MITRE D3FENDdefensive technique
D3-MSM Motion Sensor Monitoring
- Tactic
- Detect
- Synonyms
- Motion Alarm Monitoring, Motion Detector Monitoring
Definition
Monitoring events from motion detectors (e.g., passive IR, microwave, dual-technology) to detect presence or movement within protected areas.
How it works
How it works
Motion sensors generate events when movement is detected within their coverage pattern. Alarm panels or PACS correlate motion with arming schedules, door openings, and other sensors; video systems can use motion to trigger recording or bookmarks. Cross-zoning and sensitivity/pulse-count settings are commonly adjusted to balance detection and false-alarm rates.
Considerations
• Place sensors at appropriate height and angle with clear line of sight, avoiding obstructions or reflective surfaces that can cause missed or false detections.
• Reduce false alarms by tuning sensitivity and pulse-count, using cross-zoning when needed, and accounting for HVAC airflow or rapid thermal changes.
• Monitor tamper and supervision signals; for wireless devices, verify periodic check-ins and battery levels; perform regular walk tests to validate coverage.
• Integrate motion events with cameras and with door position switches and other sensors in the protected area to provide context and faster verification; use motion to trigger recording or bookmarks.
Related
Child of · MITRE D3FEND (1)
- D3-PHAM Physical Access Monitoring defensive technique
References
- https://doi.org/10.6028/NIST.SP.800-53r5 NIST Special Publication 800-53 Revision 5 - Security and Privacy Controls for Information Systems and Organizations
- https://en.wikipedia.org/wiki/Motion_detector Motion detector
- https://en.wikipedia.org/wiki/Passive_infrared_sensor Passive infrared sensor