Visualization model
In the real-world example mentioned in the previous section, an analyst was able to pinpoint commonalities between different toolsets to show where they overlapped. The diamond model (as shown in Figure 6.1), developed by Sergio Caltagirone, Andrew Pendergast, and Christopher Betz, provides the ability to do this if utilized to its full extent. This model has been widely adopted across the cybersecurity community to the point that it appears in numerous security information and event management (SIEM) systems and threat hunting software to aid in the identification of malicious activity:
Figure 6.1 – Diamond model
When utilizing this model, understand that each event will have its own diamond. In each node (corner), any known information will need to be displayed. Some events will have very little that will be known, while for others, there might be a mountain of data. Once a model is developed, an analyst can begin pivoting off of...
