MITRE ATT&CK, D3FEND and NIST: the standards behind SOC work

MITRE describes ATT&CK as "a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations". Tactics are an attacker's goals, such as gaining initial access or moving laterally; techniques are the ways of achieving them. SOC teams use it as a shared vocabulary for what a detection covers and where the gaps are.

• Dropzone AI made its AI Threat Hunter generally available on 29 July 2026. It runs hypothesis-driven hunts from 270+ prebuilt hunt packs mapped to ATT&CK, across Splunk, Microsoft Sentinel, CrowdStrike NG-SIEM, Elastic and Panther.
• Prophet Security launched an AI Detection Engineer on 30 July 2026. It builds an ATT&CK coverage map from a team's own detections and investigations, then writes, tunes and backtests detection rules for SIEMs including Splunk, Sumo Logic and Microsoft Sentinel.
• Mate Security describes threat hunting from plain language or CTI reports, mapped to ATT&CK.
• Splunk says its prebuilt SOAR playbooks are aligned to ATT&CK and D3FEND.

A mapping tells you what a hunt, rule or playbook is meant to cover. It does not tell you how well it works on your data. Ask for the mapping for your most common alert categories and test a sample.

D3FEND is MITRE's knowledge graph of defensive techniques, such as hardening, detection, isolation and eviction, linked to the attacker techniques they counter. It helps describe what a response action actually does. Among the platforms in this guide, Splunk names it for its prebuilt playbooks; the AI SOC vendors cite ATT&CK far more often.

The NIST Cybersecurity Framework 2.0 organises outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Alert triage and investigation sit mainly in Detect and Respond; decisions about how much autonomy to give an agent, and who approves it, belong in Govern.

On 18 August 2026 NIST released the initial public draft of SP 1353, a quick-start guide with AI prompts and use cases for analysing and reporting on CSF 2.0 outcomes. Comments are due on 15 October 2026. It is a draft about using AI for framework analysis and reporting, not a standard for AI SOC products.

SP 800-61 Rev. 3, published in April 2025, sets out incident response recommendations within CSF 2.0. It is a useful reference when agreeing what "response" means before an agent is allowed to act, and what records your incident process expects an audit trail to keep.

• Ask each vendor which ATT&CK techniques its hunts or detections cover for your top alert categories, and ask to see the mapping.
• Check that the platform's audit trail holds the records your incident response process needs.
• Write your autonomy rules in the terms of your governance process, so approvals and exceptions have an owner.
• Treat a framework logo on a vendor page as a statement of scope, not evidence of quality.