Every other defensive technique assumes you know what you are defending, yet most inventories are a spreadsheet of hardware that misses the software, configurations, data stores and container images attackers actually use. MITRE D3FEND puts Asset Inventory (D3-AI) first in its Model tactic and defines it as identifying and recording the organisation's assets and enriching each item with knowledge about their vulnerabilities. D3-AI has six child techniques, one of which has a child of its own. This guide treats the family as a programme: what each child records, how to collect it, which to build first, how to join the children into one usable record, and how to measure whether the inventory is good enough to defend from. It is written for security architects, vulnerability management leads and IT asset owners. For the CMDB as a system, see the Asset Inventory and CMDB Security Guide; for D3FEND overall, the MITRE D3FEND Guide.
Key takeaways
- D3FEND's inventory is security-enriched by definition. The parent definition includes vulnerability knowledge, so a list of devices without vulnerability and configuration data is only part of D3-AI.
- Six children, six different collectors. Network nodes, hardware components, software, configuration, data and vulnerabilities each come from different tools and owners.
- Start with network nodes and software. They underpin vulnerability enumeration and most detection context; data and hardware component inventories follow.
- Reconciliation is the hard part. The value comes from joining children into one record per asset with an owner, not from running more discovery.
- Inventory activity can look like attacker discovery. D3FEND notes that adversary enumeration resembles inventorying, so scanners need known identities, sources and schedules.
What D3FEND means by Asset Inventory
In the D3FEND ontology, D3-AI is a direct child of Defensive Technique, "enables Model", and carries display order 1 in that tactic. Its synonyms are Asset Inventorying and Asset Discovery. The Model tactic covers techniques that build the defender's picture of the environment, alongside Network Mapping, System Mapping and Operational Activity Mapping. Asset Inventory answers "what exists and what is wrong with it"; the mapping families answer "how it connects and what depends on it".
The D3FEND page for D3-AI builds its offensive links from the artefacts its children inventory or evaluate: database, network node, document file, configuration resource, hardware device, software and container image.
The child techniques
Every descendant of D3-AI in the D3FEND ontology, with the artefact relation D3FEND records and typical collection methods. Collection methods are examples, not recommendations.
| Technique | D3FEND definition (summary) | Artefact relation | Typical collection | Usual owner |
|---|---|---|---|---|
| D3-NNI Network Node Inventory | Records all network nodes: hosts, routers, switches, firewalls | inventories Network Node | Management protocols (SNMP, WBEM), passive network sensors, active host and port discovery, cloud provider APIs | Network and infrastructure |
| D3-HCI Hardware Component Inventory | Records hardware items in the architecture | inventories Hardware Device | Endpoint agents, device management, procurement records | IT asset management |
| D3-SWI Software Inventory | Records software items in the architecture | inventories Software | Endpoint agents, OS management interfaces such as WMI, package managers, SBOMs | Endpoint and application teams |
| D3-CI Configuration Inventory | Records the configuration of software and hardware and their components | inventories Configuration Resource | Configuration management tools, OS management interfaces, cloud configuration APIs | Platform engineering |
| D3-DI Data Inventory | Records schemas, formats, volumes and locations of data | inventories Database, Document File | Data discovery and classification scanning, database catalogues | Data owners, privacy |
| D3-AVE Asset Vulnerability Enumeration | Enriches inventory items with knowledge of their vulnerabilities | evaluates Physical Artifact, Software; identifies Vulnerability | Authenticated and agent-based vulnerability scanning, SBOM matching | Vulnerability management |
| D3-CIA Container Image Analysis (child of D3-AVE) | Analyses a container image against a set of policies | analyzes Container Image | Registry and pipeline image scanning (synonym: Container Image Scanning) | Platform and DevSecOps |
Deeper guides on individual areas: Vulnerability Scanning Guide, SBOM Guide, Data Classification Guide, Container Image Security Guide and OT Asset Visibility Guide.
Choosing, sequencing and combining the children
D3FEND does not prescribe an order. The roadmap below is NHI Mgmt Group's recommendation, ordered so that each child feeds the next.
- Network nodes (D3-NNI). Combine at least two sources, for example cloud provider APIs plus network discovery, because each misses what the other sees. Reconcile against DHCP, DNS and directory records to find unmanaged hosts.
- Software (D3-SWI). Collect installed software and versions per node from agents or management interfaces. For in-house and third-party applications, ingest SBOMs, which CISA describes as a nested inventory, a list of ingredients that make up software components.
- Vulnerabilities (D3-AVE, D3-CIA). Enumerate vulnerabilities against the software inventory, not just against IP ranges, and scan container images in the registry and pipeline before they run.
- Configuration (D3-CI). Record security-relevant settings against a baseline so drift is visible; see the NIST SP 800-128 Security-Focused Configuration Management Guide.
- Data (D3-DI). Locate databases and document stores holding sensitive data and link them to the nodes and owners from steps 1 and 2.
- Hardware components (D3-HCI). Add firmware, peripheral and component detail where it changes risk, for example servers with management controllers or OT devices.
Testing and rollback
- Pilot discovery: run active scanning against one segment first and confirm no service impact. D3FEND warns that scanning and probing can affect both IT and OT systems; for OT, prefer passive collection and vendor-approved methods.
- Rollback: keep scan profiles versioned so a disruptive profile can be reverted, and agree change windows for any active discovery in production.
Cadence: a public benchmark
CISA Binding Operational Directive 23-01, issued on 3 October 2022 for US federal civilian agencies, gives a useful reference point: automated asset discovery every 7 days covering at least the agency's whole IPv4 space, and vulnerability enumeration starting every 14 days across all discovered assets, including roaming devices. The directive excludes ephemeral assets such as containers and third-party-managed SaaS. Outside its scope these figures are a benchmark, not a requirement.
Small and large organisations
- Small organisations: device management, cloud provider inventories and one vulnerability scanner usually cover D3-NNI, D3-SWI and D3-AVE. Use the IT Asset Inventory Template to structure the record.
- Large organisations: many overlapping sources make reconciliation the main task; an asset aggregation platform helps. See the Asset Inventory and CAASM Buyers Guide.
Where identity fits
D3-AI as written inventories devices, software, configuration and data, but every one of those assets runs under, or holds, identities: service accounts on servers, API keys in configuration files, workload identities on container images. Two practical links help. Record the owning team and the machine identities used by each asset, so an asset compromise immediately gives a credential list to evict (see the MITRE D3FEND Credential Eviction Implementation Guide). And use configuration and data inventories to find secrets stored where they should not be. Identity inventory itself is modelled elsewhere in D3FEND, under Access Modeling in Operational Activity Mapping. See NHI Discovery Across Cloud, SaaS, CI/CD and On-Premises Environments and NHI Inventory Reconciliation.
ATT&CK techniques D3FEND relates to Asset Inventory
The D3FEND page for D3-AI lists offensive techniques by name across most tactics, and labels the mappings inferred and experimental. The selection below adds the current ATT&CK v20 IDs. An inventory does not stop these techniques; it supplies the context to find and prioritise them.
| ATT&CK tactic | Techniques (selection from the D3FEND page) | Child that gives defenders context |
|---|---|---|
| Initial Access | T1195 Supply Chain Compromise, T1566.001 Spearphishing Attachment | D3-SWI and SBOMs identify affected components |
| Persistence | T1505.003 Web Shell, T1543.003 Windows Service, T1547.001 Registry Run Keys / Startup Folder | D3-SWI and D3-CI show what should be installed and configured |
| Privilege Escalation | T1548.002 Bypass User Account Control, T1548.001 Setuid and Setgid | D3-CI records the settings these depend on |
| Lateral Movement | T1072 Software Deployment Tools, T1091 Replication Through Removable Media | D3-SWI locates deployment tools; D3-HCI records removable media capability |
| Credential Access | T1003 OS Credential Dumping, T1552 Unsecured Credentials, T1056.001 Keylogging | D3-CI and D3-DI find stored credentials |
| Discovery | T1518 Software Discovery, T1526 Cloud Service Discovery, T1033 System Owner/User Discovery | The attacker builds the same inventory; yours should be more complete |
See the Discovery and Reconnaissance Techniques Guide for the attacker view.
Detection and measurement
The inventory itself is a detection source. Useful signals include a node seen on the network but absent from the inventory (unauthorised component), new software on a server class that never changes, configuration drift from baseline, a new data store containing sensitive data, and scanning activity from a source that is not a registered inventory tool. Metrics we suggest:
- Coverage per child: share of assets with records from each of the six children.
- Unknown asset rate: nodes found by discovery but not in the inventory, per week.
- Ownership: share of assets with a named owner and business service.
- Freshness: median age of the last successful collection per asset.
- Vulnerability enumeration coverage: share of discovered assets scanned within the target cadence.
- Image coverage: share of running container images that were scanned before deployment.
Framework mapping
| Framework | Reference | Link to D3-AI |
|---|---|---|
| NIST CSF 2.0 | ID.AM-01 hardware, ID.AM-02 software, services and systems, ID.AM-07 data, ID.AM-08 life cycle | D3-HCI, D3-NNI, D3-SWI, D3-DI |
| NIST CSF 2.0 | ID.RA-01 vulnerabilities identified, validated and recorded | D3-AVE, D3-CIA |
| NIST SP 800-53 Rev. 5 | CM-8 System Component Inventory, CM-8(3) Automated Unauthorized Component Detection, CM-8(4) Accountability Information | D3-NNI, D3-HCI, D3-SWI and ownership |
| NIST SP 800-53 Rev. 5 | CM-2 Baseline Configuration, RA-5 Vulnerability Monitoring and Scanning, SR-4 Provenance | D3-CI, D3-AVE, SBOM-based D3-SWI |
| CIS Controls v8.1 | Control 1 Inventory and Control of Enterprise Assets, Control 2 Inventory and Control of Software Assets, Control 7 Continuous Vulnerability Management | D3-NNI and D3-HCI, D3-SWI, D3-AVE |
| CISA BOD 23-01 | Asset discovery and vulnerability enumeration | D3-NNI and D3-AVE for federal civilian agencies |
Common failure patterns
- Inventory without enrichment. A device list with no software, configuration or vulnerability data cannot drive response, which is why D3FEND builds enrichment into the definition.
- Single-source discovery. Agent-only inventories miss unmanaged devices; network-only inventories miss roaming laptops and cloud resources.
- No owner field. Assets found without an owner cannot be patched, decommissioned or investigated quickly.
- Active scanning in OT without testing. Probing fragile controllers can disrupt operations; D3FEND flags this risk directly.
- Ephemeral assets ignored. Containers and serverless functions are inventoried only at runtime, if at all, rather than through image and pipeline scanning.
- Unregistered scanners. Inventory tools with broad credentials are themselves high-value targets and generate traffic that hides attacker discovery. See If your CMDB and asset inventory is compromised.
Practitioner checklist
- Map each D3-AI child to a collection source, owner and refresh cadence.
- Use at least two independent sources for network node discovery and reconcile them.
- Collect software versions per asset and ingest SBOMs for key applications.
- Enumerate vulnerabilities against the software inventory and scan container images pre-deployment.
- Record configuration baselines and alert on drift.
- Link sensitive data stores to their hosting assets and owners.
- Record the machine identities each asset uses and holds.
- Register every scanner's identity and source so its traffic is distinguishable from attacker discovery.
- Report coverage, unknown asset rate and freshness monthly.
Standards and references
- MITRE D3FEND: Asset Inventory
- MITRE D3FEND: Network Node Inventory
- CISA: BOD 23-01 Improving Asset Visibility and Vulnerability Detection on Federal Networks
- CISA: Software Bill of Materials
- CISA: Foundations for OT Cybersecurity, Asset Inventory Guidance
- NIST: SP 800-53 Rev. 5
- NIST: Cybersecurity Framework 2.0
- CIS: CIS Controls v8.1
Related NHI Mgmt Group resources: MITRE D3FEND Guide · Asset Inventory and CMDB Security Guide · Attack Surface Management Guide · Asset Inventory Maturity Model