The Diamond Model of intrusion analysis structures threat intelligence into four corners: adversary, infrastructure, capability, and victim. By mapping these elements and their connecting links, you transform isolated security alerts into a coherent narrative of the attack chain. This method helps you track how an attacker adapts when one path fails, allowing for more effective containment and long-term defense planning.
The Pizza Delivery Analogy
Imagine a sophisticated pizza delivery service. The adversary is the chef who decides the recipe. The infrastructure is the delivery van and the GPS system used to navigate. The capability is the specific oven technology that allows for faster cooking times. The victim is the customer who receives the pizza. If you only see the van, you miss the recipe change. If you only see the pizza, you miss the route optimization. You need all four points to understand the service model. This analogy carries through every aspect of the Diamond Model of intrusion analysis.
Defining the Four Corners
The model relies on four distinct elements that must be tracked simultaneously. The adversary represents the human or group behind the attack. This is not just a name, but a pattern of behavior and motivation. The infrastructure includes the servers, domains, and communication channels the adversary controls. This is the physical or digital footprint. The capability refers to the specific tools, exploits, or techniques used. This is the "how" of the attack. The victim is the target system or network. This includes the operating system, software versions, and network topology.
| Term | Plain meaning |
|---|---|
| Adversary | The human or group behind the attack, defined by behavior and goals. |
| Infrastructure | The servers, domains, and communication channels controlled by the attacker. |
| Capability | The specific tools, exploits, or techniques used to breach defenses. |
| Victim | The target system, including its OS, software, and network layout. |
| Links | The relationships connecting the four corners, such as tool-to-server mappings. |
| Campaign | A series of related attacks sharing the same infrastructure or capabilities. |
Connecting the Dots with Links
The power of the model lies in the links between corners. A link is a relationship that explains how one element connects to another. For example, a specific malicious script (capability) is hosted on a specific server (infrastructure). This link tells you that if you block the server, you stop that specific script. Another link might connect the adversary to multiple victims. This reveals a broad campaign rather than an isolated incident. Mapping these links prevents you from treating symptoms instead of the disease. It shifts your focus from single alerts to systemic risk.
Common Points of Confusion
Many analysts confuse capability with infrastructure. Capability is the software or method; infrastructure is where it lives. A phishing email is a capability. The mail server sending it is infrastructure. Another common error is treating the adversary as a static entity. Adversaries change tactics when blocked. If you block their primary server, they may switch to a new one. Your model must reflect this dynamism. Static models become outdated quickly. You must update the links as the adversary adapts. This requires continuous monitoring and analysis.
Integrating with Existing Workflows
This model enhances incident triage by providing structure to chaotic data. When you receive an alert, map it to the four corners immediately. Identify the tool used, the server it came from, the target system, and the likely group. This structure accelerates decision-making. It also feeds into threat actor profiling. By tracking how an adversary uses infrastructure across different victims, you build a clearer picture of their preferences and weaknesses. This profile helps predict future movements. You stop reacting and start anticipating.
See also: AS-REP Roasting: How Pre-Auth Bypass Steals Kerberos Tickets · What Is Incident Triage: A Field Manual for First Response
Handling Edge Cases and Complexity
Not every attack fits neatly into four boxes. Some attacks use process injection to hide within legitimate processes. In this case, the capability (injection technique) is linked to the victim’s process list, not just an external server. The infrastructure link might be weak or non-existent. You must still map what you know. Leave blank spaces for unknown elements. Do not force data that does not fit. The model is a framework, not a rigid box. It helps you see what is missing. If the infrastructure link is missing, that is a finding in itself. It suggests a sophisticated, low-footprint attack.
Practical Application Steps
Applying this model requires discipline. You must document each corner and link consistently. Use a simple spreadsheet or a dedicated threat intelligence platform. Do not rely on memory. Write down the IP addresses, file hashes, and system details. Update the record as you learn more. This creates a historical record that reveals trends over time. It also helps when you need to explain the incident to leadership. A clear map is easier to understand than a list of raw logs.
- Identify the victim system and its current state. Document OS, software, and network position.
- Map the infrastructure. Find the external IPs, domains, or URLs involved in the alert.
- Link the capability to the infrastructure. Determine which tool ran from which server.
Long-Term Value and Limitations
The Diamond Model does not prevent attacks. It helps you understand them better. It reduces the time needed to identify the scope of an incident. It helps you distinguish between a one-time mistake and a coordinated advanced persistent threats campaign. However, it requires accurate data. If your logs are incomplete, your map will be wrong. Ensure your logging coverage is broad. Do not rely solely on perimeter data. Internal logs are critical for mapping the victim corner accurately. This model is a tool for clarity, not a shield.
Key takeaways
- Linking capabilities to infrastructure reveals the specific tools used, narrowing the scope of investigation.
- Tracking adversary behavior across multiple victims exposes the broader campaign strategy rather than isolated incidents.
- Understanding the victim’s internal network state helps predict where the attacker will move next within your environment.
The Diamond Model transforms chaotic alerts into a structured narrative of attacker behavior. Map the four corners and their links to every significant incident to improve your detection capabilities.
Frequently asked questions
How does the Diamond Model differ from MITRE ATT&CK?
MITRE ATT&CK catalogs specific tactics and techniques. The Diamond Model structures the relationship between the attacker, tools, infrastructure, and victim for a specific incident. They complement each other.
Can I use this model for insider threats?
Yes. The adversary is the insider, the infrastructure is their workstation, the capability is their access, and the victim is the data they steal. The links help identify their specific actions.
How often should I update my Diamond Model maps?
Update them in real-time during an active incident. After containment, review and finalize the map within 24 hours to capture details while they are fresh.
How this guide was produced: written by the SecOps Monitor editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
