MITRE D3FEND

D3FEND (officially Detection, Denial, and Disruption Framework Empowering Network Defense) is MITRE's defensive counterpart to Mitre Attack. Where ATT&CK catalogues what an adversary does, D3FEND catalogues what a defender can do — a machine-readable knowledge graph of defensive countermeasures, each mapped to the offense activity it mitigates.

Overview

• Maintainer: MITRE Corporation
• First released: 2021
• URL: https://d3fend.mitre.org
• Licence: Open, freely available
• Form: An openly modelled knowledge graph (countermeasures linked to offensive techniques)

How It Relates to ATT&CK

• ATT&CK is the adversary-side language; D3FEND is the defender-side language
• Each D3FEND countermeasure is designed to counter specific ATT&CK techniques and relates to specific data sources / telemetry
• Countermeasures carry D3-#### identifiers and are grouped into classes such as network, host, process, and authentication countermeasures
• Together the two form MITRE's offence/defence pairing for control selection and validation

Typical Use Cases

• Mitigation selection — choosing the right defensive controls to counter a specific observed or modelled technique
• Control validation / gap analysis — checking whether an environment actually has countermeasures covering the techniques in an organisation's threat model
• Detection engineering — identifying which telemetry a planned countermeasure should generate, feeding into detection design
• Evidence-based defence — justifying security investments against mapped, real adversary behaviour rather than vendor marketing

Related MITRE Defensive Tooling

• Car — the Cyber Analytics Repository: analytics/detections written against ATT&CK techniques
• ENGAGE — MITRE's framework for proactive adversary engagement and deception operations
• ATT&CK Navigator — can visualise and compare mitigation/coverage layers alongside techniques

Limitations

• Younger and less widely adopted than ATT&CK
• The knowledge graph is rich but requires tooling to navigate; it is not a "cookbook" of controls
• It describes countermeasure categories and relationships, not specific product configurations — operational guidance still comes from control frameworks such as the Security Control Frameworks

Australian Angle

D3FEND is a reference used in control-validation and detection-engineering work delivered to Australian government and critical-infrastructure clients. For SOCI Act obligations, mapping defensive countermeasures (via D3FEND) against the ATT&CK techniques an organisation faces is a practical way to demonstrate that controls actually cover the threat. For OT-heavy sectors, the ATT&CK for ICS domain pairs with D3FEND-equivalent thinking on industrial control countermeasures.

Related Pages

• Mitre Attack — the adversary-side knowledge base that D3FEND complements
• Cyber Kill Chain — the higher-level lifecycle model D3FEND countermeasures help interrupt
• Security Control Frameworks — the operational control catalogues (Essential Eight, CIS, ISO) that translate countermeasures into policy
• Uk Cyber Shield — national defensive capability where countermeasure coverage is central