What it means
The Diamond Model examines relationships among adversary, capability, infrastructure, and victim while adding context such as time, direction, and confidence.
Why it matters
It helps analysts pivot systematically and distinguish what is observed from what remains an analytic hypothesis.
Practical focus
- Record the evidence supporting each vertex and edge
- Use pivots to develop collection questions
- Preserve temporal context
- Combine the model with ATT&CK or kill-chain analysis
Common mistakes
- Filling every vertex with unsupported assumptions
- Treating a diagram as proof of attribution
- Ignoring compromised infrastructure
- Failing to update the model as evidence changes
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: