# The Diamond Model of Intrusion Analysis

> Structure intrusion evidence as Diamond events, link them into threads, pivot across infrastructure and capability, and build defensible activity groups.

Canonical: https://codelivly.com/rooms/cti-diamond-model
Last updated: 2026-10-28

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Lessons | 5 |
| XP | 100 |

**Purpose.** Teach the Diamond Model of Intrusion Analysis (Caltagirone, Pendergast and Betz, 2013) as a working method for structuring intrusion evidence, finding gaps, pivoting to new evidence and grouping related activity, alongside MITRE ATT&CK and the intrusion kill chain.

**Prerequisites.** Learning Path 1 (CTI Foundations) and Learning Path 2 (OSINT and Indicator Analysis), and Module 1 of this path (MITRE ATT&CK and Adversary Behavior Analysis).

**Measurable outcomes.** After this module you can:

- Record an intrusion event with all four core features and six meta-features, marking each as observed, inferred or unknown.
- Classify infrastructure as Type 1, Type 2 or service provider, and victims as persona or asset.
- Build an activity thread with actual and hypothesised arcs from mixed log sources.
- Select and run a centred pivot approach and grade each resulting link as strong, moderate or weak.
- Apply the six-step activity group process and explain why feature selection determines the group.

**Practical completion objective.** Complete the lab by constructing a Diamond summary of a synthetic intrusion case: three events, an activity thread, a graded pivot table and a confidence-qualified assessment of the adversary vertex.

## Lessons

1. Core Features and the Event Axiom (18 min)
2. Meta-Features and the Extended Diamond (16 min)
3. Activity Threads and Analytic Pivoting (20 min)
4. Activity Groups and Fitting the Diamond with ATT&CK (18 min)
5. Lab: Construct a Diamond Model from a Simulated Intrusion Case (45 min)

## Related

- [Learning path: Threat Actor and Campaign Investigation](https://codelivly.com/learning-paths/cti-threat-actor-investigation)
- [All rooms](https://codelivly.com/rooms)