diamond-model-ana

name	diamond-model-ana
description	The Diamond Model of Intrusion Analysis provides a structured framework for analyzing cyber intrusions by examining four core features - Adversary, Capability, Infrastructure, and Victim. This skill covers implementing the Diamond Model programmatically to classify and correlate intrusion events, build activity threads, and generate pivot-ready intelligence.
domain	cybersecurity
subdomain	threat-intelligence
tags	["threat-intelligence","cti","ioc","mitre-attack","stix","diamond-model","intrusion-analysis"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]

Implementing Diamond Model Analysis

Overview

The Diamond Model of Intrusion Analysis provides a structured framework for analyzing cyber intrusions by examining four core features: Adversary, Capability, Infrastructure, and Victim. This skill covers implementing the Diamond Model programmatically to classify and correlate intrusion events, build activity threads linking related events, create activity-attack graphs, and generate pivot-ready intelligence from intrusion data.

When to Use

• When deploying or configuring implementing diamond model analysis capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Python 3.9+ with networkx, stix2, graphviz libraries
• Understanding of the Diamond Model core and meta-features
• Access to threat intelligence data (MISP/OpenCTI events)
• Familiarity with MITRE ATT&CK for capability mapping

Key Concepts

Diamond Model Core Features

• Adversary: The threat actor or operator conducting the intrusion
• Capability: The tools, techniques, and malware used (maps to ATT&CK)
• Infrastructure: C2 servers, domains, email addresses, hosting providers
• Victim: Target organization, system, person, or data asset

Meta-Features

• Timestamp: When the event occurred
• Phase: Kill chain stage (recon, delivery, exploitation, etc.)
• Result: Success, failure, or unknown
• Direction: Adversary-to-infrastructure, infrastructure-to-victim, etc.
• Methodology: Social engineering, technical exploit, insider threat
• Resources: Financial, human, technical resources required

Activity Threads and Groups

• Activity Thread: Sequence of Diamond events from a single adversary operation
• Activity Group: Cluster of threads attributed to the same adversary

Workflow

Step 1: Define Diamond Event Data Structure

from dataclasses  dataclass, field
 datetime  datetime
 typing  
 json
 uuid


 :
    adversary:  = 
    capability:  = 
    infrastructure:  = 
    victim:  = 
    timestamp:  = 
    phase:  = 
    result:  = 
    direction:  = 
    methodology:  = 
    confidence:  = 
    notes:  = 
    event_id:  = field(default_factory=: (uuid.uuid4())[:])
    mitre_techniques:  = field(default_factory=)
    iocs:  = field(default_factory=)

     ():
         {
            : .event_id,
            : .adversary,
            : .capability,
            : .infrastructure,
            : .victim,
            : .timestamp,
            : .phase,
            : .result,
            : .direction,
            : .methodology,
            : .confidence,
            : .mitre_techniques,
            : .iocs,
            : .notes,
        }