MITRE D3FEND
D3FEND (officially Detection, Denial, and Disruption Framework Empowering Network Defense) is MITRE's defensive counterpart to Mitre Attack. Where ATT&CK catalogues what an adversary does, D3FEND catalogues what a defender can do — a machine-readable knowledge graph of defensive countermeasures, each mapped to the offense activity it mitigates.
Overview
- Maintainer: MITRE Corporation
- First released: 2021
- URL: https://d3fend.mitre.org
- Licence: Open, freely available
- Form: An openly modelled knowledge graph (countermeasures linked to offensive techniques)
How It Relates to ATT&CK
- ATT&CK is the adversary-side language; D3FEND is the defender-side language
- Each D3FEND countermeasure is designed to counter specific ATT&CK techniques and relates to specific data sources / telemetry
- Countermeasures carry
D3-####identifiers and are grouped into classes such as network, host, process, and authentication countermeasures - Together the two form MITRE's offence/defence pairing for control selection and validation
Typical Use Cases
- Mitigation selection — choosing the right defensive controls to counter a specific observed or modelled technique
- Control validation / gap analysis — checking whether an environment actually has countermeasures covering the techniques in an organisation's threat model
- Detection engineering — identifying which telemetry a planned countermeasure should generate, feeding into detection design
- Evidence-based defence — justifying security investments against mapped, real adversary behaviour rather than vendor marketing
Related MITRE Defensive Tooling
- CAR (Cyber Analytics Repository) — analytics/detections written against ATT&CK techniques
- ENGAGE — MITRE's framework for proactive adversary engagement and deception operations
- ATT&CK Navigator — can visualise and compare mitigation/coverage layers alongside techniques
Limitations
- Younger and less widely adopted than ATT&CK
- The knowledge graph is rich but requires tooling to navigate; it is not a "cookbook" of controls
- It describes countermeasure categories and relationships, not specific product configurations — operational guidance still comes from control frameworks such as the Security Control Frameworks
Australian Angle
D3FEND is a reference used in control-validation and detection-engineering work delivered to Australian government and critical-infrastructure clients. For Soci Act obligations, mapping defensive countermeasures (via D3FEND) against the ATT&CK techniques an organisation faces is a practical way to demonstrate that controls actually cover the threat. For OT-heavy sectors, the ATT&CK for ICS domain pairs with D3FEND-equivalent thinking on industrial control countermeasures.
Related Pages
- Mitre Attack — the adversary-side knowledge base that D3FEND complements
- Cyber Kill Chain — the higher-level lifecycle model D3FEND countermeasures help interrupt
- Security Control Frameworks — the operational control catalogues (Essential Eight, CIS, ISO) that translate countermeasures into policy
- Uk Cyber Shield — national defensive capability where countermeasure coverage is central