D3FEND Attack Coverage
d3fend_attack_coverageAssess an attack campaign's defensive coverage by mapping ATT&CK T-codes to D3FEND tactics, revealing undefended techniques for further threat analysis.
Instructions
Batch coverage breakdown: given a list of ATT&CK T-codes, return distinct defense counts per D3FEND tactic + identify which techniques have NO D3FEND mapping (undefended_techniques). Use to assess the defensive posture of an entire attack campaign or threat model in one call. defended_techniques is the subset with at least one D3FEND defense; undefended_techniques are gaps worth flagging. Pair with cve_search per gap to identify exploit availability. Free: 30/hr, Pro: 500/hr. Returns {queried_techniques, coverage_by_tactic, defended_techniques, undefended_techniques, next_calls}.
Tool call template
Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {
"attack_technique_ids": "<attack_technique_ids>"
},
"name": "d3fend_attack_coverage"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| attack_technique_ids | Yes | List of ATT&CK technique ids (T#### or T####.###) to assess. Capped at 500 — extra entries are dropped server-side. Example: ['T1059', 'T1550.001', 'T1190', 'T9999']. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |