MOAR Stack · Well-connected
D3FEND ontology.
The grounding layer that says what an observation means defensively, so you can ask which techniques you can even detect given what you collect. It is where security meets the formal-ontology world, and where the honest finding is measured rather than asserted: the OCSF-to-D3FEND crosswalk is reciprocal at the class level, but the grounding underneath is roof-only, which leaves a real question about how much formal rigor a columnar lakehouse actually needs.
Well-connected component · 5 essays
Listed from the front door down to the measured evidence. Start here marks the entry essay. The reading-level tag says whether you are reading the frame (Orientation), the argument (Depth), or a first-party finding (Evidence). The durability tag flags durable architecture versus an Evidence-pinned result tied to a version or price.
- Start here OrientationDurable
How much ontology does security data actually need?
Security keeps being told its telemetry needs a formal ontology underneath it. Measured rather than asserted, D3FEND grounding is reciprocal at the class level but roof-only beneath, and the architecture that would make a richer one pay off is adjacent and virtual, not embedded. Use the formal model at design time as a validation oracle, the columnar schema at runtime. Keep McComb diagnosis, drop the triplestore prescription; AI maps, humans model.
Read →
- DepthDurable
OCSF ontological grounding: D3FEND for federal-ready.
OCSF anchored to MITRE D3FEND gives the ontology you need for federal-grade detection. What works today, what's still aspirational, and where the gaps sit.
Read →
- EvidenceEvidence-pinned
From field mappings to the controls layer.
Up one layer from the schema crosswalks: OCSF class to digital artifact to D3FEND defense to ATT&CK offense to NIST 800-53 / SCF control. Measured hop by hop (79 D3FEND techniques to 402 controls via 606 SKOS edges; 98% of the defensive matrix reaching a governance control through ATT&CK), and honest about the one direct link that does not exist.
Read →
- EvidenceEvidence-pinned
Measuring the detection coverage you actually have.
A measured-firing coverage read, not a vendor heatmap: eight ATT&CK techniques run through Sigma over an OCSF store on one APT29-style chain, scored against planted ground truth at 3 detected, 1 noisy, 4 missed, with the D3FEND join kept honest that counters is not detects.
Read →
- EvidenceEvidence-pinned
The assurance gap no single tool closes.
No single security tool knows your environment: on a planted 140,000-cell benchmark the best single tool recovers 47.7% of the truth and a freshness-scored cross-tool merge recovers 75.6%, while a 24.4% residual stays dark no matter how many tools you own. The transferable claim is the ordering, which holds across the whole parameter sweep, plus the entity-resolution tax a contested join key adds.
Read →
Capability Matrix
Grounding depth (OCSF to D3FEND links) is the robustness axis the Matrix measures.
See the Capability Matrix →