---

name: d3fend-restore description: | Guides cybersecurity restoration using MITRE D3FEND—recovering access, objects, configurations, and systems after incidents. Covers credential reissuance, account unlocking, file restoration, database recovery, configuration rebuild, and software reinstallation. Use after incident containment for business continuity, disaster recovery, and return to normal operations—not for incident containment (d3fend-evict), detection (d3fend-detect), or hardening (d3fend-harden).

D3FEND — Restore

When to Use

• Restoring user access after incident containment (reissue credentials, unlock accounts)
• Recovering files, databases, and configurations from backup
• Rebuilding systems from disk images or clean baselines
• Restoring email and software after malware removal
• Validating restored systems before returning to production
• Documenting recovery actions for post-incident review

When NOT to Use

• Active incident containment or eviction → d3fend-evict
• Detection engineering or monitoring → d3fend-detect
• Hardening to prevent future incidents → d3fend-harden
• Backup strategy design → infrastructure-engineer
• Business continuity planning → cybersecurity

Core Workflows

1. Restore Access

Action	Steps
Reissue credential	Generate new token/cert/password; distribute securely
Unlock account	Verify identity; reset MFA if compromised
Restore network access	Re-enable firewall rules; verify no persistence
Restore user account access	Validate AD/Azure AD; check group memberships

See references/restore_access.md

2. Restore Objects

• Restore file (from backup, shadow copy, or clean source)
• Restore email (from archive or backup)
• Restore database (point-in-time recovery, transaction log replay)
• Restore disk image (bare metal restore, VM snapshot)
• Restore configuration (from version control or backup)

See references/restore_objects.md

3. Restore Software & Systems

• Reinstall software from trusted source
• Rebuild system from hardened gold image
• Verify integrity (hash check, signature validation)
• Re-apply patches and updates
• Re-run vulnerability scan before rejoining network

See references/restore_systems.md

When to load references

• Restore access → references/restore_access.md
• Restore objects → references/restore_objects.md
• Restore systems → references/restore_systems.md