Lion Cipher Lab
Analyze an intrusion with the Diamond Model
- Threat Intel Analyst
- Intermediate
- ~60 min
- Free · no account required
Why it matters
When a real intrusion lands on your desk, you get a chaotic pile of facts: a weird domain, a suspicious DLL, a list of affected machines, a rumor about who did it. Without a structure, analysts drown in it — and worse, they can't see what they're MISSING. The Diamond Model is the single most-used way to organize intrusion evidence into four buckets and then reason about the gaps. It is the mental scaffolding under most threat-intel work, and 'can you Diamond an intrusion?' is a genuine interview-grade skill for a threat-intel or SOC analyst.
What you'll learn
- Diamond Model of Intrusion Analysis
- structuring intrusion evidence
- analytic pivoting
- reading MITRE ATT&CK campaign pages
- turning a public report into structured intelligence
Steps in this lab
- First, what is an 'intrusion' — and why do you need a model?
- The four vertices, defined
- Set up your worksheet
- Choose a real, well-documented intrusion
- Fill the ADVERSARY vertex
- Fill the CAPABILITY vertex
- Fill the INFRASTRUCTURE vertex
- Fill the VICTIM vertex
- Draw the edges — connect the vertices into one event
- Make a pivot — the real analytic payoff
- What you built — and where it goes next