D2 Team CORP · Workforce DevelopmentFull Spectrum Space Cybersecurity Professional · One-pager 2 of 2 · front

METEORSTORM

One data model for the platform, the adversary and the response.

The method
MISP taxonomy v2
d2teamcorp.org

meteorstorm · Multiple Environment Threat Evaluation of Resources Space Threats and Operational Risk to Missions: a taxonomy for modeling space, cyber, and multi-domain threats and resilience across five layers. Published in the MISP taxonomy repository, version 2, October 2025.

The METEORSTORM data model: taxonomic elements in four structural layers

Figure 1. Every component of a platform in scope is recorded as exactly one enumerated element, in one of these four layers, and every element names its parent. Hover an element for its published definition.

1Five functions, run in order

F01	Concept of Operations	Decompose the platform tailored to your requirements.	PCE SEG SVC AST
F02	Contextualized Threat Modeling	Anchor every threat to the platform you just decomposed.	AN-THR
F03	Converged Detection Engineering	Enumerate attack paths and the data and signals needed to detect each step.	AN-ATT
F04	Incident Response Preparation	Write the detection signatures and the response playbooks.	AN-DET
F05	Adversary Management	Shrink the attack surface the threats keep using.	AN-RES

2One model, every environment

METEORSTORM covers the ground, user, link, and space segments, and also the aquatic, aerial, and deep space environments. When a merger, an acquisition, or a new market strategy takes your organization toward cislunar, maritime, or drone operations, your staff and your data model come with you: no expensive re-upskilling, no framework migration.

And you do not have to choose METEORSTORM over other frameworks: the analytic layer normalizes past, present, and future frameworks into the same standardized taxonomy and ontology, without building a new taxonomy for each. The reverse shows the layer and the frameworks it normalizes today.

D2 Team CORP · Workforce DevelopmentFull Spectrum Space Cybersecurity Professional · One-pager 2 of 2 · reverse

The Analytic layer

What the analyst knows about the platform, in a form every participating organization reads identically.

METEORSTORM
Layer 5 · AN

3Six elements, three target fields

Figure 2. Six elements, three target fields, one destination. Read left to right, they answer the questions an analyst asks as a situation unfolds. Every entry declares its SOURCE before enumeration: observable, or synthetic.

4What METEORSTORM normalizes: the Analytics Catalog

Table 1. The frameworks and intelligence feeds METEORSTORM normalizes, and the analytic elements each normalizes into; recommendations, not restrictions. METEORSTORM does not replace these frameworks or compete with them: their content normalizes into the same six elements.

5Naming one real instance: the ETEN

LAYERSEGTAGGRLABELGroundORDINAL00DESCRIPTIONwhat it is, where it is, what role it plays

Tags come from the published list, never invented. Ordinals start at 00 and are never re-used. One identifier carries exactly one description, everywhere it appears.

6Machine-readable from day one

The data model is a published taxonomy in the MISP taxonomy repository, namespace meteorstorm, version 2, integrated in October 2025. A partner’s threat intelligence platform reads the tags unchanged, so findings move machine to machine in one shared vocabulary.