Software Inventory

Where It Sits in the Scheme

5 ASOM-Fed techniques reach this countermeasure, across 3 forms of maneuver.

This is the direction the forward mapping cannot answer. A reader who works in D3FEND arrives holding D3-SWI and needs to know where it is employed in a scheme of maneuver — not which of MITRE's tactics it belongs to, which they already know.

Reached By

• M1.02 Shadow and Forgotten Asset DiscoveryM1 Screen / Guard · T3 Networks

  Reconcile discovered internet-facing assets against the authoritative inventory and drive the difference to zero.

• M1.14 Supplier Exposure MonitoringM1 Screen / Guard · T9 Supply Chain

  Monitor the suppliers and components that reach into the estate for breach disclosure, advisory and exposure, because their compromise is your compromise.

• M1.15 Device Estate DiscoveryM1 Screen / Guard · T2 Devices

  Discover devices reaching the estate from the identity plane outward rather than from the management console, because the console can only report what it already manages.

• M2.18 Component Provenance VerificationM2 Defense in Depth · T9 Supply Chain

  Know what is inside what you deploy, and verify it came from who it claims, before it runs on your ground.

• M6.10 Update Staging and SoakM6 Delay · T9 Supply Chain

  Hold vendor updates in a staging ring long enough to observe them, trading a little currency for the ability to not deploy a compromised build estate-wide.

Forms That Arrive Here

A countermeasure reached from more than one form is employed more than one way. D3FEND has no notion of a form, so this join exists only here.

• M1 Screen / GuardThe formGain early warning and buy reaction time before the adversary touches key terrain.
• M2 Defense in DepthThe formEnsure no single failure is decisive.
• M6 DelayThe formBuy decision time and prevent the adversary culminating on the objective.

What This Does Not Claim

That a technique reaches a D3FEND countermeasure says the two describe the same defensive act. It does not say the countermeasure is deployed, configured, or working — that is an assessment finding about your estate, not a property of the framework.

MITRE's own entry for this technique is at d3fend.mitre.org, and it is the authority on what the countermeasure is. This page is the authority only on where it sits in ASOM-Fed. D3FEND™ and ATT&CK® are trademarks of The MITRE Corporation. This mapping is published by threatDefendr and is neither produced nor endorsed by MITRE.