Executing Diamond Model Analysis

When to Use

Use this skill when:

• Analyzing a confirmed intrusion to understand the complete adversary-capability-infrastructure-victim relationship
• Attempting to link two or more incidents to a common threat actor using shared infrastructure or capability indicators
• Structuring a finished intelligence product that explains adversary behavior in a formal analytic framework

Do not use this skill during active incident containment — Diamond Model analysis is a post-event or concurrent intelligence activity, not a response procedure.

Prerequisites

• Completed incident investigation data: logs, forensic artifacts, malware samples, network captures
• Access to MITRE ATT&CK, VirusTotal, Shodan, and passive DNS databases for vertex enrichment
• Link analysis platform (Maltego, Analyst's Notebook, or graph database like Neo4j) for multi-event correlation
• Familiarity with the original Diamond Model paper: Caltagirone, Pendergast, Betz (2013)

Workflow