MITRE D3FEND: the defensive countermeasure knowledge graph, explained

MITRE D3FEND is a knowledge graph of cybersecurity countermeasures, built as the defensive counterpart to MITRE's better-known ATT&CK knowledge base. Per the project's own FAQ, the name is an acronym for "Detection, Denial, and Disruption Framework Empowering Network Defense." Where MITRE ATT&CK catalogs how attackers operate, D3FEND catalogs how defenders counter them — and, unlike a prose best-practices document, it links each defensive technique to the specific digital artifacts and attacker techniques it acts on, so the relationships can be queried rather than just read.

Who builds and funds it

D3FEND is a US government-funded research project, not an industry consortium or vendor product. Per D3FEND's own homepage and About page, it is "funded by the National Security Agency (NSA) Cybersecurity Directorate and managed by the National Security Engineering Center (NSEC) which is operated by The MITRE Corporation," with the underlying research funded under NSA contract W56KGU-18-D-0004. The About page states the project's goal is to let a practitioner understand "not only what threats a capability claims to address, but specifically how those threats are addressed from an engineering perspective" — D3FEND is meant to describe defensive mechanisms with engineering precision, not just name defensive categories.

A knowledge graph, not a checklist

D3FEND's own About page frames its core idea with a diagram titled "Simplified Offensive and Defensive Technique Relationships," and states that "the graph supports queries that can inferentially map cybersecurity countermeasures to offensive tactics, techniques, and procedures." Concretely, this means a given D3FEND defensive technique can be traced to the attacker techniques (typically from ATT&CK) it is designed to counter, and vice versa — a defender can start from "what are we worried about" or from "what capability do we already have" and query the graph in either direction.

The seven top-level tactics

As rendered on D3FEND's own homepage (checked 28 October 2026), defensive techniques are grouped under seven top-level tactic categories:

#	Tactic
1	Model
2	Harden
3	Detect
4	Isolate
5	Deceive
6	Evict
7	Restore

This guide did not locate a single official page giving a short, citable one-line definition for each of the seven tactics individually — unlike ATT&CK's tactics index, which states a one-line goal per tactic. A team that needs the precise scope of a specific tactic (for example, exactly where Isolate's boundary with Harden sits) should browse that tactic's page directly on the live D3FEND site before relying on the name alone in internal documentation.

The Artifact Ontology (DAO): what a countermeasure acts on

Underneath the tactics sits the D3FEND Artifact Ontology (DAO), D3FEND's data model of the "things" — digital and physical — that a countermeasure or an attack technique can act on. Per D3FEND's own DAO page, checked for this guide, the ontology spans several categories of artifact: digital artifacts (files, processes, network traffic, credentials, logs), physical artifacts (hardware devices, storage media, security tokens), system components (operating systems, databases, applications, firmware), operational-technology elements (industrial control systems, sensors, actuators), and OS API functions across Windows and Linux. The page is explicit that it is a work in progress, noting it "renders interesting portions of the D3FEND Artifact Ontology, but not the whole thing," and that "some concepts have no direct relationships specified, sometimes they are inferred through parent classes." The inclusion of OT elements (ICS, sensors, actuators) alongside conventional IT artifacts is notable for industrial and device-security teams specifically — D3FEND is not scoped to enterprise IT alone.

A project that is still actively revised

D3FEND's own changelog states that version 1.0.0, reached 20 December 2024, was the milestone that "established the D3FEND Digital Event ontology, integrating ATT&CK data sources, introducing Access Mediation techniques, and implementing Source Code Hardening countermeasures" — and D3FEND's own FAQ separately states that "as of 1.0.0, D3FEND is now considered stable." Despite that stability milestone, the project keeps shipping incremental releases: the changelog's most recent entries (checked 28 October 2026) include a 31 August 2026 release adding a dedicated ontology page for satellite and spacecraft defense scenarios, and a 23 September 2026 release fixing issues in the project's diagramming tool. The homepage separately shows a knowledge-graph content version (1.6.0) distinct from the site's UI version (0.26.1) at the time of this check. As with any actively maintained knowledge base, treat specific version numbers and release dates as a snapshot and check D3FEND's own changelog for the current state before citing one in a compliance or vendor document.

A workable starting point

1. Use D3FEND to answer "how," not just "what." If a security control is already named (e.g., network segmentation), D3FEND's engineering-level technique pages are the place to get specific about implementation, not just the category name.
2. Query the graph from the attacker side. Starting from a specific ATT&CK technique relevant to your environment and asking "what D3FEND techniques counter this" is often more actionable than browsing D3FEND's seven tactics top-down.
3. Don't skip the Artifact Ontology. The DAO is what makes D3FEND's mappings precise rather than aspirational — a defensive technique is described in terms of the concrete artifact (a process, a credential, a network flow) it operates on.
4. Re-check the live site before citing a count or a release date. D3FEND ships incremental releases multiple times a year; this guide's version and date references are a snapshot as of the check date above, not a permanently current figure.

SoftWSP's OT Snapshot service builds a passive device inventory and remote-access map from shop-floor traffic, the kind of visibility that sits behind D3FEND's Detect and Isolate tactics in an OT environment: see OT Snapshot.

This guide summarises public MITRE D3FEND project pages as checked on 28 October 2026; it does not constitute security or compliance advice.