What it does. The Diamond Model of Intrusion Analysis provides a structured framework Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Upstream	mukul975/Anthropic-Cybersecurity-Skills
Skill file	skills/implementing-diamond-model-analysis/SKILL.md
License	Apache-2.0 (skill folder LICENSE)
Author	mukul975
Fetched	2026-09-10

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-diamond-model-analysis, or copy the skill folder into ~/.claude/skills/implementing-diamond-model-analysis/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-diamond-model-analysis/SKILL.md

SKILL.md (verbatim)

name: implementing-diamond-model-analysis
description: The Diamond Model of Intrusion Analysis provides a structured framework
  for analyzing cyber intrusions by examining four core features - Adversary, Capability,
  Infrastructure, and Victim. This skill covers implementing the Diamond Model programmatically
  to classify and correlate intrusion events, build activity threads, and generate
  pivot-ready intelligence.
domain: cybersecurity
subdomain: threat-intelligence
tags:
- threat-intelligence
- cti
- ioc
- mitre-attack
- stix
- diamond-model
- intrusion-analysis
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-05
- DE.CM-01
- DE.AE-02
mitre_attack:
- T1591
- T1592
- T1593
- T1589
- T0816

Implementing Diamond Model Analysis

Overview

The Diamond Model of Intrusion Analysis provides a structured framework for analyzing cyber intrusions by examining four core features: Adversary, Capability, Infrastructure, and Victim. This skill covers implementing the Diamond Model programmatically to classify and correlate intrusion events, build activity threads linking related events, create activity-attack graphs, and generate pivot-ready intelligence from intrusion data.

When to Use

• When deploying or configuring implementing diamond model analysis capabilities in your environment
• When establishing security controls aligned to compliance requirements
• When building or improving security architecture for this domain
• When conducting security assessments that require this implementation

Prerequisites

• Python 3.9+ with networkx, stix2, graphviz libraries
• Understanding of the Diamond Model core and meta-features
• Access to threat intelligence data (MISP/OpenCTI events)
• Familiarity with MITRE ATT&CK for capability mapping

Key Concepts

Diamond Model Core Features

• Adversary: The threat actor or operator conducting the intrusion
• Capability: The tools, techniques, and malware used (maps to ATT&CK)
• Infrastructure: C2 servers, domains, email addresses, hosting providers
• Victim: Target organization, system, person, or data asset

Meta-Features

• Timestamp: When the event occurred
• Phase: Kill chain stage (recon, delivery, exploitation, etc.)
• Result: Success, failure, or unknown
• Direction: Adversary-to-infrastructure, infrastructure-to-victim, etc.
• Methodology: Social engineering, technical exploit, insider threat
• Resources: Financial, human, technical resources required

Activity Threads and Groups

• Activity Thread: Sequence of Diamond events from a single adversary operation
• Activity Group: Cluster of threads attributed to the same adversary

Workflow

Step 1: Define Diamond Event Data Structure

from dataclasses import dataclass, field
from datetime import datetime
from typing import Optional
import json
import uuid

@dataclass
class DiamondEvent:
    adversary: str = ""
    capability: str = ""
    infrastructure: str = ""
    victim: str = ""
    timestamp: str = ""
    phase: str = ""
    result: str = ""
    direction: str = ""
    methodology: str = ""
    confidence: int = 0
    notes: str = ""
    event_id: str = field(default_factory=lambda: str(uuid.uuid4())[:8])
    mitre_techniques: list = field(default_factory=list)
    iocs: list = field(default_factory=list)

    def to_dict(self):
        return {
            "event_id": self.event_id,
            "adversary": self.adversary,
            "capability": self.capability,
            "infrastructure": self.infrastructure,
            "victim": self.victim,
            "timestamp": self.timestamp,
            "phase": self.phase,
            "result": self.result,
            "direction": self.direction,
            "methodology": self.methodology,
            "confidence": self.confidence,
            "mitre_techniques": self.mitre_techniques,
            "iocs": self.iocs,
            "notes": self.notes,
        }

Step 2: Build Activity Thread from Events

import networkx as nx

class DiamondAnalysis:
    def __init__(self):
        self.events = []
        self.graph = nx.DiGraph()

    def add_event(self, event: DiamondEvent):
        self.events.append(event)
        self.graph.add_node(event.event_id, **event.to_dict())

    def build_activity_thread(self):
        """Link events chronologically into activity threads."""
        sorted_events = sorted(self.events, key=lambda e: e.timestamp)
        for i in range(len(sorted_events) - 1):
            self.graph.add_edge(
                sorted_events[i].event_id,
                sorted_events[i + 1].event_id,
                relationship="followed_by",
            )

    def find_pivots(self):
        """Find pivot points where events share infrastructure or capabilities."""
        pivots = {"infrastructure": {}, "capability": {}, "adversary": {}}

        for event in self.events:
            if event.infrastructure:
                pivots["infrastructure"].setdefault(event.infrastructure, []).append(event.event_id)
            if event.capability:
                pivots["capability"].setdefault(event.capability, []).append(event.event_id)
            if event.adversary:
                pivots["adversary"].setdefault(event.adversary, []).append(event.event_id)

        return {
            k: {pk: pv for pk, pv in v.items() if len(pv) > 1}
            for k, v in pivots.items()
        }

    def generate_report(self):
        return {
            "total_events": len(self.events),
            "unique_adversaries": len(set(e.adversary for e in self.events if e.adversary)),
            "unique_victims": len(set(e.victim for e in self.events if e.victim)),
            "unique_infrastructure": len(set(e.infrastructure for e in self.events if e.infrastructure)),
            "pivots": self.find_pivots(),
            "events": [e.to_dict() for e in self.events],
        }

Validation Criteria

• Diamond events capture all four core features with meta-features
• Activity threads link related events chronologically
• Pivot analysis identifies shared infrastructure and capabilities across events
• Graph visualization renders the activity-attack graph correctly
• Events map to MITRE ATT&CK techniques for capability classification

References

• Diamond Model Paper
• MITRE ATT&CK
• STIX 2.1 Campaign Object

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Diamond Model Analysis Report Template

Report Metadata

Field	Value
Report ID	CTI-YYYY-NNNN
Date	YYYY-MM-DD
Classification	TLP:AMBER
Analyst	[Name]
Confidence	High/Moderate/Low

Executive Summary

[Brief overview of key findings and their significance]

Key Findings

1. [Finding 1 with supporting evidence]
2. [Finding 2 with supporting evidence]
3. [Finding 3 with supporting evidence]

Detailed Analysis

Finding 1

• Evidence: [Description of evidence]
• Confidence: High/Moderate/Low
• MITRE ATT&CK: [Relevant technique IDs]
• Impact Assessment: [Potential impact to organization]

Indicators of Compromise

Type	Value	Context	Confidence

Recommendations

1. Immediate: [Actions requiring immediate attention]
2. Short-term: [Actions within 1-2 weeks]
3. Long-term: [Strategic improvements]

References

• [Source 1]
• [Source 2]

references/api-reference.md (verbatim)

API Reference: Diamond Model Intrusion Analysis Agent

Dependencies

Library	Version	Purpose
(stdlib only)	Python 3.8+	Dataclass-based Diamond Model event modeling

CLI Usage

python scripts/agent.py --data /intel/events.json --output-dir /reports/

Functions

DiamondEvent (dataclass)

Four vertices: adversary, capability, infrastructure, victim. Plus: phase, result, confidence, notes.

create_event(adversary, capability, infrastructure, victim, **kwargs) -> DiamondEvent

Factory for creating Diamond Model events with auto-generated ID and timestamp.

load_events(data_path) -> list

Loads events from JSON file with {"events": [...]} structure.

pivot_on_vertex(events, vertex, value) -> list

Analytic pivot: returns all events sharing a specific vertex value.

build_activity_thread(events, adversary) -> dict

Groups events by adversary chronologically. Lists capabilities, infrastructure, victims.

cluster_by_infrastructure(events) -> dict

Groups event IDs by shared infrastructure for campaign identification.

compute_vertex_statistics(events) -> dict

Counts unique values per vertex and confidence distribution.

Input Format

{
  "events": [{
    "adversary": "APT29",
    "capability": "Cobalt Strike",
    "infrastructure": "185.220.101.42",
    "victim": "finance-server-01",
    "phase": "Lateral Movement",
    "confidence": "high"
  }]
}

Output Schema

{
  "statistics": {"total_events": 15, "unique_adversaries": 2},
  "activity_threads": [{"adversary": "APT29", "event_count": 8}],
  "infrastructure_clusters": {"185.220.101.42": ["evt1", "evt5"]}
}

references/standards.md (verbatim)

Standards and Frameworks Reference

Applicable Standards

• STIX 2.1: Structured Threat Information eXpression for CTI data representation
• TAXII 2.1: Transport protocol for sharing CTI over HTTPS
• MITRE ATT&CK: Adversary tactics, techniques, and procedures taxonomy
• Diamond Model: Intrusion analysis framework (Adversary, Capability, Infrastructure, Victim)
• Traffic Light Protocol (TLP): Information sharing classification (CLEAR, GREEN, AMBER, RED)

MITRE ATT&CK Relevance

• Technique mapping for threat actor behavior classification
• Data sources for detection capability assessment
• Mitigation strategies linked to specific techniques

Industry Frameworks

• NIST Cybersecurity Framework (CSF) 2.0 - Identify function
• ISO 27001:2022 - A.5.7 Threat Intelligence
• FIRST Standards - TLP, CSIRT, vulnerability coordination

References

• STIX 2.1 Specification
• MITRE ATT&CK
• Diamond Model Paper
• NIST CSF 2.0

references/workflows.md (verbatim)

Diamond Model Analysis Workflows

Workflow 1: Collection and Analysis

[Intelligence Sources] --> [Data Collection] --> [Analysis] --> [Reporting]
        |                        |                   |               |
        v                        v                   v               v
  OSINT/HUMINT/SIGINT    Normalize/Enrich    Assess/Correlate  Disseminate

Steps:

1. Planning: Define intelligence requirements and collection priorities
2. Collection: Gather data from relevant sources
3. Processing: Normalize data formats and filter noise
4. Analysis: Apply analytical frameworks and correlate findings
5. Production: Generate intelligence products and reports
6. Dissemination: Share with stakeholders via appropriate channels
7. Feedback: Collect consumer feedback to refine future collection

Workflow 2: Continuous Monitoring

[Watchlist] --> [Automated Monitoring] --> [Change Detection] --> [Alert/Update]

Steps:

1. Define Watchlist: Identify indicators, actors, and topics to monitor
2. Configure Monitoring: Set up automated collection from relevant sources
3. Change Detection: Identify new or changed intelligence
4. Assessment: Evaluate significance of changes
5. Alerting: Notify stakeholders of significant intelligence updates
6. Archive: Store intelligence for historical analysis and trending

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.