAS

Finds a Host running a Process that is neither a remote access service nor a reverse proxy, but is used via a reverse proxy chain by a Remote Terminal client, not mediated by a collocated remote access service.
MP-RTvSPRAS

Finds a remote terminal client using a reverse proxy chain that provides access to a remote access service.
MP-PILSsSC

Finds a Process running on a Host connected via an Interface to a Logical Subnet, where the Process acts as a Service to at least one client communicating over that Interface, any of which is sufficient to cause a threat.
MP-CSL0H

Finds a client channel whose client and service are collocated on a host that is not a cluster, and an internal (socket) LAN provided by the host accessible in a space.
MP-CCSCAP

Finds a Client Channel via a Service Channel that goes via an Attack Path.
MP-CSDS

Finds a client and service plus the associated client channel where there is a data step from the client to the service.
MP-CCCCAP

Finds a Client Channel via a proxy Client Channel that goes via an Attack Path.
MP-CCCfCCS+aFC

Finds a Client accessing a Service via a Proxy, with the channel between the Client and Service, the channel to the first Proxy, and the client and service hosts, plus a client context in which the client can access the proxy channel.
MP-CCCLnSAC

Finds a Client and Remote Access Service with a ClientChannel between them, plus their hosts, the contexts for access to the service via the channel, and optionally the client and service managers.
MP-CCCmSCS

Finds a Client and Service with a Client Channel between them and all associated Service Channels (of which there must be at least one), plus the client and service hosts and optionally the service manager and interactive client user.
MP-CCC-nmCCS

Finds a Client not acting as an authentication proxy with access via at least one proxy to a Service which is not using a separate authenticator, with a Client Channel between them and all associated proxy client channels (of which there must be at least one), plus the client and service hosts and optionally the Client user and Service manager.
MP-CCC-nmSCS

Finds a Client accessing and authenticating directly with a Service, the Client Channel between them and all associated Service Channels (of which there must be at least one), plus the client and service hosts and optionally the service manager and client user.
MP-CCC-nS

Finds a Client that is not sharing or forwarding credentials, with access to a Service that does not use a separate authenticator, the ClientChannel between them, the Client and Service hosts and optionally the Client user and Service manager.
MP-CCC-nS-i

Finds a Client and Service where the Service is responsible for authenticating the client, the ClientChannel between them which must be a direct connection, plus the Client and Service hosts and optionally the Client user and Service manager.
MP-CCCPCCS-i

Finds a client accessing a reverse proxy that uses a service, via the associated client channels, where the client and service are not in a credential forwarding chain, plus optionally the reverse proxy manager.
MP-CCAPNaS

Finds a service and its host accessed by a client via the associated client channel on a closed client attack path from a logical subnet where messages from the attacker come from the same address as those from the client, plus all the associated service process contexts, and optionally the client user and the service and service host managers.
MP-CCCS

Finds a Client and Service with a ClientChannel between them, the Client and Service hosts and optionally the client user and the service and service host managers.
MP-CCCSACvLS

Finds a Client with a Client Channel to a Service via an adjacent L2 subnet, plus their hosts, all related access contexts at the Service, and optionally the client user and the service and service host managers.
MP-CCCSCCSDF-Vi

Finds a client accessing a service that uses another service, via the associated client channels, where indirect access by the client is not authenticated by the second service, plus a data flow not encrypted with keys from a vault, that flows to the second service from the first but not to the client.
MP-CCCSCCS-i

Finds a client accessing a service that uses another service, via the associated client channels, where indirect access by the client is not authenticated by the second service.
MP-CCCSCSoAC

Finds a Client and Service connected via a Client Channel, also connected by a Service Channel, plus any indirect Auth Channels that depend on this Client Channel (which may be none). The presence of the Service Channel means the first Client Channel is a direct connection (not via intermediaries) involving communication over a network (not via a local API or sockets).
MP-CCCSDF-VCCS-i

Finds a client accessing a service that uses another service, via the associated client channels, where indirect access by the client is not authenticated by the second service, plus a data flow and any data fields not encrypted with keys from a vault flowing to the second service from the first but not from the client.
MP-CCCS-i

Finds a Client and Service with a direct ClientChannel between them, the Client and Service hosts and optionally the client user and the service and service host managers.
MP-CCCS-iAC

Finds a Client and Service with a direct Client Channel between them, plus their hosts, the contexts for access to the service via the channel, and optionally the client user and service and service host managers.
MP-CCCSPCCSDF-Vi

Finds a client accessing a proxy that (directly or indirectly) uses a service that uses a second service, where the client is not authenticated by the second service, with a data flow not encrypted with keys from a vault going from the second service to the first but not to the client, plus the associated client channels.
MP-CCCSPDF-VCCS-i

Finds a client accessing a proxy that (directly or indirectly) uses a service that uses a second service, where the client is not authenticated by the second service, with a data flow not encrypted with keys from a vault, flowing to the second service from the first but not from the client, plus the associated client channels.
MP-CCCSAC

Finds a Client and Service with a Client Channel between them, plus their hosts, the contexts for access to the service via the channel, and optionally the client user and service and service host managers.
MP-CCCSPSFCS

Finds a client sending a flow of data to a service via a chain of intermediaries, over which the client communications authentication or authorization credentials.
MP-CAPSAP

Finds a Client Attack Path via a Service Attack Path.
MP-CAPlISAP

Finds a client attack path via a service attack path where the former has a last interface.
MP-CSHSAC

Finds a service accessed by a client and an associated context for access to the service, plus the two process hosts and optionally the client user and service host manager.
MP-ACDF-VFS-i

Finds a data flow not encrypted with keys from a vault flowing from a service to/via a client, plus any data fields, and the associated channel, where the connection is direct.
MP-ACDFVFS-i

Finds a data flow encrypted with keys from a vault flowing from a service to/via a client, plus any data fields, and the associated client channel, where the connection is direct.
MP-ACDF-VSC-i

Finds a data flow not encrypted with keys from a vault, that goes via a service and thence a client, and the related channel and any data fields, where the connection is direct and not via any credential-sharing intermediaries.
MP-ACDF-VTS-i

Finds a data flow not encrypted with keys from a vault, flowing to a service from/via a client, plus the data, data access and any data fields, and the associated channel, where the connection is direct and not via any credential-sharing intermediaries.
MP-ACDFVTS-i

Finds a data flow encrypted with keys from a vault, flowing to a service from/via a client, plus any data fields, the data access, and the associated client channel, where the connection is direct and not via any credential-sharing intermediaries.
MP-AC-iDF-VCS

Finds a data flow not encrypted with keys from a vault, that goes via a client and thence a service, plus any data fields, and the related auth channel, where the client and service have a trust relationship w.r.t. the data flow (i.e., they are not intermediaries in an end-to-end relationship).
MP-AC-iDFVFC

Finds a data flow encrypted by a key from a vault, flowing from a client to or via a service, and the associated auth channel which must not be to a trust intermediary, the data and data access and any data fields, and process contexts in which the data flows from the client (of which any can cause the threat). The source of the flow is matched twice, so it can be referred to by either role name (FlowsFrom or Client) in control strategies.
MP-AC-iDF-VFC

Finds a data flow not encrypted by a key from a vault, flowing from a client to or via a service, and the associated auth channel which must not be to a trust intermediary, the data and data access, any data fields, and process contexts in which the data flows from the client (of which any can cause the threat). The source of the flow is matched twice, so it can be referred to by either role name (FlowsFrom or Client) in control strategies.
MP-CAPNPSAP

Finds a Client Attack Path via a Service Attack Path and a Network Path.
MP-AC-iDF-VSC

Finds a data flow not encrypted with keys from a vault, that goes via a service and thence via a client, plus any data fields, and the related auth channel, where the client and service have a trust relationship w.r.t. the data flow (i.e., they are not intermediaries in an end-to-end relationship).
MP-AC-iDF-VTC

Finds a data flow not encrypted by a key from a vault, flowing to a client from or via a service, and the associated auth channel which must not be to a trust intermediary, the data and data access, and process contexts in which the data flows from the client (of which any can cause the threat). The source of the flow is matched twice, so it can be referred to by either role name (FlowsTo or Client) in control strategies.
MP-CACHcLSS

Finds a service accessed by a client via a subnet the client is on, and an associated context for access to the client, plus the two process hosts and optionally the client user and service manager.
MP-CACHLSS

Finds a service that is not acting as a reverse proxy accessed by a client and an associated context for access from the client via a subnet to which it need not normally be connected, plus the two process hosts and optionally the client user and service manager.
MP-CAC-pPaAC-pS

Finds a client providing authentication credentials to a process which uses a service to validate those credentials, along with the channels between each pair of processes, where the Client, Process and Service are not in a credential sharing chain.
MP-CAC-pPzAC-pS

Finds a client providing indirect authorization credentials to a process which uses a service to validate those credentials, along with the channels between each pair of processes, where the Client, Process and Service are not in a credential sharing chain.
MP-CAC-pScAC-pP

Finds a client and process connected via a channel, where the client also uses another service that controls the process, along with the associated channels, where the Client, Process and Service are not in a credential sharing chain.
MP-CACSSaS

Finds a channel between a client and a service used to pass authorization tokens, and a second channel from the service to another service used to validate those tokens, along with the hosts of the client and the second service, plus optionally the client user and the managers of the second service and its host.
MP-CACSScS

Finds a channel between a client and a service, where authentication on this channel is controlled by authentication on another channel from the same client to a second service, along with the hosts of the client and the second service, plus optionally the client user and the managers of the second service and its host.
MP-CACvsCCS

Finds a Client accessing a Service via intermediaries, along with the Auth Channel between the Client and Service, and the related client channels via intermediaries, any of which can cause a threat, plus the client and service hosts and and optionally the service manager and interactive client user.
MP-AC-iDFVTC

Finds a data flow encrypted by a key from a vault, flowing to a client from or via a service, and the associated auth channel which must not be to a trust intermediary, the data access and any data fields, and process contexts in which the data flows from the client (of which any can cause the threat). The source of the flow is matched twice, so it can be referred to by either role name (FlowsTo or Client) in control strategies.
MP-CCCSPSFSC

Finds a client receiving a flow of data from a service via a chain of intermediaries, over which the client communications authentication or authorization credentials.
MP-ACDF-VCS-i

Finds a data flow not encrypted with keys from a vault, that goes via a client and thence a service, plus any data fields, and the related channel, where the connection is direct and not via any credential-sharing intermediaries.
MP-CCCvCCS

Finds a Client accessing a Service via a Proxy, with the Client Channel between the Client and Service, and the related channel to the Proxy, the hosts of client and service and and optionally the service manager and interactive client user.
MP-CCSmDFS

Finds a client and service connected by a client channel, which is used by at least one DataStep representing the possibility to exchange data between the two.
MP-CCtImSC

Finds a Client Channel to an Interface at the Service host with at least one associated Service Channel.
MP-CDBSC

Finds a process acting as a client to a DB with a Client Channel between them, and optionally the process host manager.
MP-CDBSCDSF

Finds a process using data served by a DB service the process is using, and the associated service channel, host and data copy assets, plus optionally the service host manager.
MP-CDBSC-DSF

Finds a process using a DB service and the associated service channel, plus the DB host and a copy of data served by the DB and flowing to it, but not from the process.
MP-CDBSC-DST

Finds a process using a DB service and the associated service channel, plus the DB host and a copy of data served by the DB and flowing from it, but not to the process.
MP-CRoS

Finds a Service and its Host, a Client Channel from a legitimate Client and its Host, and a Logical Subnet used by at least one path from the client, plus the Client Path for that Client from this Subnet, and optionally the service manager and client user.
MP-CRoSI

Finds a Service and its Host, a Client Channel from a legitimate Client and its Host, an Interface to a subnet on at least one path from the Client, and the Client Path from that Interface, and optionally the service manager and client user.
MP-CSAPNaS

Finds a host running a service, a closed service attack path to the service from a logical subnet, the location access contexts where the service is accessible via this attack path, and optionally the managers of the service and its host.
MP-CCSCvLS

Finds a Client Channel via a Service Channel that visits a Logical Subnet.
MP-CSCCHuoSt

Finds a Human manager of a Service and a Client Channel to the Service from a Client, where the Client is managed by someone else, plus optionally the employer of the Service manager.
MP-CSCCmCC

Finds a Client and Service with a Client Channel between them having at least one associated Client Channel indicating access is via a proxy.
MP-CSCCSC

Finds a Client and Service with a Client Channel between them and a single associated Service Channel.
MP-CSCC-SC

Finds a Client and Service running on different hosts with a ClientChannel but no ServiceChannel or ServiceProxy between them.
MP-CSCLS

Finds a client and its host and a service channel to the service via a logical subnet to which the host is connected, plus the associated network context.
MP-CSCLS+ii

Finds a client and its host and a service channel to the service via the Internet to which the host need not be connected, accessible from the World in which the host need not be located.
MP-CSCLS-ii

Finds a client and its host and a service channel to the service via a logical subnet (not a HostLAN or the Internet) to which the host need not be connected, accessible from a space in which the host need not be located.
MP-CScP-v

Finds a client directly or indirectly accessing a service which is controlled by another process, where the three processes are not in a credential forwarding or sharing chain and there is no link to say the cilent uses the third process for authentication.
MP-CSCvLS

Finds a Service Channel from a client process to a service, and a logical subnet visited by it.
MP-CCCtCCS+aTS

Finds a Client accessing a Service via a Proxy, with the channel between the Client and Service, the channel from the last Proxy, the client and service hosts, and a service context in which the service can be accessed via the proxy channel.
MP-CSCCHuSt

Finds a Human manager of a Service and their employer, and a Client Channel to the Service from a Client not operated by the employer.
MP-CCSCvI

Finds a Client Channel via a Service Channel that goes via an Interface.
MP-CRoSG

Finds a Service and its Host, a Client Channel from a legitimate Client and its Host, an Interface from a subnet to a Gateway host on at least one path from the Client, plus the Client Path from that subnet, and an access context for the gateway where it is on the relevant path, plus all service channels that relate to the client path, and optionally the service host manager and client user.
MP-CCSCtI

Finds a Client Channel via a Service Channel that goes to an Interface.
MP-CCCvCCvLS

Finds a Client Channel from a Client process that goes via a Logical Subnet and also via another Client Channel (i.e. the client and service communicate via a credential sharing/forwarding chain).
MP-CCSCtSg

Finds a Client Channel via a Service Channel that goes via a Logical Segment.
MP-CCCvsCCSAC

Finds a Client and Service with a Client Channel between them that goes via at least one channel via an intermediary, plus their hosts, the contexts for access to the service via the channel, and optionally the client user and service and service host managers.
MP-CCDFCDAScDA-c

Finds a data flow from a service to an indirect client, where the client encrypts the data flow to create an outbound data asset controlled by a vault, which does not control the inbound data flow.
MP-CCDFCS

Finds a data flow that goes via a client and thence via a service, plus the related client channel and data.
MP-CCDFSC

Finds a data flow that goes via a service and thence a client, and the related client channel and data.
MP-CCDFSDAScDA-c

Finds a data flow to a service from an indirect client, where the service encrypts the data flow to create an outbound data asset controlled by a vault, which does not control the inbound data flow.
MP-CCDFSFC

Finds a data flow from a client to/via a service, and the associated client channel, data and the first data step, plus optionally the managers of the service and the source of the data flow. The source of the flow is matched twice, so it can be referred to by either role name.
MP-CCDFSFS

Finds a data flow to/via a client from a service, and the associated client channel, data and the first data step, plus optionally the managers of the service and the source of the data flow. The source of the flow is matched twice, so it can be referred to by either role name.
MP-CCDFSTC

Finds a data flow to a client from/via a service, and the associated client channel, data and the last data step, plus optionally the managers of the service and the source of the data flow. The destination of the flow is matched twice, so it can be referred to by either role name.
MP-CCCvsCC-nS

Finds a Client accessing a Service via intermediaries, where the Service is responsible for client authentication, along with the Client Channel between the Client and Service, and the related channels via intermediaries, any of which can cause a threat, plus the client and service hosts and and optionally the service manager and interactive client user.
MP-CCDS2FC

Finds a data flowing from/via a client via a service, plus the associated client channel and the data steps from the client and from the service, and optionally the manager of the service and of the data flow source process.
MP-CCDFSTS

Finds a data flow from/via a client to a service, and the associated client channel, data and the last data step, plus optionally the managers of the service and the source of the data flow. The destination of the flow is matched twice, so it can be referred to by either role name.
MP-CCSC

Finds a client and service connected by a client channel and a service channel.
MP-CC-iDFSC

Finds a data flow that goes via a service and thence via a client, plus the related client channel and data, where the client and service have a trust relationship w.r.t. the data flow (i.e., they are not intermediaries in an end-to-end credential sharing chain).
MP-CC-iDFC-SS

Finds a data flow that goes via a client and thence via a service, plus the related client channel and data, where the client and service have a trust relationship w.r.t. the data flow (i.e., they are not intermediaries in an end-to-end credential sharing chain), and the client does not get the data from its own client. The last restriction is so related threats are not duplicated if the client also acts as a service when exchanging this data.
MP-CCSCCP

Finds a client channel via a service channel that is via a client path.
MP-CCfImSC

Finds a Client Channel from an Interface at the Client host with at least one associated Service Channel.
MP-CCSCfI

Finds a Client Channel via a Service Channel that goes from an Interface.
MP-CCDS2TC

Finds a data flowing to/via a client via a service, plus the associated client channel and the data steps to the client and to the service, and optionally the manager of the service and of the data flow source process.
MP-CC-iDFCS

Finds a data flow that goes via a client and thence via a service, plus the related client channel and data, where the client and service have a trust relationship w.r.t. the data flow (i.e., they are not intermediaries in an end-to-end credential sharing chain).

MP-H-sDFuCudDFdS-ACau

Finds a Process that reads (needs) data not saved on its host sent from a service over one channel, and reads (needs) different data not saved on its host from a different service over a second channel, plus the process host, where the Process has no location context in which it can access the first service and access cannot be interrupted to the second service.
MP-H-sDFcCaiAC

Finds a Process that creates data not stored on its host, which it sends to a service, and has a location access context where it can connect to the service but where access to the service may be interrupted.
MP-H-sDFcCr-aAC

Finds a Process that creates data in a context that is not stored on its host, and sends it to a service over a channel that cannot be accessed in this context.
MP-H-sDFCFdS-ACau

Finds a Process that receives a data flow not saved on its host from a service over one channel, and sends the same data in a data flow to a different service over a second channel, where the Process has no location context in which it can access the first service and access cannot be interrupted to the second service.
MP-H-sDFrSACdDFiaS

Finds a Process that receives a data flow not saved on its host from a client over one channel, and reads (needs) different data also not saved on its host in a data flow from a service over a second channel, plus an associated process location context in which the process can be accessed via the first channel but access to the service over the second may be interrupted.
MP-H-sDFSACaiFS

Finds a Process that receives a data flow not saved on its host from a client over one channel, and sends the same data in a data flow to a service over a second channel, plus an associated process location context in which the process can be accessed via the first channel but access to the service over the second may be interrupted.
MP-H-sDFSFdC

Finds a process that receives data over a channel from a client, and sends the data over a channel from a different client, plus the process host which does not store the data.
MP-H-sDFuSdC

Finds a process that reads (needs) data sent over a channel from a client and not saved on its host, and a second channel to the process from a distinct client, plus the process host.
MP-SCLSgfTS

Finds a Service Channel traversing a NAT segment (with its interfaces) after which source addresses can be distinguished from a client.
MP-NP1CCAPSC

Finds a service channel via a closed subnet (before a subsequent NAT gateway) and a network path into the channel via this subnet traversing an unblocked logical segment from a subnet not in the service channel.
MP-NP2CCAPSC

Finds a service channel via a closed subnet (before a subsequent NAT gateway) with a nework path to the channel via this subnet, and an extension via an unblocked logical segment from a subnet not in the service channel.
MP-SCLSgvTS-vS

Finds a service channel traversing a logical segment, where the subnet after the segment has source addresses that cannot be distinguished from a client source address, and this has not yet been inferred for the subnet before the segment.
MP-SCNP2CPtI

Finds a service channel via a client path from a subnet in the channel to an interface on a subnet at or after the start of the client path.
MP-SCvLS-vS

Finds a Service Channel that visits a Logical Subnet, with no relationship indicating that source addresses cannot be distinguished from a client.
MP-SCxAPtI

Finds an Attack Path starting from a subnet in a Service Channel, the path from which is a subpath of the Service Channel path, a gateway segment visited along that path, and the subnet and interface on the attacker side of that gateway.
MP-SPvSPvS-U

Finds a reverse proxy using a second reverse proxy that uses a service, with mutual authentication at each step, and with no link indicating that the first proxy may indirectly use the service.
MP-DFtP

Finds a DataFlow to a Process.
MP-IDFfCCCftS-s

Finds a client-service channel to a service, and a location context at the service where it can be accessed via the channel, plus a data flow over the channel from client to service which flows to the service in that context, is used as input and not stored on the service host.
MP-DFtCCCtS

Finds a client-service channel, the client and service, and an access context at the service where it can be accessed via the channel, plus a data flow over the channel from service to client.
MP-DFuCuS-C-P

Finds a data flow via two processes, one of which is indirectly a client of the other via a chain of credential sharing/forwarding intermediaries, and the Client has no other client in the same chain, and the service has no other service in the same chain.
MP-DFfCCCtS

Finds a client-service channel, the client and service, and an access context at the service where it can be accessed via the channel, plus a data flow over the channel from client to service.
MP-DFtCCCfS

Finds a client-service channel, the client and service, and an access context at the client where it can access the channel, plus a data flow over the channel from service to client.
MP-APxSCtI

Finds a Service Attack Path starting off a Service Channel, and the path from the attacker subnet which is an extension of the Service Channel path, plus the Interface from the attacker subnet to the first gateway on the Attack Path.
MP-CaS-SP

Finds a client that is not a remote access service accessing a service, not via a deputy and not via a shell process on the service host.
MP-CCCfS+aFC-aI

Finds a client-service channel, the client and service, and an access context at the client in which the client can access the channel, and the service cannot be in a context where access to it would be interrupted.
MP-CCCftS+aFC-aTS

Finds a client-service channel, the client and service, and an access context on each side, where the channel can be accessed from the client in its context, but the service cannot be accessed in its context.
MP-CSCCAPNP4

Finds a service channel from a client to a service with a network path from an attacker subnet into the channel via a closed subnet, where the network path is consistent with an extension of the on-channel subpath.
MP-CSCscLS

Finds a Service Channel from a client process to a service, and a logical subnet from which source addresses are obscured by NAT.
MP-CSCsdLS

Finds a Service Channel from a client process to a service, and a logical subnet from which source addresses remain unaltered by NAT.
MP-CSLS2H2-SC

Finds a client and service between which there is as yet no service channel, running on different hosts connected to different logical subnets that are not hotspots, connected by a network path in which neither host is a gateway.
MP-CCCfS-aFC

Finds a client-service channel, the client and service, and an access context at the client, where the client cannot access the channel in that context.
MP-CS-SP

Finds a client using a service not via a remote access service or a reverse proxy chain, where the client and service are both able to exchange data.
MP-CucSaP

Finds a Client using a Service as such (i.e., not via the host shell) using forwarded or shared credentials, and also using a third Process for authentication which controls the Service without being used by it.
MP-CuPiS-i

Finds a client process using a service indirectly using another service, where there is no link yet indictating that the client could communicate indirectly with the second service.
MP-CuPuS-i

Finds a client process using a service using another service, where there is no link yet indictating that the client could communicate indirectly with the second service.
MP-DFfCCCfS

Finds a client-service channel, the client and service, and an access context at the client where it can access the channel, plus a data flow over the channel from client to service.
MP-CuScS

Finds a client using a service for application or authentication and also controlled by the service.
MP-CuSPvS-U

Finds a client directly using a reverse proxy that uses a service, where the client has as yet no link indicating that the client is indirectly using the service.
MP-DFDSfP

Finds a DataFlow via a DataStep from a Process.
MP-CSLSH2-SC

Finds a client and service on different hosts connected to the same network that is not a hotspot, and there is no existing service channel between them when the respective hosts are in locations where the network is accessible.

MP-SC4HVSVC

Finds a Service Channel crossing a Virtual Subnet between two Hosts, and the Virtual Channel representing the physical connectivity requirement to support this communication.
MP-SgACmHC

Finds a logical segment between two subnets, plus the associated gateway host and its inbound and outbound interfaces, an access context in which the segment is active, and all assocated host channels.
MP-SgmHC

Finds a logical segment between two subnets, plus the associated gateway host and its inbound and outbound interfaces, and all assocated host channels.
MP-THVH

Finds a Virtual Host provisioned on a Trivial Host.
MP-VC2HmHC

Finds a virtual channel between two physical hosts, plus all the host channels associated with physical network paths between the hosts.
MP-VC2HmSC

Finds a virtual channel between two physical hosts, plus all the service channels associated with physical network paths between the hosts.
MP-VH2H-a

Finds three virtual hosts in a chain but lacking the above relationship indicating which of the first and last links is higher.
MP-VCH2LS2PP

Finds a virtual subnet communication path between physical hosts, including the virtual channel, path generator and the start and end subnets.
MP-SC4HVSHC

Finds a Service Channel crossing a Virtual Subnet between two Hosts, and the Host Channel representing a physical network path supporting this communication.
MP-VHH2

Finds a VirtualHost provisioned at a Host for which it is also on the path to a physical host.
MP-VSVC4H-PP

Finds a virtual subnet and two connected hosts with distinct physical hosts between which virtual subnet messages should flow, and yet there is no host channel, indicating no physical path between the physical hosts was found.
MP-VHHHoDC

Finds a Virtual Host (role Host) provisioned at a Host (SHost), where the Virtual Host may optionally be provisioned by a Data Centre.
MP-VHHsD-HsS-S

Finds a Virtual Host above another Host in a virtualisation stack where both store the same Data, there is no lower level host in the stack that also stores the data, and the second host does not run a Process that serves the Data.
MP-VHPH

Finds a virtual host provisioned by a physical host.
MP-VHPhDHS-HsS-S

Finds a Virtual Host running a Process that handles Data but does not access it via a service, where its host is in a virtualisation stack above a second Host running a service for the Data, and there is no host between the two in the virtualisation stack running a Process that Serves the Data.
MP-VSHCmSC

Finds a host channel supporting a virtual subnet, and the associated hosts, along with all service channels that use the host channel.
MP-VSPSH

Finds a Virtual Subnet provided by a gateway host using a Physical Subnet to route at least one host-host connection, and optionally the process controlling the virtual subnet, and the manager of the gateway.
MP-VSPS-HP

Finds a Virtual Subnet using a Physical Subnet to route at least one host-host connection, where there is no gateway specified as the subnet provider, and no controlling Process.
MP-VSPSH-P

Finds a Virtual Subnet with no controlling Process, provided by a gateway host using a Physical Subnet to route at least one host-host connection, and optionally the manager of the Gateway.
MP-pLSoLS

Finds a solo Overlay Subnet lacking any other subnet on which it is an overlay.
MP-VSVCHC

Finds a Virtual Subnet via a Virtual Channel via a Host Channel.
MP-VSVCHCLS

Finds a virtual subnet that uses a physical subnet.
MP-VHH3

Finds a virtual host provisioned by two distinct hosts.
MP-mLSoLS

Finds a solo Logical Subnet which is an overlay of at least one other subnet.
MP-HVH

Finds a VirtualHost and its host, and optionally its manager.
MP-LSmHC

Finds a Logical Subnet and all virtualised host channels via that subnet.
MP-CCSCHC

Finds a Client Channel via a Service Channel that depends on connectivity represented by a Host Channel.
MP-CCSCVC

Finds a Client Channel via a Service Channel that requires connectivity represented by a Virtual Channel.
MP-CVHHDC

Finds a clusterable virtual Host provisioned on a physical host at a DataCentre.
MP-CVHHHoDC

Finds a cluster Virtual Host (role Host) provisioned at a Host (SHost), where the Virtual Host may optionally be managed by a Data Centre.
MP-DCCVH-LS

Finds a Data Centre with a Cluster on which is provisioned a Virtual Host that is not connected to any logical subnet.
MP-DCVHVS-H

Finds a Host that is physically in a DataCentre and connected to a virtual subnet that is not provided by any host.
MP-EH

Finds a solo elastically scalable host.
MP-GdHVS

Finds a gateway providing a virtual subnet to which a distinct host is connected, and optionally a process controlling access to the subnet.
MP-H2dPH2

Finds two hosts on a virtual subnet with distinct physical hosts, between which the virtualised communication must flow.
MP-LSoLS

Finds a Logical Subnet that is an overlay on another Subnet.
MP-HACVHmAC

Finds a host in a space provisioning a virtual host, and a location access context for the first host, plus all related access contexts for the virtual host.
MP-HL

Finds a solo HostLAN
MP-HuiVH

Finds a Human interacting with a Virtual Host (which is not possible).
MP-HumHVH-Hu

Finds an unmanaged VirtualHost provisioned at a Host managed by a Human.
MP-HVH-a

Finds a VirtualHost provisioned at a Host where the pair lacks the above relationship indicating which is higher.
MP-HVHS

Finds a VirtualHost provisioned at a Host that is not a cluster and is located in a physical Space.
MP-HVSICSG

Finds a host connecting to a virtual subnet that it does not provide, plus the controlling service and connection to it from the authentication client on the host.
MP-ImHCf

Finds an interface between a host and a logical subnet where at least one host channel goes from that interface.
MP-ImHCt

Finds an interface between a host and a logical subnet where at least one host channel goes to that interface.
MP-INCmHCf

Finds an Interface, plus the associated host, subnet, and a host network access context where the interface is connected, plus all host channels from the interface.
MP-INCmHCt

Finds an Interface, plus the associated host, subnet, and a host network access context where the interface is connected, plus all host channels to the interface.
MP-HCLSg

Finds a host channel that traverses a logical segment, along with the inbound and outbound interfaces to the segment host.