Skip to content

Class: D3fend

The MITRE D3FEND™ object describes the tactic & technique associated with a

countermeasure.

URI: ocsf:D3fend

 classDiagram
    class D3fend
    click D3fend href "../D3fend/"
      Object <|-- D3fend
        click Object href "../Object/"

      D3fend : d3f_tactic





        D3fend --> "0..1 _recommended_" D3fTactic : d3f_tactic
        click D3fTactic href "../D3fTactic/"



      D3fend : d3f_technique





        D3fend --> "0..1 _recommended_" D3fTechnique : d3f_technique
        click D3fTechnique href "../D3fTechnique/"



      D3fend : version

Inheritance

Slots

Name Cardinality and Range Description Inheritance
d3f_tactic 0..1 recommended
D3fTactic		 The Tactic object describes the tactic ID and/or name that is associated with... direct
d3f_technique 0..1 recommended
D3fTechnique		 The Technique object describes the technique ID and/or name associated with a direct
version 0..1 recommended
String		 The D3FEND™ Matrix version direct

Usages

used by used in type used
Mitigation countermeasures range D3fend
FileRemediationActivity countermeasures range D3fend
NetworkRemediationActivity countermeasures range D3fend
ProcessRemediationActivity countermeasures range D3fend
RemediationActivity countermeasures range D3fend

Rules

Rule Applied Preconditions Postconditions Elseconditions
any_of [{'slot_conditions': {'d3f_tactic': {'required': True}}}, {'slot_conditions': {'d3f_technique': {'required': True}}}]

In Subsets

Aliases

  • MITRE D3FEND™

See Also

Notes

Identifier and Mapping Information

Annotations

property value
ocsf_constraints {"at_least_one": ["d3f_tactic", "d3f_technique"]}

Schema Source

Mappings

Mapping Type Mapped Value
self ocsf:D3fend
native ocsf:D3fend

LinkML Source

Direct

name: D3fend
annotations:
  ocsf_constraints:
    tag: ocsf_constraints
    value: '{"at_least_one": ["d3f_tactic", "d3f_technique"]}'
description: 'The MITRE D3FEND™ object describes the tactic & technique associated
  with a

  countermeasure.'
notes:
- D3FEND™ Matrix — https://d3fend.mitre.org
in_subset:
- objects_subset
from_schema: https://w3id.org/lmodel/ocsf
see_also:
- https://d3fend.mitre.org
aliases:
- MITRE D3FEND™
is_a: Object
slots:
- d3f_tactic
- d3f_technique
- version
slot_usage:
  d3f_tactic:
    name: d3f_tactic
    description: 'The Tactic object describes the tactic ID and/or name that is associated
      with a

      countermeasure.'
    recommended: true
  d3f_technique:
    name: d3f_technique
    description: 'The Technique object describes the technique ID and/or name associated
      with a

      countermeasure.'
    recommended: true
  version:
    name: version
    description: The D3FEND™ Matrix version.
    recommended: true
rules:
- postconditions:
    any_of:
    - slot_conditions:
        d3f_tactic:
          name: d3f_tactic
          required: true
    - slot_conditions:
        d3f_technique:
          name: d3f_technique
          required: true
  description: 'OCSF at_least_one: at least one of [''d3f_tactic'', ''d3f_technique'']
    must be set.'

Induced

name: D3fend
annotations:
  ocsf_constraints:
    tag: ocsf_constraints
    value: '{"at_least_one": ["d3f_tactic", "d3f_technique"]}'
description: 'The MITRE D3FEND™ object describes the tactic & technique associated
  with a

  countermeasure.'
notes:
- D3FEND™ Matrix — https://d3fend.mitre.org
in_subset:
- objects_subset
from_schema: https://w3id.org/lmodel/ocsf
see_also:
- https://d3fend.mitre.org
aliases:
- MITRE D3FEND™
is_a: Object
slot_usage:
  d3f_tactic:
    name: d3f_tactic
    description: 'The Tactic object describes the tactic ID and/or name that is associated
      with a

      countermeasure.'
    recommended: true
  d3f_technique:
    name: d3f_technique
    description: 'The Technique object describes the technique ID and/or name associated
      with a

      countermeasure.'
    recommended: true
  version:
    name: version
    description: The D3FEND™ Matrix version.
    recommended: true
attributes:
  d3f_tactic:
    name: d3f_tactic
    description: 'The Tactic object describes the tactic ID and/or name that is associated
      with a

      countermeasure.'
    notes:
    - D3FEND™ Matrix — https://d3fend.mitre.org
    from_schema: https://w3id.org/lmodel/ocsf
    see_also:
    - https://d3fend.mitre.org
    aliases:
    - MITRE D3FEND™ Tactic
    rank: 1000
    alias: d3f_tactic
    owner: D3fend
    domain_of:
    - D3fend
    range: D3fTactic
    recommended: true
  d3f_technique:
    name: d3f_technique
    description: 'The Technique object describes the technique ID and/or name associated
      with a

      countermeasure.'
    notes:
    - D3FEND™ Matrix — https://d3fend.mitre.org
    from_schema: https://w3id.org/lmodel/ocsf
    see_also:
    - https://d3fend.mitre.org
    aliases:
    - MITRE D3FEND™ Technique
    rank: 1000
    alias: d3f_technique
    owner: D3fend
    domain_of:
    - D3fend
    range: D3fTechnique
    recommended: true
  version:
    name: version
    description: The D3FEND™ Matrix version.
    from_schema: https://w3id.org/lmodel/ocsf
    aliases:
    - Version
    rank: 1000
    alias: version
    owner: D3fend
    domain_of:
    - Os
    - Package
    - RpcInterface
    - Sbom
    - Scim
    - SoftwareComponent
    - Tls
    - Agent
    - AiModel
    - Analytic
    - Api
    - ApplicationObject
    - Attack
    - Certificate
    - Check
    - CisControl
    - CisCsc
    - Cvss
    - D3fend
    - Databucket
    - Epss
    - Extension
    - Feature
    - File
    - HttpRequest
    - Logger
    - ManagedEntity
    - Metadata
    - Policy
    - Product
    - ResourceDetails
    - Rule
    - Service
    - NtpActivity
    range: string
    recommended: true
rules:
- postconditions:
    any_of:
    - slot_conditions:
        d3f_tactic:
          name: d3f_tactic
          required: true
    - slot_conditions:
        d3f_technique:
          name: d3f_technique
          required: true
  description: 'OCSF at_least_one: at least one of [''d3f_tactic'', ''d3f_technique'']
    must be set.'