Diamond Model Vertex Sorter

About this interactive

Every Diamond Model event has four corners. Each card is a finding from an investigation: a crew, a trojan, a call-home domain, a clerk's laptop. Place it on its corner, and see how each corner leads to the next.

What you'll learn

Place the facts of an intrusion event on the four corners of the Diamond Model: adversary, capability, infrastructure and victim
Explain how a link from one corner, such as the malware found on a victim's machine, leads an analyst to the next corner and to further events

Aligned to

CompTIA CySA+

3.1 Explain concepts related to attack methodology frameworks.

Cisco CyberOps Associate

5.10 Classify intrusion events into categories as defined by security models

Key terms

Diamond Model of Intrusion Analysis: A framework used by cybersecurity professionals to analyze intrusions by examining the relationships between an adversary, their capabilities, infrastructure, and the victim.
Threat Actor: An individual or group responsible for a security incident or attack.
Infrastructure: The collection of servers, domains, DNS services, and web resources an attacker acquires or compromises to support an attack operation.
Command and Control: Command and Control refers to the infrastructure and communication channels used by attackers to issue instructions to and receive data from compromised systems, enabling persistent access and coordinated attack operations.
Data Exfiltration: The unauthorized transfer of data from a system to an external destination.

Topics

Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →