The Diamond Model Explained: Intrusion Analysis for the CySA+ Exam

The Diamond Model analyses a single intrusion event through four connected features. Its value is that establishing any one of them gives you a route to discovering the others — which is what makes it an investigative tool rather than a taxonomy.

The four vertices

Adversary — who is conducting the intrusion. The operator actually at the keyboard, and behind them the customer who benefits.

Capability — what they use. Malware, exploits, stolen credentials, techniques.

Infrastructure — what they use it from and through. Command and control servers, domains, IP addresses, email accounts, compromised third-party hosts.

Victim — who is targeted. The organisation, and also the specific assets and people.

The core axiom is worth stating as the model does: for every intrusion, an adversary uses a capability over some infrastructure against a victim. Every event has all four, even when you only know one.

Pivoting — why the model is useful

The diamond shape is not decoration. The vertices are connected, and analysis proceeds by moving from a known vertex to an unknown one.

You detect malware on a host: that is capability. Analysing it reveals a command and control domain, which is infrastructure. Looking up that domain reveals other domains registered by the same actor, which are further infrastructure. Checking your logs for connections to those domains reveals other affected hosts — more victims. Correlating the tooling and infrastructure against threat intelligence suggests an adversary.

That progression is the point. One indicator becomes a picture of the intrusion, and each discovery opens the next question. Analysts who record findings against the four vertices tend to find the next lead faster than those who work from a flat list of indicators.

The meta-features

Beyond the four core vertices, the model defines additional attributes worth recognising: timestamp, phase (which stage of the intrusion), result, direction, methodology and resources.

Two extra axes are also defined. The social-political axis captures the relationship between adversary and victim — the motivation and the reason this victim was chosen. The technology axis captures the relationship between capability and infrastructure.

The social-political axis is the one CySA+ tends to draw on, because it is what explains targeting: a victim is selected for a reason, and understanding that reason predicts who else is at risk.

Compared with the other frameworks

These three are examined together and are complementary rather than competing.

Framework	What it models	Best for
Cyber Kill Chain	Seven sequential stages of an intrusion	Understanding progression and where to interrupt
Diamond Model	Four features of a single event	Analysis and pivoting between indicators
MITRE ATT&CK	Catalogue of tactics and techniques	Detection coverage and shared vocabulary

The Kill Chain is a sequence: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, actions on objectives. It answers "how far has this progressed and where can we break it".

The Diamond Model is an analytic frame for one event. It answers "what else can I learn from what I already know".

ATT&CK is a catalogue of observed behaviour. It answers "what is this technique called and would we detect it".

In practice they combine: Diamond events are strung together along Kill Chain phases, with capabilities described in ATT&CK technique identifiers.

Activity threads and groups

Two extensions that appear in more detailed treatments. An activity thread chains related diamond events into the progression of a single intrusion. An activity group clusters events sharing features across intrusions, which is how analysts arrive at the conclusion that separate incidents are the same actor.

Attribution, carefully

The model makes adversary identification look straightforward. It is not, and CySA+ expects the caution.

Infrastructure is rented, shared and stolen. Tooling is sold, leaked and copied — using a group's malware does not make you that group. False flags are deliberately planted. And the operator at the keyboard may be a contractor rather than the beneficiary, which is why the model separates the adversary operator from the adversary customer.

Useful analysis usually stops at behavioural clustering — "this matches the activity group we track as X" — rather than naming a state or an individual. That distinction is worth carrying into the exam.

What to remember

Adversary, capability, infrastructure and victim: every intrusion event has all four. The model's value is pivoting — moving from a known vertex to discover unknown ones. The social-political axis explains why this victim. The Kill Chain models sequence, the Diamond Model analyses an event, ATT&CK catalogues technique. Attribution is harder than the model makes it look.

Related reading: TAXII · STIX objects · Adversary emulation