docs: add TITO threat modeling integration guide

[Leathal1]

Summary

Adds an integration guide for TITO (Threat In, Threat Out), an open-source threat modeling tool that integrates with Semgrep.

What TITO Does With Semgrep

TITO calls Semgrep as a subprocess and enriches the SAST findings with:

• STRIDE-LM threat classification — Maps each finding to Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege, Lateral Movement, and Malware categories
• MITRE ATT&CK technique mapping — Every finding gets ATT&CK technique IDs
• Multi-step attack path analysis — Chains individual findings into realistic attack scenarios
• Interactive 3D visualizations — Three.js and D3.js threat model diagrams

Integration Details

• TITO invokes semgrep as a subprocess (no bundling or redistribution of Semgrep rules)
• Sets SEMGREP_INTEGRATION_NAME=tito per integration guidelines
• Available as a GitHub Action: Leathal1/TITO
• MIT licensed, fully open source

Placement

Added to docs/kb/integrations/ alongside existing integration guides (DefectDojo, etc.)

Links

• GitHub: https://github.com/Leathal1/TITO
• GitHub Action: https://github.com/marketplace/actions/tito-threat-model
• CSA MAESTRO framework: https://cloudsecurityalliance.org/artifacts/maestro-multi-agent-security-threat-and-risk-ontology

[netlify]

👷 Deploy request for semgrep-docs-prod pending review.

Visit the deploys page to approve it

Name	Link
🔨 Latest commit	25fde87

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Steven Leath seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[LewisArdern]

Hi @Leathal1 this seems like a really interesting project however our integration docs are for how you can leverage Semgrep results in third-party applications like defect dojo.

We won't be accepting this time, but we appreciate you for leveraging Semgrep in your project!