Story condition
A discrete, evidence-bounded Prologue condition and the authority it supplied.
ATTACK STORIES · THREAT-INFORMED DEFENSE
Defender Intelligence is the reusable control layer.
Attack Stories establish the conditions. Defender Intelligence classifies those conditions as durable privilege exposures. NIST protection objectives belong to that shared DI layer, while each story retains its own ATT&CK adjudication—so new stories can inherit control candidates without inheriting behavior claims from another case.
Research lineage
Map the intelligence once. Let every story inherit it.
The MITRE Center for Threat-Informed Defense Mappings Explorer connects protection capabilities to adversary behavior. Privilege Disruption adds a durable environmental layer: stories anchor to Defender Intelligence, and DI owns the typed ATT&CK and NIST relationships.
Defender Intelligence
The IoPE classifies the durable exposure; related WoPEs identify warning patterns.
DI ATT&CK association
Cross-case behaviors the exposure can enable or supply. These stay in the DI register and are never inherited as story behavior.
NIST protection candidate
The control objectives that govern, prevent, constrain, detect, or retire the DI exposure. Story inheritance remains unvalidated until separately reviewed.
“Taking a threat-informed defense approach that connects defender intelligence to protection capabilities codified the notion of building security in.”
Federal Cyber Defense Specialist
“Privilege management is no longer merely an administrative IT control. It is a construct for cyber defense, as these mappings demonstrate and as the prevalence of privilege across cyberattacks in the wild makes clear.”
Kevin E. Greene
Primary references: CTID Mappings Explorer · MITRE ATT&CK · NIST SP 800-53 Rev. 5
Eleven-story coverage register
All eleven stories inherit through one DI model.
The inheritance unit is the Prologue condition—not the story release. Seventy-four of 80 conditions have a catalogued DI anchor. Six conditions remain explicit no-anchor outcomes after importing all 29 admitted EA pairs from the frozen R2.6 register; none receives a manufactured control relationship.
DI inherited pathExplicit no-anchor boundary
Layer 1 · Computed story inheritance
Story condition → DI → inherited NIST candidates.
These paths are computed from the Story→DI adjudication and the canonical DI register. Adding a story does not create a new control map. ATT&CK remains governed by each story's own adjudication and is not inherited through this view.
Layer 2 · Canonical Defender Intelligence register
The mappings belong to the exposure—not the story.
All 23 IoPEs carry candidate NIST control objectives. DI ATT&CK associations are cross-case exposure intelligence and remain here. Fifteen IoPEs preserve validation-seed provenance; eight—including EA05, whose former seed depended on rejected anchors—are explicitly labeled DI-direct candidates.
Inherited control heat map
Which DI protection objectives recur across stories?
Cells count story conditions displaying each inherited NIST candidate through a DI anchor. Frequency is not validation, importance, implementation, or compliance.
Validation seed · preserved provenance
The five-story corpus seeded DI; it no longer limits coverage.
The validated R2.3 story corpus remains unchanged and auditable. Its admitted control relationships were lifted to the matching DI exposures. New and future stories inherit those relationships through DI instead of becoming new mapping silos.