d3fend_defense_for_attack
Translate an ATT&CK technique ID into D3FEND defenses that mitigate it, connecting threat intelligence to actionable defensive playbooks.
Instructions
Reverse lookup: given an ATT&CK T-code, return D3FEND defenses that mitigate it. This is the bridge from offensive intelligence (ATT&CK / ATLAS / CVE) to defensive playbook. Pair with cve_lookup or atlas_technique_lookup output — when those carry an ATT&CK id, call this tool to surface the mitigations. defenses is capped at limit (default 30) for token efficiency; total is the honest pre-truncation count and truncated=true flags when the cap was hit. coverage_by_tactic always aggregates the FULL set, not the slice. Default response is SLIM (drops uri from each row); pass include='full' for the verbose record. Pass exclude_id when drilling from d3fend_defense_lookup to skip self in the 'see also' list. Returns 200 with empty defenses list when the T-code has no D3FEND mapping (the gap is itself a signal). Free: 30/hr, Pro: 500/hr. Returns {attack_technique_id, total, truncated, defenses [{defense_id, label, uri (only when include=full), parent_label, tactic, artifact, attack_label, attack_tactic}], coverage_by_tactic, next_calls}.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| attack_technique_id | Yes | ATT&CK technique id matching 'T####' or 'T####.###' (e.g. 'T1059', 'T1550.001'). Use this to bridge from CVE/ATLAS findings to D3FEND mitigations. | |
| limit | No | Cap on `defenses` array length. Default 30; popular T-codes (T1059, T1078) map to 30-50+ defenses. `total` and `coverage_by_tactic` always reflect the honest pre-truncation count. | |
| include | No | Detail level. Default (omit/empty) returns slim rows (drops the deterministic ontology `uri` — popular T-codes with 15+ defenses save ~900 chars). Pass 'full' to get `uri` back on every row. | |
| exclude_id | No | Optional D3FEND defense slug to omit from the defenses list. Used when chaining from d3fend_defense_lookup so the originating defense is not echoed back in its own 'see also' results. |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |