This paper presents a novel model of intrusion analysis built by analysts and derived from years of experience asking the simple question, “What is the underlying method to our work?” The model establishes the basic atomic element of any intrusion activity and the event, composed of four core features: adversary, infrastructure, capability, and victim. These features are edge-connected representing their underlying relationships and arranged in the shape of a diamond, giving the model its name, the Diamond Model.
