D3FEND Posture
get_d3fend_postureRetrieve D3FEND countermeasures for a threat's ATT&CK techniques, mapping offensive techniques to digital artifacts and defensive tactics. Identify what would have stopped the threat by its threat ID.
Instructions
Get the defensive twin of a threat's ATT&CK mapping: offensive technique to digital artifact to D3FEND countermeasure, plus coverage by defensive tactic. Use to answer 'what would have stopped this'. COVERAGE: 197 of 1,891 threats carry a mapping, so absence is common and is not an error — a threat that exists with no mapping answers 200 with an empty mappings and a reason saying whether it has no techniques at all or techniques the ontology has no countermeasure for; only an unknown threat id answers 404. IMPORTANT: this is a deterministic projection of the threat's techniques through a static ontology — two threats sharing countermeasures almost always just share techniques, so never treat countermeasure overlap as independent correlation evidence.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Raw technique x countermeasure pairs in `mappings` (default 60, max 500). `countermeasures` always rolls up ALL pairs regardless, so the default loses no information — raise this only if you need the individual pairings. | |
| threat_id | Yes | Threat ID (e.g. TL-2026-1916) |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| count | No | TOTAL technique x countermeasure pairs, not the number returned in `mappings`. | |
| error | No | Present only on 404 ('threat not found'). A threat that exists but has no mapping answers 200, never 404. | |
| caveat | No | States that this is a deterministic projection of threat_mitre, not independent evidence. | |
| reason | No | Present only on the 200-with-zero-mappings case: says WHY there is no posture (no techniques mapped vs techniques with no countermeasure). | |
| coverage | No | ||
| mappings | No | ||
| threat_id | Yes | ||
| detail_hint | No | ||
| countermeasures | No | ||
| mappings_returned | No | ||
| mappings_truncated | No | True when `mappings` was capped; `countermeasures` still covers every pair. | |
| countermeasure_count | No | ||
| offensive_technique_count | No | Distinct ATT&CK techniques on the threat — the denominator the projection ran over. |