The Diamond Model of Intrusion Analysis
When we talk about TI, we don't only mean the IoCs integrated into monitoring and detection tools in the form of feeds.
In an IR modern approach, CTI information is vital for the early identification and containment of threats as it provides the necessary context for threat hunting and identifying malicious behaviors.
The Diamond Model of Intrusion Analysis was created by Sergio Caltagirone, Andrew Pendergast, and Christopher Betz from the Center for Cyber Threat Intelligence and Threat Research (http://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf).
This model has become one of the pillars for intelligence analysts and is based on four main components, as outlined here:
- Adversary: This could be an organization or individual, also known as an adversary or threat actor.
- Infrastructure: The threat actor's technology infrastructure could be a domain name, Internet Protocol (IP) address, and so on....
