thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Diamond Model of Intrusion Analysis

An analytic model describing every intrusion event by four core features: adversary, capability, infrastructure and victim.

Definition

The Diamond Model links the four vertices by relationships, so analysts can pivot from one feature to discover others, for example from infrastructure to other victims. Meta-features include timestamp, phase, result, direction, methodology and resources. Events chain into activity threads.

Example

Pivoting from a C2 domain (infrastructure) to find other malware samples (capability) that use it.

Exam tip

Know the four vertices: adversary, capability, infrastructure, victim.

Related terms