Detection, Denial, and Disruption Framework Empowering Network Defense
D3FEND is a MITRE knowledge base that catalogs defensive techniques and maps them to the offensive techniques in ATT&CK. Security architects and detection engineers use it to answer which countermeasures actually address a given attacker behavior. It matters because it gives defenders a shared, structured vocabulary for defense, just as ATT&CK did for offense.