{"ok":true,"contract":"shatteredcastles.dml.model.v1","name":"Detection Maturity Level","author":"Ryan Stillions","version":"Stillions-2014-original","published":"2014-04-21","suite":"ShatteredCastle(s)","levels":[{"level":0,"id":"DML-0","name":"None or Unknown","band":"unknown","description":"No demonstrated detection information or capability within the assessed scope."},{"level":1,"id":"DML-1","name":"Atomic Indicators","band":"evidence","description":"Detection based on atomic indicators such as hashes, IP addresses, domains, or similarly specific observables."},{"level":2,"id":"DML-2","name":"Host & Network Artifacts","band":"evidence","description":"Detection based on host or network artifacts and traces observed during or after activity."},{"level":3,"id":"DML-3","name":"Tools","band":"execution","description":"Detection of adversary tooling beyond individual atomic indicators or minor artifacts."},{"level":4,"id":"DML-4","name":"Procedures","band":"execution","description":"Detection of specific procedures or sequences used to implement techniques."},{"level":5,"id":"DML-5","name":"Techniques","band":"execution","description":"Detection at the adversary technique level."},{"level":6,"id":"DML-6","name":"Tactics","band":"execution","description":"Detection at the adversary tactic or broader behavioral-goal level."},{"level":7,"id":"DML-7","name":"Strategy","band":"intent","description":"Detection or intelligence-driven recognition of adversary strategy."},{"level":8,"id":"DML-8","name":"Goals","band":"intent","description":"Detection or intelligence-driven recognition of adversary goals or desired end state."}],"semantics":{"original_levels_0_through_8":true,"later_identity_extension_excluded":true,"maturity_is_ability_to_consume_and_act_on_threat_information":true,"detection_not_prevention":true,"higher_level_is_more_semantically_abstract":true,"level_is_not_severity":true,"level_is_not_coverage_percentage":true,"one_detection_does_not_establish_organization_wide_maturity":true,"no_automatic_attribution":true,"no_automatic_level_from_free_text":true,"no_automatic_level_from_attack_label":true},"composition":{"attack":{"contract":"shatteredcastles.attack.model.v1","role":"adversary behavior","bridge":"semantic-candidate-only"},"pyramid":{"contract":"shatteredcastles.pyramid.model.v1","role":"observable replacement burden","bridge":"semantic-candidate-only"},"dml":{"role":"detection semantic abstraction and evidence-backed maturity"}},"model_digest_sha256":"8a700d26790908acb9b268a6340d2fc8c8d5be26e84b030c72ce4b417ed11be9","actions":["model","normalize_detection","assessment","semantic_bridge","compose"]}