🗺️ 01 - DFIR
Parent: 000 - Global Index
Overview
Scope: Evidence level — the defensive / blue-team side of the vault.
Focus: Investigating what already happened: acquiring evidence, preparing it for analysis, and reconstructing attacker activity from it.
This domain covers digital forensics and incident response work such as HTB Sherlocks. Where the offensive categories are organized by what the attacker wanted (MITRE ATT&CK tactics), the secondary categories here are organized by what evidence was examined, named after the artifact types of MITRE D3FEND’s Digital Artifact Ontology. A write-up usually carries both: a DFIR secondary for the evidence, and ATT&CK secondaries for the attacker behavior it uncovered.
Secondary Categories
| File | Created |
|---|---|
| 02 - D3FEND Email | September 28, 2026 |
| 02 - D3FEND File | September 28, 2026 |
| 02 - D3FEND Log | September 28, 2026 |
| 02 - D3FEND Network Traffic | September 28, 2026 |
| 02 - D3FEND Process | September 28, 2026 |
| 02 - D3FEND Windows Registry | September 28, 2026 |