Intelligence
What is Diamond Model?
A model giving every intrusion event four features, adversary, capability, infrastructure and victim, so knowing one gives you a route to the others.
The Diamond Model of Intrusion Analysis describes every intrusion event with four connected features: adversary, capability, infrastructure and victim. It was published in 2013 by Sergio Caltagirone, Andrew Pendergast and Christopher Betz.
Its practical value is pivoting. Knowing one corner gives you a route to the others: an infrastructure node leads to the capability deployed from it, which leads to other victims, which can lead back to the adversary.