skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-diamond-model-analysis

Implement Diamond Model intrusion analysis to correlate events and generate pivot-ready threat intelligence.

954|172|Updated Mar 13, 2026
Search Tags:#threat intelligence#NetworkX#stix#mitre att&ck#pivot analysis#intrusion analysis#diamond model
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-diamond-model-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-diamond-model-analysis
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-intelligence/implementing-diamond-model-analysis
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-diamond-model-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires networkx, stix2, graphviz.

What problem does it solve?

Analyzing cyber intrusions across disconnected events makes it hard to attribute activity to adversaries or find shared infrastructure. This Skill structures intrusion data using the Diamond Model's four core features (Adversary, Capability, Infrastructure, Victim) so analysts can correlate events, build activity threads, and identify pivot points programmatically.

Core Features & Use Cases

  • Diamond Event Modeling: Define structured intrusion events with all four core features plus meta-features like timestamp, phase, result, and MITRE ATT&CK technique mappings.
  • Activity Thread Construction: Link chronologically sorted events into directed graphs using networkx to reconstruct adversary operations.
  • Pivot Analysis: Automatically identify shared infrastructure, capabilities, and adversaries across events to cluster activity groups.
  • Use Case: Given a set of MISP or OpenCTI intrusion events, model each as a DiamondEvent, build an activity thread, and run pivot analysis to discover that three seemingly separate incidents share the same C2 infrastructure and ATT&CK techniques, revealing a single coordinated campaign.

Quick Start

Ask the AI to model a set of intrusion events using the Diamond Model, build an activity thread, and find pivot points across shared infrastructure and capabilities.

Frequently Asked Questions about implementing-diamond-model-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement the Diamond Model for intrusion analysis in Python?▼

Define a DiamondEvent dataclass capturing the four core features (Adversary, Capability, Infrastructure, Victim) plus meta-features like timestamp and phase. Then use networkx to build a directed graph, sort events chronologically into activity threads, and run pivot analysis on shared attributes.

What is pivot analysis in threat intelligence?▼

Pivot analysis identifies events sharing the same infrastructure, capability, or adversary values, letting analysts traverse from one known indicator to related activity. The find_pivots function groups events by non-empty fields and returns only values shared by more than one event.

Why are my Diamond Model pivots missing related events?▼

Pivots fail when events have empty core features, since find_pivots only matches non-empty fields, or when infrastructure values are not normalized (e.g., '1.2.3.4' vs '1.2.3.4:443'). Populate all four vertices and canonicalize infrastructure values before graphing.

Does Diamond Model analysis integrate with MITRE ATT&CK?▼

Yes, each DiamondEvent includes a mitre_techniques list for mapping capabilities to ATT&CK technique IDs. Populating this field enables cross-event capability correlation and ATT&CK-based clustering of activity groups.

What Python libraries are needed for Diamond Model analysis?▼

The implementation requires Python 3.9+ with networkx for activity-attack graph construction, stix2 for structured threat intelligence objects, and graphviz for graph visualization. Access to threat data from MISP or OpenCTI is also expected.

Related Skills

Explore More Software Engineering Skills→
dapperdiversdapperdivers
1

ioc-distributor

Export and distribute validated IOCs across security platforms.

Community
Advanced
Liberty91LTDLiberty91LTD
15

stix-bundle

Generate STIX 2.1 bundles modeling threat intelligence objects and relationships.

Official
Advanced
hypnguyen1209hypnguyen1209
338

threat-hunting

Hunt threats across infrastructure and extract IOC data mapped to MITRE ATT&CK.

Community
Advanced
Jayarr03Jayarr03

attack-path-simulator

Simulate attacker paths and generate kill chain reports from security reviews.

Community
Advanced