<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-diamond-model-analysis
description: >-
  Apply the Diamond Model of Intrusion Analysis to structure threat intelligence
  around adversary, capability, infrastructure, and victim dimensions.
domain: cybersecurity
subdomain: threat-intelligence
tags:
  - diamond-model
  - intrusion-analysis
  - campaign-analysis
  - threat-actors
  - attribution
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: []
---
# Performing Diamond Model Analysis

## Overview

The Diamond Model of Intrusion Analysis structures threat events around four core
features: adversary, capability, infrastructure, and victim. Each intrusion event
forms a "diamond" connecting these features, enabling analysts to pivot across
dimensions, cluster events into activity threads, and establish campaign boundaries
for attribution analysis.

## Prerequisites

| Requirement | Details |
|---|---|
| Understanding of intrusion analysis fundamentals | Required |
| Access to incident data (IOCs, malware samples, victim reports) | Required |
| MISP or OpenCTI for structured storage | Required |
| Passive DNS, WHOIS, and certificate transparency tools | Required |
| Python 3.10+ with `stix2`, `networkx` for graph analysis | Required |

## Key Concepts

### The Four Core Features

```
          Adversary
            ╱  ╲
           ╱    ╲
  Capability ── Infrastructure
           ╲    ╱
            ╲  ╱
           Victim
```

**Adversary:** The threat actor or group. May be unknown initially — analysis proceeds
without attribution. Characterized by intent, capability, and targeting patterns.

**Capability:** Tools, techniques, and malware used. Maps to ATT&CK techniques.
Ranges from commodity (Cobalt Strike) to bespoke (custom implants).

**Infrastructure:** Domains, IPs, email accounts, C2 servers used for delivery,
exploitation, and command. Type I (attacker-owned) vs Type II (compromised).

**Victim:** Target organization, sector, geography, and specific assets. Victimology
is a strong attribution signal — consistent targeting narrows actor hypotheses.

### Meta-Features

- **Timestamp:** When the event occurred (operational tempo analysis)
- **Phase:** Kill Chain stage (delivery, exploitation, C2, actions on objective)
- **Result:** Success, failure, or unknown for each event
- **Direction:** Adversary→Infrastructure→Victim or reverse pivot
- **Methodology:** Social engineering, exploitation, supply chain
- **Resources:** Cost/effort required for the capability

### Activity Threads and Groups

- **Activity Thread:** Sequence of events sharing at least one Diamond feature
- **Activity Group:** Cluster of threads attributed to the same adversary
- **Campaign:** Time-bounded set of activity groups with shared objective

## Workflow

### Step 1: Event Documentation

```python
import json
from datetime import datetime

def create_diamond_event(
    adversary: str | None,
    capability: dict,
    infrastructure: dict,
    victim: dict,
    timestamp: str,
    phase: str,
    confidence: str = "MODERATE",
) -> dict:
    """Create a structured Diamond Model event."""
    return {
        "id": f"event-{datetime.now().strftime('%Y%m%d%H%M%S')}",
        "adversary": adversary,
        "capability": capability,
        "infrastructure": infrastructure,
        "victim": victim,
        "meta_features": {
            "timestamp": timestamp,
            "phase": phase,
            "confidence": confidence,
        },
    }

event = create_diamond_event(
    adversary="APT29",
    capability={"malware": "SUNBURST", "techniques": ["T1195.002", "T1071.001"]},
    infrastructure={"domains": ["avsvmcloud.com"], "type": "compromised-supply-chain"},
    victim={"org": "SolarWinds customers", "sector": "government", "geo": "US"},
    timestamp="2020-03-01T00:00:00Z",
    phase="initial-access",
    confidence="HIGH",
)
```

### Step 2: Feature Pivoting

```python
def pivot_on_infrastructure(events: list[dict], domain: str) -> list[dict]:
    """Find all events sharing infrastructure."""
    return [
        e for e in events
        if domain in e.get("infrastructure", {}).get("domains", [])
    ]

def pivot_on_capability(events: list[dict], malware: str) -> list[dict]:
    """Find all events using the same capability."""
    return [
        e for e in events
        if e.get("capability", {}).get("malware") == malware
    ]

def pivot_on_victim_sector(events: list[dict], sector: str) -> list[dict]:
    """Find all events targeting the same sector."""
    return [
        e for e in events
        if e.get("victim", {}).get("sector") == sector
    ]
```

### Step 3: Activity Thread Construction

```python
import networkx as nx

def build_activity_graph(events: list[dict]) -> nx.Graph:
    """Build graph connecting events by shared features."""
    G = nx.Graph()
    for e in events:
        G.add_node(e["id"], **e)
        # Connect events sharing infrastructure
        for other in events:
            if other["id"] == e["id"]:
                continue
            shared_infra = set(e.get("infrastructure", {}).get("domains", [])) & \
                           set(other.get("infrastructure", {}).get("domains", []))
            if shared_infra:
                G.add_edge(e["id"], other["id"], link_type="shared_infrastructure",
                           shared=list(shared_infra))
            if e.get("capability", {}).get("malware") == other.get("capability", {}).get("malware"):
                G.add_edge(e["id"], other["id"], link_type="shared_capability")
    return G
```

### Step 4: Campaign Boundary Definition

```python
def define_campaign(events: list[dict], name: str) -> dict:
    """Define campaign boundaries from clustered events."""
    timestamps = [e["meta_features"]["timestamp"] for e in events]
    actors = {e["adversary"] for e in events if e["adversary"]}
    techniques = set()
    for e in events:
        techniques.update(e.get("capability", {}).get("techniques", []))

    return {
        "campaign": name,
        "start": min(timestamps),
        "end": max(timestamps),
        "event_count": len(events),
        "attributed_actors": list(actors),
        "techniques": sorted(techniques),
        "victim_sectors": list({e["victim"]["sector"] for e in events}),
    }
```

## Verification

- [ ] Diamond events capture all four features with meta-features
- [ ] Feature pivoting reveals connected events across dimensions
- [ ] Activity graph correctly clusters related intrusion events
- [ ] Campaign boundaries defined with start/end dates and scope
- [ ] Attribution hypotheses documented with confidence levels
- [ ] Analysis exported to MISP/OpenCTI with proper relationships

## References

- [Diamond Model of Intrusion Analysis](https://www.threatintel.academy/diamond/)
- [MITRE ATT&CK](https://attack.mitre.org/)
- [Cyber Kill Chain](https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html)
- [OpenCTI Documentation](https://docs.opencti.io/)
