| name | implementing-diamond-model-analysis |
| description | The Diamond Model of Intrusion Analysis provides a structured framework for analyzing cyber intrusions by examining four core features - Adversary, Capability, Infrastructure, and Victim. This skill covers implementing the Diamond Model programmatically to classify and correlate intrusion events, build activity threads, and generate pivot-ready intelligence. |
| domain | cybersecurity |
| subdomain | threat-intelligence |
| tags | ["threat-intelligence","cti","ioc","mitre-attack","stix","diamond-model","intrusion-analysis"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"] |
Implementing Diamond Model Analysis
Overview
The Diamond Model of Intrusion Analysis provides a structured framework for analyzing cyber intrusions by examining four core features: Adversary, Capability, Infrastructure, and Victim. This skill covers implementing the Diamond Model programmatically to classify and correlate intrusion events, build activity threads linking related events, create activity-attack graphs, and generate pivot-ready intelligence from intrusion data.
When to Use
- When deploying or configuring implementing diamond model analysis capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Common Misconfigurations & Verification
- Empty core features break pivots: events missing one of the four vertices (Adversary/Capability/Infrastructure/Victim) silently drop out of
find_pivots(), which only pivots on non-empty fields. Validate every DiamondEvent populates all four before adding it.
- Unnormalized infrastructure values:
1.2.3.4, 1.2.3.4:443, and hxxp://1.2.3.4 are treated as distinct infrastructure nodes, so shared-infra pivots are missed. Canonicalize values before graphing.
- Timestamp format drift:
build_activity_thread() sorts lexically on the timestamp string - mixed formats (epoch vs ISO-8601) corrupt thread ordering. Enforce UTC ISO-8601.
- Capability not mapped to ATT&CK: leaving
mitre_techniques empty prevents cross-event capability correlation and ATT&CK-based clustering of activity groups.
- Over-merging activity groups: clustering threads on shared infrastructure alone (CDN, shared host) creates false activity groups - require a capability or adversary pivot as well.
- Verification: confirm pivot output groups only events with >1 shared value, render the activity-attack graph and check edges are chronological, and verify each event resolves to valid ATT&CK technique IDs.
Prerequisites
- Python 3.9+ with
networkx, stix2, graphviz libraries
- Understanding of the Diamond Model core and meta-features
- Access to threat intelligence data (MISP/OpenCTI events)
- Familiarity with MITRE ATT&CK for capability mapping
