Diamond Model of Intrusion Analysis.

The Diamond Model of Intrusion Analysis, introduced by Sergio Caltagirone, Andrew Pendergast, and Christopher Betz in a 2013 paper for the Center for Cyber Intelligence Analysis and Threat Research, represents each malicious event as a diamond connecting four core features: Adversary, Capability (tooling, malware, TTPs), Infrastructure (IPs, domains, C2), and Victim. Meta-features such as timestamp, phase, result, direction, methodology, and resources enrich each event.

Pivoting and analytic use

The model's power is the pivot: any known vertex can be used to discover others. From a single malware hash (capability) an analyst can find every victim it touched; from one C2 domain (infrastructure), the registrant email that ties it to other domains; from victimology, the likely adversary intent. Chaining diamonds across the Cyber Kill Chain produces an activity thread, and grouping threads that share features yields an activity group — the discipline behind vendor clusters such as CrowdStrike's "BEAR"/"PANDA" naming or Microsoft's "typhoon" families.

Because it separates who (adversary) from what (capability) and where (infrastructure), the Diamond Model pairs naturally with MITRE ATT&CK (which enumerates the how) and structured formats like STIX, letting a SOC express a hypothesis as testable relationships rather than a flat list of IOCs. This is why it anchors pivoting workflows in threat-intelligence platforms and formal intrusion-analysis reports.

flowchart TD
  A[Adversary] ---|develops| C[Capability]
  A ---|controls| I[Infrastructure]
  C ---|deployed via| I
  C ---|used against| V[Victim]
  I ---|connects to| V
  A -.-|targets| V
  subgraph Pivots
    direction LR
    P1[Hash to other victims]
    P2[Domain to registrant to more domains]
    P3[Victimology to adversary intent]
  end