The Diamond Model of intrusion analysis
The Diamond Model exists to make pivoting explicit. Its four vertices are not a taxonomy to recite — they are the four places you can be standing when you ask "what else touches this?"
Published in 2013 by Caltagirone, Pendergast and Betz, the Diamond Model describes any intrusion event as a relationship between four core features. Its practical value is not classification. It is that it makes pivoting a deliberate, auditable act instead of an intuition.
The four core features
| Vertex | What it holds | Typical pivot from it |
|---|---|---|
| Adversary | The operator, and separately the customer or sponsor behind them | Other activity attributed to the same cluster; personas, handles, forum accounts |
| Capability | Malware, exploits, tooling, tradecraft | Code overlap, YARA hits, shared builders, configuration patterns |
| Infrastructure | C2 servers, domains, email accounts, redirectors, hosting | Passive DNS, certificate reuse, registrar and hosting patterns, JARM/TLS fingerprints |
| Victim | The target organisation, and the specific assets or people hit | Sector and geography patterns, other victims sharing a targeting profile |
An event is one adversary using one capability over some infrastructure against one victim. Real intrusions are chains of these, and the model's power is that any vertex you have evidence for is a place to start looking for the ones you do not.
Meta-features
Each event also carries meta-features: timestamp, phase, result, direction, methodology and resources. Phase is what lets you thread events into an activity thread — a kill-chain-ordered sequence of diamonds describing one intrusion. Threading is where the model stops being a diagram and starts being analysis.
The original paper also describes two axes across the diamond: the social-political axis (the adversary's intent and the victim's value to them) and the technology axis (the capability and infrastructure that connect them). Interviewers who know the model well sometimes probe here, because it is the part that gets skipped.
Using it in an answer
Given a single C2 IP address, a weak answer names the vertices. A strong answer pivots out loud:
- Infrastructure → capability. What samples have beaconed to this address? Do they share a configuration or a builder?
- Infrastructure → infrastructure. What domains resolved here, and when? Does certificate transparency or a TLS fingerprint tie it to other hosts?
- Infrastructure → victim. Who else in our telemetry, or in public reporting, has contacted it? Does a sector pattern emerge?
- Capability → adversary. Only now, and only tentatively, does clustering toward a known intrusion set become reasonable.
Treating infrastructure overlap as adversary identity. Shared hosting, bulletproof providers, compromised third-party servers and commodity VPS ranges produce overlaps between wholly unrelated actors constantly. State the overlap as an observation, then say what would raise it above coincidence.
How it relates to the other models
- The kill chain gives you sequence. The Diamond gives you relationships. They compose: an activity thread is diamonds ordered by kill-chain phase.
- ATT&CK is the vocabulary for the capability and methodology detail inside a diamond.
- The Pyramid of Pain tells you which of your pivots produce durable findings. Infrastructure pivots are cheap for the adversary to invalidate; capability and methodology pivots are not.
Run a mock interview on this material. You get the question, a graded response against a vetted rubric, and the probing follow-up an interviewer would ask next.
Related reading
- MITRE ATT&CK for CTI analysts ATT&CK is a knowledge base of adversary behaviour organised by tactic and technique. Most candidates can recite that. Fewer can map an ambiguous artefact correctly, or explain what a heat map does not tell you.
- The Cyber Kill Chain A 2011 model that is still the clearest way to talk about intrusion sequence and defensive coverage — provided you can also say where its linear assumption fails.
- The intelligence cycle and F3EAD Every intelligence failure in a CTI team traces back to the first step. If nobody can state the requirement, everything downstream is expensive noise.
- STIX, TAXII and TLP STIX is the data model, TAXII is the transport, TLP is the handling rule. Mixing these up is a common and very visible interview error.