Diamond model of intrusion analysis framework

The diamond model of intrusion analysis (https://bit.ly/3iHC6Hn) is another popular intelligence framework for understanding adversaries' behavior and analyzing intrusions. The model is simple to represent but complex and powerful to apply compared to the Lockheed Cyber Kill Chain and the MITRE ATT&CK frameworks. The framework presents the intrusion activity as a function of four core elements: the adversary, the infrastructure, the capability, and the victim. Those elements are connected on the edges to represent the relationships between them in the form of a diamond, hence the name diamond model. A simplified form of the model is shown in the following diagram. The diamond model is based on a scientific approach to intrusion analysis and provides effective documentation, synthesis, and correlation of cyber events to the analyst. The model uses the logic that every cyber event involves an adversary who utilizes a capability over...