MITRE D3FEND - Defensive Countermeasures Knowledge Graph

MITRE D3FEND is a knowledge graph of cybersecurity countermeasures, developed by The MITRE Corporation as the defensive counterpart to MITRE ATT&CK. D3FEND catalogs defensive techniques (Hardening, Detection, Isolation, Deception, Eviction) and maps them to the specific ATT&CK techniques they counter, allowing defenders to reason systematically about coverage and control gaps.

D3FEND's Five Defensive Tactics

• Harden: reduce attack surface and pre-emptively close vectors
• Detect: identify adversary actions in progress or after the fact
• Isolate: contain adversary actions, limit blast radius
• Deceive: present misleading information to slow or reveal adversaries
• Evict: remove adversary access and persistence

D3FEND vs ATT&CK

ATT&CK is the catalog of adversary techniques (what the attacker does). D3FEND is the catalog of defensive techniques (what the defender does in response). The two frameworks reference each other: each D3FEND technique includes the ATT&CK techniques it can counter, and each ATT&CK technique can be queried for available D3FEND countermeasures.

How D3FEND Is Used

Security architects use D3FEND to map their existing control stack against the techniques they need to counter, exposing gaps. Detection engineers use D3FEND to identify specific defensive techniques worth implementing for high-priority ATT&CK gaps. Cyber insurance applications and audits increasingly reference D3FEND to demonstrate coverage in a vendor-neutral way.