Knowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search courses, individual lessons, wiki entries, books, podcasts, magazine articles, Daily Cyber News, and Darwin.

MITRE D3FEND™ Learning Center

D3-PUM — Platform Uptime Monitoring

Monitor the amount of time since the last power cycle or restart.

1Parent technique
1Related artifact
1Source reference

Detect · D3FEND ontology 1.6.0 · Active

Open official technique ↗
Official D3FEND definition

Definition

Monitor the amount of time since the last power cycle or restart.

Official D3FEND knowledge-base content

How it works

Monitoring the time since the last power cycle or restart alerts operators to unexpected restarts and their frequency. This can indicate potential issues or malicious activity, and provides valuable information for forensic investigations.

Considerations

The source of the variable may be mutable depending on the platform, and the provenance of the value.

Bare Metal Cyber interpretation

Implementation perspective

Platform Uptime Monitoring should be treated as a technical defensive capability rather than a product checkbox. In practice, teams should define the protected scope, the conditions under which the technique acts, and the observable evidence that demonstrates the intended behavior. For this technique, likely engineering context includes the relevant system, activity, and evidence sources.

Use the technique to identify suspicious, unauthorized, or abnormal activity through observable evidence and repeatable analysis.

Questions to ask

  • Which events, states, or artifacts must be observed for the analysis to work?
  • What analytic logic, threshold, comparison, or signature turns observations into a finding?
  • How are expected false positives, blind spots, and environmental variations documented?
  • Who receives the result, and what action is expected when the technique produces a finding?

Evidence and validation

  • Telemetry and data-source configuration records
  • Analytic logic, thresholds, signatures, and version history
  • Test cases demonstrating expected positive and negative results
  • Alert, triage, escalation, and tuning records

Common failure patterns

  • Required telemetry is missing, delayed, or transformed in a way that invalidates the analysis.
  • The technique produces alerts without an accountable triage and response process.
  • Detection coverage is claimed from product deployment without testing the relevant analytic behavior.

This implementation perspective is original Bare Metal Cyber educational content. It does not replace the official D3FEND definition or establish that a specific product implements the technique.

Ontology hierarchy

Technique hierarchy

Parent techniques

Direct child techniques

None listed at this level.

D3FEND graph relationships

Artifacts and ontology entities

These relationships describe how D3FEND connects a defensive technique to artifacts or other ontology entities. They describe graph semantics, not a product certification.

Explicit technique relationships

monitorsPlatform Uptime
Source record

Authoritative sources