MITRE DEFEND™ Technique

d3f_technique

The MITRE DEFEND™ Technique object describes the leaf defensive technique ID and/or name associated to a countermeasure, as defined by D3FENDTM Matrix.

Contents

Attributes

Caption Name Type Is Array Default Description
Name name String The name of the defensive technique, as defined by D3FENDTM Matrix. For example: IO Port Restriction.
Raw Data raw_data JSON The event data as received from the event source.
Record ID record_id String Unique identifier for the object
Source URL src_url URL String The versioned permalink of the defensive technique, as defined by D3FENDTM Matrix. For example: https://d3fend.mitre.org/technique/d3f:IOPortRestriction/.
Unique ID uid String The unique identifier of the defensive technique, as defined by D3FENDTM Matrix. For example: D3-IOPR.
Unmapped Data unmapped Unmapped The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.

References

Referenced By

Context

MITRE DEFEND™ Technique

JSON

            
{
  "caption": "MITRE DEFEND\u2122 Technique",
  "description": "The MITRE DEFEND\u2122 Technique object describes the leaf defensive technique ID and/or name associated to a countermeasure, as defined by <a target='_blank' href='https://d3fend.mitre.org'>D3FEND<sup>TM</sup> Matrix</a>.",
  "extends": "_entity",
  "name": "d3f_technique",
  "attributes": {
    "name": {
      "description": "The name of the defensive technique, as defined by <a target='_blank' href='https://d3fend.mitre.org'>D3FEND<sup>TM</sup> Matrix</a>. For example: <code>IO Port Restriction</code>.",
      "requirement": "recommended",
      "caption": "Name",
      "type": "string_t"
    },
    "src_url": {
      "description": "The versioned permalink of the defensive technique, as defined by <a target='_blank' href='https://d3fend.mitre.org'>D3FEND<sup>TM</sup> Matrix</a>. For example: <code>https://d3fend.mitre.org/technique/d3f:IOPortRestriction/</code>.",
      "requirement": "optional",
      "caption": "Source URL",
      "type": "url_t"
    },
    "uid": {
      "description": "The unique identifier of the defensive technique, as defined by <a target='_blank' href='https://mitre.mitre.org'>D3FEND<sup>TM</sup> Matrix</a>. For example: <code>D3-IOPR</code>.",
      "requirement": "recommended",
      "caption": "Unique ID",
      "type": "string_t"
    },
    "raw_data": {
      "group": "context",
      "caption": "Raw Data",
      "description": "The event data as received from the event source.",
      "type": "json_t"
    },
    "record_id": {
      "description": "Unique identifier for the object",
      "group": "primary",
      "requirement": "required",
      "caption": "Record ID",
      "type": "string_t"
    },
    "unmapped": {
      "caption": "Unmapped Data",
      "description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
      "type": "unmapped",
      "is_array": true
    }
  },
  "constraints": {
    "at_least_one": [
      "name",
      "uid"
    ]
  }
}