D3FENDer - Security Assessment & Gap Detection Tool Using MITRE ATT&CK & D3FEND Frameworks

D3FENDer is a rule-based CLI tool developed by Michael for his thesis titled Development of a security assessment and gap detection system using the MITRE ATT&CK and D3FEND Frameworks. It is designed to evaluate an organization's existing defensive measures, identify security gaps, detect various attack vectors and propose mitigations based on the MITRE ATT&CK and D3FEND Knowledge Bases.

This project is part of an academic thesis and focuses on transparency, explainability, practical use in SOC workflows, and DevSecOps Principles.

Features

• Rule-Based System of defensive measures
• Detection of missing defensive measures
• Mapping of possible MITRE ATT&CK techniques
• Mitigation Proposal
• Support for JSON and Plaintext inputs
• Local Storage of MITRE ATT&CK & D3FEND datasets using JSON and SQLite
• Docker Packaging for easier deployment
• Software bill of materials (SBOM) generation
• SBOM Vulnerability Analysis with OSV
• Explainability in AI
• CI/CD Pipeline
• Inclusion of a Light Semantic Layer for Semantic Similarity.

Online Version

There is an online and showcase version of D3FENDer hosted using Railway that presents its main capabilities. For more details please read the presentation presentation.pdf, or view the dedicated github repository at .