D3-PLLM: Passive Logical Link Mapping

MITRE D3FEND countermeasure

What it does

Passive logical link mapping only listens to network traffic as a means to map the the whole data link layer, where the links represent logical data flows rather than physical connections.

Attacks this counters

No ATT&CK technique in this corpus maps to this countermeasure. D3FEND may map it to techniques outside the Enterprise matrix, or to ones MITRE has since revoked — absence here is about this corpus, not about the countermeasure.

Source

• MITRE D3FEND D3-PLLM