Bidda Sovereign Intelligence · 10,085 Verified Nodes · 39 Sovereign Pillars
MITRE D3FEND: A Knowledge Graph of Cyber Countermeasures
MITRE D3FEND is a knowledge graph of cybersecurity countermeasures developed by MITRE with funding from the National Security Agency. Where ATT&CK…
· 7 min read · MITRE Frameworks
The defensive counterpart to ATT&CK, mapping techniques to the controls that stop them.
The Defensive Side of the Map
For years, defenders had a rich vocabulary for attacks, through ATT&CK, but no equally rigorous vocabulary for defences. D3FEND fills that gap. It is a framework, expressed as a knowledge graph, that names and defines defensive techniques with the same precision ATT&CK applies to offensive ones. It was created by MITRE and funded by the National Security Agency, and it is published openly.
Defensive Tactics
D3FEND organises countermeasures into defensive tactics. These include Model, which is understanding and inventorying your assets; Harden, which reduces attack surface before contact; Detect, which identifies adversary activity; Isolate, which limits an adversary's reach; Deceive, which uses decoys and lures; Evict, which removes an adversary's access; and Restore, which returns systems to a known-good state. Each tactic contains specific defensive techniques, such as credential hardening, decoy environments, or credential rotation.
The Digital Artifact Bridge
D3FEND's most important contribution is the way it connects defence to offence. Rather than asserting that a defence simply counters an attack, it models the digital artifacts involved, the files, processes, network traffic, and credentials that both an attacker manipulates and a defender observes. By relating defensive techniques and offensive techniques to the same artifacts, D3FEND lets a team reason precisely about which defences are relevant to which ATT&CK techniques, and why.
How Bidda Maps D3FEND
Bidda represents D3FEND techniques as verified nodes and crosswalks them to the control catalogues used for assurance and audit, principally NIST SP 800-53 and the CIS Critical Security Controls. This means a defensive technique such as credential rotation resolves not only to the ATT&CK techniques it counters, but also to the specific control identifiers an auditor expects to see implemented. The result is a closed loop: threat, defensive countermeasure, and control obligation, all in one query.
Designing Defence in Depth
A security architect can use the Bidda D3FEND nodes to plan layered defences against a chosen set of ATT&CK techniques, then export the mapped controls as the basis for a control narrative. Agents can perform the same reasoning through the MCP server and discovery API. The official D3FEND knowledge graph is published by MITRE at d3fend.mitre.org; Bidda supplies the verified crosswalk to compliance controls.
Frequently Asked Questions
What is MITRE D3FEND?D3FEND is a knowledge graph of cybersecurity countermeasures developed by MITRE with National Security Agency funding. It names and defines defensive techniques, organised into tactics such as Harden, Detect, Isolate, Deceive, Evict, and Restore, and links them to the offensive techniques they counter.
How does D3FEND relate to ATT&CK?ATT&CK describes attacks; D3FEND describes defences. D3FEND connects the two through digital artifacts, the files, processes, traffic, and credentials that both sides interact with, so defenders can identify exactly which countermeasures are relevant to a given attacker technique.
Which control frameworks does Bidda map D3FEND to?Bidda crosswalks D3FEND defensive techniques to NIST SP 800-53 and the CIS Critical Security Controls, so a defensive capability resolves directly to the control identifiers used in audits and assurance reviews.
⚠ Important: Human Verification Required
Bidda compliance nodes are reference intelligence, not legal advice. Every node must be reviewed by a qualified compliance professional or legal counsel before implementation in any enterprise workflow, regulated system, or compliance programme. See bidda.com/disclaimer for full terms.