Reference · development snapshot
Connect the model to existing frameworks
Proposed crosswalks relate Maneuver Calculus concepts to public security catalogs while preserving their definitions, versions and unresolved mapping questions.
Maneuver Calculus is framework-neutral. Its intended alignment layer relates MC concepts
to public threat-informed frameworks through
SKOS mapping — exactMatch, closeMatch,
relatedMatch — never by owl:equivalentClass, never by subclassing
into another taxonomy. The correspondences below are explanatory proposals. Their concrete
predicate bindings and machine-readable publication remain to be verified.
Foundations and related work
The linked research source list identifies the authors, dates and primary sources behind the concepts compared here. It distinguishes foundations and related work from case intelligence and development tests. These are conceptual relationships, not claims of direct historical influence or validated equivalence.
The ATT&CK crosswalk below retains its historical v19.2 pin. MITRE's version history identifies v20.0 from 13 October 2026. No mapping migration is made by this editorial revision.
The integration matrix
These are provisional correspondences for an intended alignment graph separate from the core. The proposed relation is exact for conceptual identity, close for near correspondence, and related for concepts that make different cuts. A proposed strength is not a published machine-readable mapping. External identifiers continue to identify entries in their source catalogs; their MC predicate bindings remain unverified.
| Maneuver Calculus | Framework | Proposed relation | Note |
|---|---|---|---|
| Robustness L1–L5 | StP Levels 1–5 | version-specific comparison with StP v4.0.0 remains open | |
| spanning / discriminating | StP observable roles | the selected MC distinction is retained; current StP terminology and relation strength need comparison | |
| robustness level | Analytic Robustness Level | a related measurement concern; equivalence across versions is not established |
In the selected MC specification, robustness is derived from observable grounding. An attested grade is retained alongside it as a separate statement. The comparison with StP v4.0.0 and empirical validation remain open.
| Maneuver Calculus | Framework | Proposed relation | Note |
|---|---|---|---|
| Objectives | Tactics (TA0001 · TA0006 · TA0010 · TA0040) | exact | proposed correspondence for catalog labels; the objective is carried as an annotation and is not consulted for maneuver identity |
| Defense impairment | Defense Impairment (TA0112) | closeMatch | provisional correspondence; the technique-scope comparison remains open |
| Maneuver | Techniques | many-to-many correspondence; external technique identifiers retain their ATT&CK identities, with concrete MC predicate bindings unverified | |
| Actor · Campaign | Groups · Campaigns | close | attribution layer |
Connections among MC tools, maneuver records, implementation variants, and ATT&CK software or procedure descriptions remain under discussion. An implementation variant is a whole maneuver record considered as a class member; a Tool is separate and can realize a maneuver. Several connections may be relevant. Their scope, relation types, and any concept-mapping strengths need to be established before a replacement correspondence is listed.
| Maneuver Calculus | Framework | Proposed relation | Note |
|---|---|---|---|
| Defender maneuver | Defensive Technique | MC types a defense by (locus, function); D3FEND by a tactic/technique tree — a different cut | |
| Observable | Digital Artifact | epistemic (telemetry-visible) versus ontic (exists unobserved) — not equivalent | |
| counters | counters | close | MC also pins the (locus, function) cell of the counter |
| Investigation | Model tactic · analysis | belief-writing actions, distinct from prevent/detect/react | |
| Invariant core | Offensive Technique | the identity-bearing requirements a defense is keyed against: invariant precondition, invariant mechanism, and required effect |
| Maneuver Calculus | Framework | Proposed relation | Note |
|---|---|---|---|
| Investigative question | Question | exact | the same unit — "what do we need to determine?" |
| Catalog reference | DFIQ identifier | close | an external identifier retains its catalog identity; the concrete MC predicate binding remains unverified |
| Investigation | Approach | one-to-many — many approaches answer one question | |
| answers | answersQuestion | close | the resolution relation |
The intended MC investigation layer derives a question from a discriminating variable: the (role, variable) where surviving reconstruction hypotheses disagree. A matching DFIQ question can supply a catalog reference; the concrete binding remains to be verified.
What the calculus adds
The proposed contribution is a connected account of procedure-level structure, observables, defenses, and investigation. In the selected MC specification, a maneuver record is identified by what it structurally requires; an invariant core identifies a class through its stripped triple. An objective is carried as an annotation and is not consulted for identity. Robustness is derived from grounding, with an attested grade retained separately. Observables remain distinct from the artifacts that produce them, while telemetry sourcing and detection health inform defensive coverage. The intended investigation layer generates questions from disagreement among surviving hypotheses. These are the concepts the alignment layer is intended to relate to the public catalogs.