D3FEND API Documentation | MITRE D3FEND™

Endpoint for retrieving single artifact properties

GET

/api/dao/artifact/[artifact].json

Parameters

Name	Type	Description
artifact	string	Name of D3FEND Artifact

Returns

Type	Description
DAOArtifact	200 - success response - application/json

/api/dao/artifact/d3f:AccessToken.json

export interface DAOArtifact {
    da_to_off:   DaToOff;
    da_to_def:   DaToDef;
    da_to_weak:  DaToWeak;
    da_graph:    DaGraph;
    neighbors:   DaToWeak;
    description: DaToWeak;
}

export interface DaGraph {
    "@context": Context;
    "@graph":   DaGraphGraph[];
}

export interface Context {
    d3f:       string;
    rdfs:      string;
    skos:      string;
    owl:       string;
    children?: Children;
}

export interface Children {
    "@id":        string;
    "@type":      string;
    "@container": string;
}

export interface DaGraphGraph {
    "@id":               string;
    "rdfs:hasSubClass"?: RdfsSeeAlso[] | RdfsSeeAlso;
    "rdfs:label":        string;
}

export interface RdfsSeeAlso {
    "@id": string;
}

export interface DaToDef {
    head:    Head;
    results: DaToDefResults;
}

export interface Head {
    vars: string[];
}

export interface DaToDefResults {
    bindings: Binding[];
}

export interface Binding {
    def_tactic_label:            DefArtifact;
    def_tactic_rel_label:        DefArtifact;
    def_tech_parent_is_toplevel: DefTechParentIsToplevel;
    def_tech_parent_label:       DefArtifact;
    def_tech_label:              DefArtifact;
    def_artifact_rel_label:      DefArtifact;
    def_artifact_label:          DefArtifact;
    def_tactic:                  DefArtifact;
    def_tactic_rel:              DefArtifact;
    def_tech:                    DefArtifact;
    def_artifact_rel:            DefArtifact;
    def_artifact:                DefArtifact;
}

export interface DefArtifact {
    type:  Type;
    value: string;
}

export enum Type {
    Literal = "literal",
    URI = "uri",
}

export interface DefTechParentIsToplevel {
    datatype: string;
    type:     Type;
    value:    string;
}

export interface DaToOff {
    head:    Head;
    results: DaToOffResults;
}

export interface DaToOffResults {
    bindings: { [key: string]: DefArtifact }[];
}

export interface DaToWeak {
    "@context": Context;
    "@graph":   DaToWeakGraph[];
}

export interface DaToWeakGraph {
    "@id":              string;
    "@type"?:           string[];
    "d3f:definition"?:  string;
    "rdfs:label"?:      string[] | string;
    "rdfs:seeAlso"?:    RdfsSeeAlso;
    "rdfs:subClassOf"?: RdfsSeeAlso;
    "skos:altLabel"?:   string[];
    "d3f:copies"?:      RdfsSeeAlso[];
    "d3f:outbound"?:    RdfsSeeAlso[];
    "d3f:contains"?:    RdfsSeeAlso[];
}

Endpoint for retrieving all D3FEND artifacts.

GET

/api/dao/artifacts.json

Returns

Type	Description
ArtifactsGraph	200 - success response - application/json

/api/dao/artifacts.json

export interface ArtifactsGraph {
    "@context": Context;
    "@graph":   Graph[];
}

export interface Context {
    d3f:      string;
    rdfs:     string;
    skos:     string;
    owl:      string;
    children: Children;
}

export interface Children {
    "@id":        string;
    "@type":      string;
    "@container": string;
}

export interface Graph {
    "@id":               string;
    "d3f:definition"?:   string[];
    "rdfs:hasSubClass"?: RdfsHasSubClass[];
    "rdfs:label":        string[];
    "skos:altLabel"?:    string[];
}

export interface RdfsHasSubClass {
    "@id": string;
}

Endpoint for retrieving all ATT&CK Mitigation Mappings.

GET

/api/mappings/attack-mitigations.json

Returns

Type	Description
ATTACKMapping	200 - success response - application/json

/api/mappings/attack-mitigations.json

export interface ATTACKMapping {
    "@context": Context;
    "@graph":   Graph[];
}

export interface Context {
    d3f:      string;
    rdfs:     string;
    skos:     string;
    owl:      string;
    children: Children;
}

export interface Children {
    "@id":        string;
    "@type":      string;
    "@container": string;
}

export interface Graph {
    "@id":                 string;
    "@type":               string[] | string;
    "rdfs:label":          string[];
    "d3f:d3fend-id"?:      string[];
    "d3f:definition"?:     string[];
    "d3f:d3fend-comment"?: string[];
    "d3f:related"?:        D3FRelated[];
}

export interface D3FRelated {
    "@id": string;
}

Endpoint for retrieving CCI mappings artifact properties

GET

/api/mappings/cci.[version].[format]

Parameters

Name	Type	Description
version	string	Mappings version (currently 5)
format	string	Format type (ttl, json, csv) of mappings

Returns

Type	Description
CCIMapping	200 - success response - application/json

/api/mappings/cci.5.json

export interface CCIMapping {
    head:    Head;
    results: Results;
}

export interface Head {
    vars: string[];
}

export interface Results {
    bindings: any[];
}

Endpoint for retrieving NIST mappings artifact properties

GET

/api/mappings/nist.[version].[format]

Parameters

Name	Type	Description
version	string	Mappings version (currently 5)
format	string	Format type (ttl, json, csv) of mappings

Returns

Type	Description
NISTMapping	200 - success response - application/json

/api/mappings/nist.5.json

export interface NISTMapping {
    head:    Head;
    results: Results;
}

export interface Head {
    vars: string[];
}

export interface Results {
    bindings: Binding[];
}

export interface Binding {
    catalog_label:   CatalogLabel;
    control_label:   CatalogLabel;
    technique:       CatalogLabel;
    relation_label:  CatalogLabel;
    technique_label: CatalogLabel;
}

export interface CatalogLabel {
    type:  Type;
    value: string;
}

export enum Type {
    Literal = "literal",
    URI = "uri",
}

Endpoint for retrieving D3FEND formatted object.

GET

/api/matrix.json

Returns

Type	Description
DAOMatrix[]	200 - success response - application/json

/api/matrix.json

export interface DAOMatrix {
    "@id":                  string;
    children:               DAOMatrixChild[];
    "d3f:display-order":    D3F;
    "d3f:display-priority": D3F;
    "d3f:type":             string;
    "rdfs:label":           string;
}

export interface PurpleChild {
    "@id":            string;
    "d3f:d3fend-id":  string;
    "d3f:definition": string;
    "rdfs:label":     string;
    children?:        DAOMatrixChild[];
    "d3f:ref-count"?: D3F;
}

export interface DAOMatrixChild {
    "@id":            string;
    children?:        PurpleChild[];
    "d3f:d3fend-id":  string;
    "d3f:definition": string[] | string;
    "rdfs:label":     string;
    "d3f:ref-count"?: D3F;
}

export interface D3F {
    "@type":  string;
    "@value": string;
}

Endpoint for retrieving all ATT&CK-technique artifacts.

GET

/api/offensive-technique/all.json

Returns

Type	Description
ATTACKTechniques	200 - success response - application/json

/api/offensive-technique/all.json

export interface ATTACKTechniques {
    "@context": Context;
    "@graph":   Graph[];
}

export interface Context {
    d3f:  string;
    rdfs: string;
    skos: string;
    owl:  string;
}

export interface Graph {
    "@id":           string;
    "d3f:attack-id": string;
    "rdfs:label":    string;
}

Endpoint for retrieving single ATT&CK technique properties.

GET

/api/offensive-technique/attack/[technique].json

Parameters

Name	Type	Description
artifact	string	Name of ATT&CK Artifact

Returns

Type	Description
OffensiveTechnique	200 - success response - application/json

/api/offensive-technique/attack/d3f:DataInventory.json

export interface OffensiveTechnique {
    off_to_def:    OffToDef;
    description:   Description;
    subtechniques: Description;
}

export interface Description {
    "@context": Context;
    "@graph":   any[];
}

export interface Context {
    d3f:  string;
    rdfs: string;
    skos: string;
    owl:  string;
}

export interface OffToDef {
    head:    Head;
    results: Results;
}

export interface Head {
    vars: string[];
}

export interface Results {
    bindings: any[];
}

Endpoint for retrieving D3FEND ontology bindings.

GET

/api/ontology/describe/[subject].json

Parameters

Name	Type	Description
subject	string	Single D3FEND object/artifact id

Returns

Type	Description
OntologyBindings	200 - success response - application/json

/api/ontology/describe/d3f:URLAnalysis.json

export interface OntologyBindings {
    head:    Head;
    results: Results;
}

export interface Head {
    vars: string[];
}

export interface Results {
    bindings: Binding[];
}

export interface Binding {
    subject:   Object;
    predicate: Object;
    object:    Object;
}

export interface Object {
    type:  Type;
    value: string;
}

export enum Type {
    Bnode = "bnode",
    Literal = "literal",
    URI = "uri",
}

Endpoint for retrieving single tactic properties.

GET

/api/tactic/[tactic].json

Parameters

Name	Type	Description
tactic	string	Name of D3FEND tactic Artifact

Returns

Type	Description
Tactic	200 - success response - application/json

/api/tactic/d3f:Harden.json

export interface Tactic {
    group:      Group;
    techniques: Techniques;
}

export interface Group {
    "@context": Context;
    "@graph":   GroupGraph[];
}

export interface Context {
    d3f:  string;
    rdfs: string;
    skos: string;
    owl:  string;
}

export interface GroupGraph {
    "@id":                  string;
    "@type":                string[];
    "d3f:definition":       string;
    "d3f:display-order":    D3FDisplay;
    "d3f:display-priority": D3FDisplay;
    "rdfs:label":           string;
    "rdfs:subClassOf":      Rdfs;
}

export interface D3FDisplay {
    "@type":  string;
    "@value": string;
}

export interface Rdfs {
    "@id": string;
}

export interface Techniques {
    "@context": Context;
    "@graph":   TechniquesGraph[];
}

export interface TechniquesGraph {
    "@id":               string;
    "d3f:d3fend-id":     string;
    "d3f:definition":    string;
    "rdfs:label":        string;
    "rdfs:subClassOf"?:  Rdfs;
    "d3f:synonym"?:      string[] | string;
    "d3f:top-level"?:    string;
    "rdfs:hasSubClass"?: Rdfs[];
}

Endpoint for retrieving all D3FEND Tactics.

GET

/api/tactic/all.json

Returns

Type	Description
Tactics	200 - success response - application/json

/api/tactic/all.json

export interface Tactics {
    "@context": Context;
    "@graph":   Graph[];
}

export interface Context {
    d3f:      string;
    rdfs:     string;
    skos:     string;
    owl:      string;
    children: Children;
}

export interface Children {
    "@id":        string;
    "@type":      string;
    "@container": string;
}

export interface Graph {
    "@id":                  string;
    "@type":                Type[];
    "d3f:definition":       string;
    "d3f:display-order":    D3FDisplay;
    "d3f:display-priority": D3FDisplay;
    "rdfs:label":           string;
    "rdfs:subClassOf":      RdfsSubClassOf;
}

export enum Type {
    D3FDefensiveTactic = "d3f:DefensiveTactic",
    OwlClass = "owl:Class",
    OwlNamedIndividual = "owl:NamedIndividual",
}

export interface D3FDisplay {
    "@type":  string;
    "@value": string;
}

export interface RdfsSubClassOf {
    "@id": Type;
}

Endpoint for retrieving Taxonomies.

GET

/api/taxonomies/[root_id].json

Parameters

Name	Type	Description
root_id	string	Name of D3FEND Taxonomy root/parent id

Returns

Type	Description
Taxonomy	200 - success response - application/json

/api/taxonomies/d3f:DigitalEvent.json

export interface Taxonomy {
    "@context": Context;
    "@graph":   Graph[];
}

export interface Context {
    rdfs: string;
    owl:  string;
    d3f:  string;
    skos: string;
}

export interface Graph {
    "@id":                  string;
    "@type":                TypeElement[] | TypeElement;
    "d3f:creates"?:         D3FAccess[];
    "rdfs:label":           string[];
    "rdfs:subClassOf":      D3FAccess[];
    "d3f:authenticates"?:   D3FAccess[];
    "d3f:definition"?:      string[];
    "d3f:may-create"?:      D3FAccess[];
    "d3f:originates-from"?: D3FAccess[];
    "rdfs:hasSubClass"?:    D3FAccess[];
    "rdfs:seeAlso"?:        Array<D3FAccess | string>;
    "d3f:authorizes"?:      D3FAccess[];
    "rdfs:isDefinedBy"?:    D3FAccess[];
    "d3f:connects"?:        D3FAccess[];
    "d3f:copies"?:          D3FAccess[];
    "skos:altLabel"?:       string[];
    "d3f:deletes"?:         D3FAccess[];
    "d3f:enumerates"?:      D3FAccess[];
    "d3f:reads"?:           D3FAccess[];
    "d3f:forges"?:          D3FAccess[];
    "d3f:accesses"?:        D3FAccess[];
    "d3f:modifies"?:        D3FAccess[];
    "d3f:evicts"?:          D3FAccess[];
    "d3f:executes"?:        D3FAccess[];
    "d3f:synonym"?:         string[];
    "d3f:terminates"?:      D3FAccess[];
    "d3f:monitors"?:        D3FAccess[];
}

export enum TypeElement {
    D3FAuthentication = "d3f:Authentication",
    D3FCopyToken = "d3f:CopyToken",
    D3FImpersonateUser = "d3f:ImpersonateUser",
    OwlClass = "owl:Class",
    OwlNamedIndividual = "owl:NamedIndividual",
}

export interface D3FAccess {
    "@id": string;
}

Endpoint for retrieving single technique properties.

GET

/api/technique/[technique].json

Parameters

Name	Type	Description
technique	string	Name of D3FEND technique Artifact

Returns

Type	Description
Technique	200 - success response - application/json

/api/technique/d3f:DataInventory.json

export interface Technique {
    def_to_off:               DefToOff;
    description:              Description;
    digital_artifacts:        DigitalArtifacts;
    references:               References;
    references_meta:          ReferencesMeta;
    subtechniques:            Description;
    related_offensive_matrix: RelatedOffensiveMatrix;
}

export interface DefToOff {
    head:    Head;
    results: DefToOffResults;
}

export interface Head {
    vars: string[];
}

export interface DefToOffResults {
    bindings: Binding[];
}

export interface Binding {
    query_def_tech_label:        DefArtifact;
    top_def_tech_label:          DefArtifact;
    def_tactic_label:            DefArtifact;
    def_tactic_rel_label:        DefArtifact;
    def_tech_label:              DefArtifact;
    def_artifact_rel_label:      DefArtifact;
    def_artifact_label:          DefArtifact;
    off_artifact_label:          DefArtifact;
    off_artifact_rel_label:      DefArtifact;
    off_tech_label:              DefArtifact;
    off_tech_id:                 DefArtifact;
    off_tech_parent_label:       DefArtifact;
    off_tech_parent_is_toplevel: OffTechParentIsToplevel;
    off_tactic_rel_label:        DefArtifact;
    off_tactic_label:            DefArtifact;
    def_tactic:                  DefArtifact;
    def_tactic_rel:              DefArtifact;
    def_tech:                    DefArtifact;
    def_artifact_rel:            DefArtifact;
    def_artifact:                DefArtifact;
    off_artifact:                DefArtifact;
    off_artifact_rel:            DefArtifact;
    off_tech:                    DefArtifact;
    off_tech_parent:             DefArtifact;
    off_tactic_rel:              DefArtifact;
    off_tactic:                  DefArtifact;
}

export interface DefArtifact {
    type:  Type;
    value: string;
}

export enum Type {
    Literal = "literal",
    URI = "uri",
}

export interface OffTechParentIsToplevel {
    datatype: string;
    type:     Type;
    value:    string;
}

export interface Description {
    "@context": DescriptionContext;
    "@graph":   DescriptionGraph[];
}

export interface DescriptionContext {
    d3f:  string;
    rdfs: string;
    skos: string;
    owl:  string;
}

export interface DescriptionGraph {
    "@id":              string;
    "@type":            string[];
    "d3f:d3fend-id":    string;
    "d3f:definition":   string;
    "d3f:inventories":  D3FKBReference[];
    "d3f:kb-reference": D3FKBReference;
    "d3f:synonym":      string[];
    "rdfs:label":       string;
    "rdfs:subClassOf":  D3FKBReference;
}

export interface D3FKBReference {
    "@id": string;
}

export interface DigitalArtifacts {
    head:    Head;
    results: DigitalArtifactsResults;
}

export interface DigitalArtifactsResults {
    bindings: { [key: string]: DefArtifact }[];
}

export interface References {
    "@context": ReferencesContext;
    "@graph":   ReferencesGraph[];
}

export interface ReferencesContext {
    rdfs: string;
    d3f:  string;
}

export interface ReferencesGraph {
    "@id":                      string;
    "@type":                    string[];
    "d3f:has-link":             D3FHasLink;
    "d3f:kb-abstract":          string;
    "d3f:kb-author":            string;
    "d3f:kb-organization":      string;
    "d3f:kb-reference-of":      D3FKBReference;
    "d3f:kb-reference-title":   string;
    "d3f:reference-type-label": string;
    "rdfs:label":               string;
}

export interface D3FHasLink {
    "@type":  string;
    "@value": string;
}

export interface ReferencesMeta {
    Patent: number;
}

export interface RelatedOffensiveMatrix {
    Collection:             Array<Array<Binding[] | string>>;
    "Credential Access":    Array<Array<Binding[] | string>>;
    "Defense Evasion":      Array<Array<Binding[] | string>>;
    Discovery:              Array<Array<Binding[] | string>>;
    Execution:              Array<Array<Binding[] | string>>;
    "Lateral Movement":     Array<Array<Binding[] | string>>;
    "Privilege Escalation": Array<Array<Binding[] | string>>;
    "Initial Access":       Array<Array<Binding[] | string>>;
    Persistence:            Array<Array<Binding[] | string>>;
}

Endpoint for retrieving all D3FEND Techniques.

GET

/api/technique/all.json

Returns

Type	Description
Techniques	200 - success response - application/json

/api/technique/all.json

export interface Techniques {
    "@context": Context;
    "@graph":   Graph[];
}

export interface Context {
    d3f:      string;
    rdfs:     string;
    skos:     string;
    owl:      string;
    children: Children;
}

export interface Children {
    "@id":        string;
    "@type":      string;
    "@container": string;
}

export interface Graph {
    "@id":           string;
    "@type":         Type;
    "d3f:d3fend-id": string;
    "rdfs:label":    string;
    "d3f:synonym"?:  string[] | string;
}

export enum Type {
    OwlClass = "owl:Class",
}

Endpoint for retrieving version and release date of D3FEND.

GET

/api/version.json

Returns

Type	Description
VersionData	200 - success response - application/json

/api/version.json

export interface VersionData {
    version:      string;
    release_date: Date;
}

Endpoint for retrieving all CWE Weaknesses in D3FEND Ontology.

GET

/api/weakness/all.json

Returns

Type	Description
Weaknesses	200 - success response - application/json

/api/weakness/all.json

export interface Weaknesses {
    "@context": Context;
    "@graph":   Graph[];
}

export interface Context {
    rdfs: string;
    owl:  string;
    d3f:  string;
    skos: string;
}

export interface Graph {
    "@id":                     string;
    "@type":                   TypeElement[] | TypeElement;
    "d3f:cwe-id":              string[];
    "d3f:weakness-of"?:        SsOf[];
    "rdfs:label":              string[];
    "rdfs:subClassOf":         SsOf[];
    "d3f:may-be-weakness-of"?: SsOf[];
    "rdfs:comment"?:           string[];
}

export enum TypeElement {
    OwlClass = "owl:Class",
    OwlNamedIndividual = "owl:NamedIndividual",
}

export interface SsOf {
    "@id": string;
}

Endpoint for retrieving Taxonomies.

GET

/api/weakness/cwe/[weakness_id].json

Parameters

Name	Type	Description
weakness_id	string	CWE Identifier

Returns

Type	Description
Weakness	200 - success response - application/json

/api/weakness/cwe/CWE-78.json

export interface Weakness {
    related:     Related;
    description: Description;
}

export interface Description {
    "@context": Context;
    "@graph":   DescriptionGraph[];
}

export interface Context {
    rdfs: string;
    owl:  string;
    d3f:  string;
    skos: string;
}

export interface DescriptionGraph {
    "@id":                    string;
    "@type":                  Type[];
    "d3f:cwe-id":             string[];
    "d3f:may-be-weakness-of": D3FMayBeWeaknessOf[];
    "rdfs:label":             string[];
    "rdfs:subClassOf":        D3FMayBeWeaknessOf[];
}

export enum Type {
    D3FDigitalArtifact = "d3f:DigitalArtifact",
    OwlClass = "owl:Class",
    OwlNamedIndividual = "owl:NamedIndividual",
}

export interface D3FMayBeWeaknessOf {
    "@id": string;
}

export interface Related {
    "@context": Context;
    "@graph":   RelatedGraph[];
}

export interface RelatedGraph {
    "@id":                     string;
    "@type":                   Type[];
    "rdfs:label":              string[];
    "rdfs:subClassOf":         D3FMayBeWeaknessOf[];
    "d3f:authenticates"?:      D3FMayBeWeaknessOf[];
    "d3f:definition"?:         string[];
    "d3f:cwe-id"?:             string[];
    "d3f:may-be-weakness-of"?: D3FMayBeWeaknessOf[];
    "d3f:related"?:            D3FMayBeWeaknessOf[];
    "d3f:related-rels"?:       D3FMayBeWeaknessOf[];
    "d3f:invokes"?:            D3FMayBeWeaknessOf[];
    "d3f:addresses"?:          D3FMayBeWeaknessOf[];
    "rdfs:comment"?:           string[];
    "d3f:accesses"?:           D3FMayBeWeaknessOf[];
}