Diamond Model
An intrusion analysis model linking four features of every event: adversary, capability, infrastructure and victim.
The Diamond Model of Intrusion Analysis (Caltagirone, Pendergast and Betz, 2013) represents each malicious event as a diamond whose corners are adversary, capability (malware, exploits, techniques), infrastructure (IPs, domains, accounts used) and victim. Meta-features such as timestamp, phase, direction and result add context, and events link into activity threads.
Its practical power is pivoting: from a known corner you discover others, for example from a C2 domain (infrastructure) to other malware samples using it (capability) to other organisations hit (victims). It complements the kill chain (sequence) and ATT&CK (technique vocabulary).