D3-MSM Motion Sensor Monitoring: Sensor Types, Tuning and Walk Test Verification

Server rooms, network closets and comms cabinets are often protected by a door control that records who badged in, but nothing records someone who entered another way or stayed after the door closed. MITRE D3FEND names the countermeasure that fills that gap Motion Sensor Monitoring (D3-MSM), with the synonyms Motion Detector Monitoring and Motion Alarm Monitoring, and defines it as "Monitoring events from motion detectors (e.g., passive IR, microwave, dual-technology) to detect presence or movement within protected areas." It sits under the Detect tactic as a child of Physical Access Monitoring (D3-PHAM). This short card covers what D3-MSM monitors, the sensor types, how the events should reach security operations, how to verify coverage and where it fails. Alarm panel and transmission security are covered in the Intrusion Alarm Systems Security Guide, which this card does not repeat.

Key takeaways

• Presence, not identity. A motion detector tells you something moved in a protected area; door controllers and cameras tell you who. D3-MSM is most useful correlated with both.
• No ATT&CK mapping. D3FEND lists no ATT&CK technique relationship for D3-MSM; its value is detecting physical intrusion that precedes or enables cyber attack.
• Tuning is part of the control. D3FEND's considerations name sensitivity and pulse-count settings, cross-zoning, and HVAC airflow and rapid thermal changes as the levers that balance detection against false alarms.
• Supervision signals matter as much as motion. Tamper, supervision, wireless check-in and battery events show when a sensor has stopped protecting the room.
• Walk tests prove coverage. D3FEND recommends regular walk tests; without them a masked or misaligned sensor looks the same as a quiet room.

D3-MSM at a glance

How it works

D3FEND's knowledge base article describes the flow: motion sensors generate events when movement is detected in their coverage pattern; alarm panels or PACS correlate motion with arming schedules, door openings and other sensors; and video systems can use motion to start recording or add bookmarks.

ATT&CK relationship

D3FEND lists no ATT&CK technique, inferred or direct, for D3-MSM (D3FEND 1.6.0, checked November 2026). The technique does not observe a digital artefact that ATT&CK techniques act on. Its security value is upstream: physical entry to a server room or comms cabinet is how an attacker reaches console ports, removable media and network ports without touching the network perimeter. Treat D3-MSM alerts in sensitive technology spaces as potential precursors to cyber intrusion and correlate them with host and network events from the same room.

Where it is implemented

Implementation steps

1. Identify the protected areas. List data halls, server rooms, comms rooms and cabinets, and decide which need motion detection in addition to door monitoring.
2. Choose and place sensors. Follow D3FEND's considerations: correct height and angle, clear line of sight, no obstructions or reflective surfaces, and attention to HVAC airflow, which is common in server rooms.
3. Tune. Set sensitivity and pulse-count per sensor, and use cross-zoning (two sensors must agree) where false alarms are a problem.
4. Integrate. Link motion with door position switches, badge events and cameras so a motion alarm arrives with context. Decide which events also go to the SOC.
5. Monitor the sensors themselves. Alert on tamper and supervision failures, missed wireless check-ins and low batteries.
6. Pilot and walk test. Commission one room, walk test every sensor, record the coverage, then extend.
7. Roll back. If a sensor causes repeated false alarms, re-aim or re-tune it, or put it into a temporary bypass with a logged expiry date, rather than disarming the zone.

How to verify it works

• Walk tests: on a fixed schedule and after any room change, walk the coverage pattern of each sensor, including slow movement and the edges of the pattern, and confirm events reach the panel, the PACS and, where integrated, the SIEM.
• Supervision check: confirm that a removed or tampered sensor raises an alarm, and that wireless devices report check-ins and battery levels.
• Correlation test: enter a protected room through a door held open (with approval) and confirm the motion-without-badge rule fires.

Limits, bypasses and failure patterns

• Disarmed during working hours: many rooms are only armed at night, so daytime tailgating relies on door and camera monitoring instead.
• Masked or blocked sensors: new racks, cable trays or stored equipment block line of sight. Walk test after every room change.
• Environmental false alarms: HVAC airflow and thermal changes lead to permanent bypasses that nobody reviews.
• Dual-technology trade-off: fewer false alarms, but defeating one technology can defeat the device.
• Supervision ignored: tamper and low-battery events are treated as maintenance tickets, not security events.
• Alarm system not secured: panels, communicators and installer access are part of the attack surface; see the Intrusion Alarm Systems Security Guide.

Framework mapping

Practitioner checklist

• List every technology space that needs motion detection as well as door monitoring.
• Place sensors for clear line of sight and away from HVAC outlets and reflective surfaces.
• Tune sensitivity and pulse-count, and use cross-zoning where needed.
• Correlate motion with door position, badge and camera events.
• Alert on tamper, supervision, check-in and battery failures.
• Walk test every sensor on schedule and after room changes.
• Give every bypassed zone a reason, an owner and an expiry date.

Standards and references

• MITRE D3FEND: Motion Sensor Monitoring (D3-MSM)
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls (PE-6)
• Wikipedia: Passive infrared sensor (D3FEND reference)
• Wikipedia: Motion detector (D3FEND reference)

Related NHI Mgmt Group resources: MITRE D3FEND Guide · Physical Security Guide for Security Teams · Intrusion Alarm Systems Security Guide · Physical Access Control Systems Security Guide