ModelD3-NTPM
Network Traffic Policy Mapping
Also called: IPS Policy Mapping, Web Security Gateway Policy Mapping, Firewall Mapping, DLP Policy Mapping
Definition
Network traffic policy mapping identifies and models the allowed pathways of data at the network, transport, and/or application levels.
- D3FEND ID
- D3-NTPM
- Tactic
- Model
- Certification relevance
- CISSPCISMSecurity+
ATT&CK techniques it counters
7 techniques, 16 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.
- T1134Access Token Manipulation
- T1222File and Directory Permissions Modification
- T1484Domain or Tenant Policy Modification
- T1548Abuse Elevation Control Mechanism
- T1552Unsecured Credentials
- T1556Modify Authentication Process
- T1615Group Policy Discovery
Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.
Across MITRE's defensive frameworks
Linked through the 7 ATT&CK techniques above.
Detect with CAR
MITRE CAR analytics that cover the same ATT&CK techniques.