d3fend-restore

Guides cybersecurity restoration using MITRE D3FEND—recovering access, objects, configurations, and systems after incidents. Covers credential reissuance, account unlocking, file restoration, database recovery, configuration rebuild, and software reinstallation. Use after incident containment for business continuity, disaster recovery, and return to normal operations—not for incident containment (d3fend-evict), detection (d3fend-detect), or hardening (d3fend-harden).