MITRE D3FEND™

d3fend

The MITRE D3FEND™ object describes the tactic, technique & sub-technique associated with a countermeasure as defined in DEFEND MatrixTM.

Contents

Attributes

Caption Name Type Is Array Default Description
MITRE DEFEND™ Tactic d3f_tactic MITRE D3FEND™ Tactic The Tactic object describes the tactic ID and/or name that is associated with a countermeasure, as defined by D3FEND MatrixTM.
MITRE DEFEND™ Technique d3f_technique MITRE DEFEND™ Technique The Defend Technique object describes the technique ID and/or name associated with a countermeasure, as defined by D3FEND MatrixTM.
Raw Data raw_data JSON The event data as received from the event source.
Record ID record_id String Unique identifier for the object
Unmapped Data unmapped Unmapped The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.
Version version String The D3FEND MatrixTM version.

Context

MITRE D3FEND™

JSON

            
{
  "caption": "MITRE D3FEND\u2122",
  "name": "d3fend",
  "description": "The <a target='_blank' href='https://d3fend.mitre.org'>MITRE D3FEND\u2122</a> object describes the tactic, technique & sub-technique associated with a countermeasure as defined in <a target='_blank' href='https://d3fend.mitre.org/'>DEFEND Matrix<sup>TM</sup></a>.",
  "extends": "object",
  "attributes": {
    "d3f_tactic": {
      "description": "The Tactic object describes the tactic ID and/or name that is associated with a countermeasure, as defined by <a target='_blank' href='https://d3fend.mitre.org'>D3FEND Matrix<sup>TM</sup></a>.",
      "requirement": "recommended",
      "caption": "MITRE DEFEND\u2122 Tactic",
      "type": "d3f_tactic"
    },
    "d3f_technique": {
      "description": "The Defend Technique object describes the technique ID and/or name associated with a countermeasure, as defined by <a target='_blank' href='https://d3fend.mitre.org'>D3FEND Matrix<sup>TM</sup></a>.",
      "requirement": "recommended",
      "caption": "MITRE DEFEND\u2122 Technique",
      "type": "d3f_technique"
    },
    "version": {
      "description": "The <a target='_blank' href='https://d3fend.mitre.org'>D3FEND Matrix<sup>TM</sup></a> version.",
      "requirement": "recommended",
      "caption": "Version",
      "type": "string_t"
    },
    "raw_data": {
      "group": "context",
      "caption": "Raw Data",
      "description": "The event data as received from the event source.",
      "type": "json_t"
    },
    "record_id": {
      "description": "Unique identifier for the object",
      "group": "primary",
      "requirement": "required",
      "caption": "Record ID",
      "type": "string_t"
    },
    "unmapped": {
      "caption": "Unmapped Data",
      "description": "The attributes that are not mapped to the event schema. The names and values of those attributes are specific to the event source.",
      "type": "unmapped",
      "is_array": true
    }
  },
  "constraints": {
    "at_least_one": [
      "d3f_tactic",
      "d3f_technique"
    ]
  }
}