How do I install the D3fend Model skill?

Run npx skillmds@latest add daemon-blockint-tech/d3fend-model in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is D3fend Model safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with D3fend Model?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is D3fend Model free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published D3fend Model?

daemon-blockint-tech (@daemon-blockint-tech) published this skill. Their other Agent Skills are listed on their SkillMD profile.

D3fend Model by daemon-blockint-tech

Name: D3fend Model
Author: daemon-blockint-tech

D3fend Model

Guides cybersecurity asset modeling, inventory, and vulnerability assessment using MITRE D3FEND. Covers asset inventory (hardware, software, network, data, containers), network mapping, vulnerability enumeration, dependency mapping, and operational risk assessment. Use when building CMDBs, running asset discovery, mapping network topology, assessing vulnerabilities, or modeling organizational cyber posture—not for hardening controls (d3fend-harden), detection engineering (d3fend-detect), or incident response (d3fend-evict).

File contents

D3FEND — Model

When to Use

Building or auditing asset inventories (hardware, software, network, data)
Mapping network topology and logical/physical links
Running vulnerability assessments and enumerating exposures
Modeling operational dependencies and service mappings
Assessing organizational cyber risk posture
Analyzing container images and configurations

When NOT to Use

Implementing hardening controls → d3fend-harden
Designing detection rules or monitoring → d3fend-detect
Network segmentation or access mediation → d3fend-isolate
Incident response or eviction actions → d3fend-evict
General enterprise security program design → cybersecurity

Core Workflows

1. Asset Inventory

Asset Type	What to Capture	Tools
Hardware	Devices, firmware, components	Lansweeper, Nmap, agent-based discovery
Software	Installed apps, versions, licenses	SCCM, osquery, SBOM tools
Network	Nodes, interfaces, VLANs	Nmap, SNMP, network scanners
Data	Databases, file stores, sensitivity	Data classification tools
Containers	Images, registries, runtime inventory	Trivy, Docker Scout, Kubernetes APIs

See references/asset_inventory.md

2. Network Mapping

Logical: Layer 3 topology, routing paths, traffic policies
Physical: Cable runs, rack layouts, wireless coverage
Active: Scanning, probing, traceroute
Passive: NetFlow, ARP tables, DHCP logs

See references/network_mapping.md

3. Vulnerability Assessment

Discovery → asset inventory
Scanning → Nessus, Qualys, OpenVAS
Analysis → CVSS scoring, exploitability, exposure
Prioritization → threat intel, asset criticality
Reporting → remediation timelines

See references/vulnerability_assessment.md

4. Dependency & Risk Mapping

Service dependencies: upstream/downstream services
Operational: business process → IT asset mapping
Data exchange: flows, interfaces, protocols
Access modeling: who can access what

See references/dependency_risk_mapping.md

When to load references

Asset inventory → references/asset_inventory.md
Network mapping → references/network_mapping.md
Vulnerability assessment → references/vulnerability_assessment.md
Dependency & risk mapping → references/dependency_risk_mapping.md

---name: d3fend-modeldescription: Guides cybersecurity asset modeling, inventory, and vulnerability assessment using MITRE D3FEND. Covers asset inventory (hardware, software, network, data, containers), network mapping, vulnerability enumeration, dependency mapping, and operational risk assessment. Use when building CMDBs, running asset discovery, mapping network topology, assessing vulnerabilities, or modeling organizational cyber posture—not for hardening controls (d3fend-harden), detection engineering (d3fend-detect), or incident response (d3fend-evict).---# D3FEND — Model## When to Use- Building or auditing asset inventories (hardware, software, network, data)- Mapping network topology and logical/physical links- Running vulnerability assessments and enumerating exposures- Modeling operational dependencies and service mappings- Assessing organizational cyber risk posture- Analyzing container images and configurations## When NOT to Use- Implementing hardening controls → `d3fend-harden`- Designing detection rules or monitoring → `d3fend-detect`- Network segmentation or access mediation → `d3fend-isolate`- Incident response or eviction actions → `d3fend-evict`- General enterprise security program design → `cybersecurity`## Core Workflows### 1. Asset Inventory| Asset Type | What to Capture | Tools ||---|---|---|| Hardware | Devices, firmware, components | Lansweeper, Nmap, agent-based discovery || Software | Installed apps, versions, licenses | SCCM, osquery, SBOM tools || Network | Nodes, interfaces, VLANs | Nmap, SNMP, network scanners || Data | Databases, file stores, sensitivity | Data classification tools || Containers | Images, registries, runtime inventory | Trivy, Docker Scout, Kubernetes APIs |**See `references/asset_inventory.md`**### 2. Network Mapping- **Logical**: Layer 3 topology, routing paths, traffic policies- **Physical**: Cable runs, rack layouts, wireless coverage- **Active**: Scanning, probing, traceroute- **Passive**: NetFlow, ARP tables, DHCP logs**See `references/network_mapping.md`**### 3. Vulnerability Assessment1. Discovery → asset inventory2. Scanning → Nessus, Qualys, OpenVAS3. Analysis → CVSS scoring, exploitability, exposure4. Prioritization → threat intel, asset criticality5. Reporting → remediation timelines**See `references/vulnerability_assessment.md`**### 4. Dependency & Risk Mapping- Service dependencies: upstream/downstream services- Operational: business process → IT asset mapping- Data exchange: flows, interfaces, protocols- Access modeling: who can access what**See `references/dependency_risk_mapping.md`**## When to load references- **Asset inventory** → `references/asset_inventory.md`- **Network mapping** → `references/network_mapping.md`- **Vulnerability assessment** → `references/vulnerability_assessment.md`- **Dependency & risk mapping** → `references/dependency_risk_mapping.md`

Frequently asked questions