APT Intelligence -- Diamond Model

APT Diamond Model Builder

An interactive implementation of the Diamond Model of Intrusion Analysis. Fill in the four vertices (Adversary, Infrastructure, Capability, Victim) and meta-features to build a structured intelligence product from any APT incident you are investigating.

Adversary

Suspected threat actor (if known)

Adversary persona / alias observed

Sponsorship (if assessed)

Intent / motivation (assessed)

Victim

Victim organisation / asset

Victim persona (specific individual targeted)

Industry / sector

What was the adversary targeting?

Capability

Malware / tools used

Primary MITRE ATT&CK tactics observed

Sophistication level

Unique technical features observed

Infrastructure

IP addresses used

Domains / C2 infrastructure

Infrastructure type

Operational relay / proxy observed

Meta-features

Start timestamp (first observed activity)

Stop timestamp (last observed / detection date)

Phase (kill chain stage at detection)

Analyst confidence in attribution (0-100%)

Analyst name / team

Fill in the Diamond Model vertices and click Build to generate a structured intelligence product.