The Diamond Model provides a structured framework for investigating and understanding cyber intrusions. Where the Cyber Kill Chain describes the sequential stages of an attack and MITRE ATT&CK catalogues the specific techniques an adversary employs, the Diamond Model focuses on the relationships between the fundamental components of any intrusion. It asks four questions simultaneously: who is attacking, with what, using which resources, and against whom. The answers to those four questions, and the connections between them, form the analytical foundation for attribution, threat intelligence enrichment, and campaign identification.
The Four Vertices #
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
