The Diamond Model of Intrusion Analysis: A CTI Analyst’s Guide to Structured Threat Analysis

Introduction

Every intrusion event has four core features: an Adversary, a Capability, Infrastructure, and a Victim. That is the Diamond Model – deceptively simple, and the most powerful structured analysis tool I use. When an alert fires in the SOC, the Diamond Model gives you a framework for asking the right questions. When an investigation stalls, it shows you exactly what you are missing.

I learned the Diamond Model from its original authors at the Center for Cyber Intelligence Analysis and Threat Research, and I have applied it to hundreds of intrusion analyses since. This guide walks through how to use it in daily CTI work – not the academic theory, but the practical application that saves hours during investigations and reveals connections you would otherwise miss.

For the infrastructure mapping techniques that flow from Diamond Model analysis, see the pivot analysis guide. For building adversary profiles from Diamond Model outputs, the CTI Capability Maturity Model provides the strategic framework.

The Four Nodes and Six Edges: How the Diamond Model Structures an Intrusion

The Diamond Model has four nodes connected by six edges. Each node is a feature of the intrusion event. Each edge represents a relationship between two features. Mapping an event onto the diamond forces you to document what you know and – more importantly – what you do not know.

Adversary: Who is responsible? This might be a named threat actor group like APT29, a broader category like “financially motivated cybercrime,” or an unknown entity. Document what you know about their motivation, their known targets, and their historical TTPs. If the adversary is unknown, that is a gap. Write it down.

Capability: What tool or technique did they use? This could be a specific malware family, a phishing kit, an exploit, or a technique like credential dumping. The capability node connects to the adversary – this actor is known to use this tool – and to the victim – this tool was deployed against this target. Document the capability in as much detail as you have. A file hash alone is weak. A file hash plus behavioural analysis plus MITRE ATT&CK mapping is strong.

Infrastructure: What did they use to deliver the capability or control the victim? IP addresses, domain names, email servers, C2 channels. The infrastructure node connects to both the adversary – this actor controls this infrastructure – and the victim – this infrastructure communicated with this target. This is where pivot analysis generates the most value. Every infrastructure element is a potential pivot point to uncover more of the adversary’s operation.

Victim: Who was targeted? Document the organisation, the specific systems or users affected, the data that was accessed or exfiltrated, and the impact. The victim node is where the Diamond Model connects to your organisation’s risk assessment. A victim in your sector with your technology stack is a higher priority than a victim in an unrelated industry.

Using the Diamond Model During an Active Investigation

The Diamond Model is not a post-incident documentation tool. It is an active investigation framework. When a new alert fires, I draw the diamond immediately – literally on a whiteboard or in a note – and populate the nodes with what I know. The gaps become immediately visible, and each gap is a collection requirement.

If I know the infrastructure and the capability but not the adversary, my next step is clear: research which threat actors use this capability and this infrastructure. If I know the adversary and the victim but not the capability, I need to analyse the malware or review endpoint telemetry. The diamond tells you what to do next. It transforms an investigation from “figure out what happened” into a structured sequence of collection tasks.

Cross-event pivoting. The Diamond Model’s real power emerges when you map multiple events and look for connections between diamonds. An adversary using the same infrastructure across two victims creates a link between those diamonds. A capability observed across multiple adversaries suggests tool sharing or false flag operations. A victim targeted by the same infrastructure across multiple events reveals a persistent campaign. These cross-diamond connections are what turn individual incident analyses into strategic intelligence. The pivot analysis guide covers the technical techniques for tracing these connections through infrastructure data.

Build the habit. Every time an alert fires, sketch the diamond. It takes sixty seconds. It will save you hours of directionless investigation. After a hundred diamonds, you will start seeing patterns across events that no dashboard can show you – because you have structured the data in a way that reveals connections, not just counts. For the next step, the threat actor profiling guide shows how Diamond Model outputs feed directly into adversary profiles.