Diamond Model of Intrusion Analysis.

An intrusion analysis framework that ties every malicious event to four linked vertices: adversary, capability, infrastructure, and victim. It belongs to the Defense & Operations category of cybersecurity.

An intrusion analysis framework that ties every malicious event to four linked vertices: adversary, capability, infrastructure, and victim.

The Diamond Model of Intrusion Analysis, introduced by Caltagirone, Pendergast, and Betz in 2013, represents each malicious event as a diamond connecting four core features: Adversary, Capability (tooling, malware, TTPs), Infrastructure (IPs, domains, C2), and Victim. Meta-features such as timestamp, phase, result, direction, methodology, and resources enrich each event. Analysts pivot across vertices to enumerate related activity — for example, from a domain to other domains the same adversary registered, or from a capability hash to other victims it has touched. The model complements MITRE ATT&CK and the Cyber Kill Chain by making relationships explicit, and is widely used in threat intelligence platforms, intrusion-analysis reports, and structured pivoting workflows.

Defences for Diamond Model of Intrusion Analysis typically combine technical controls and operational practices, as detailed in the full definition above.