While performing threat-hunting functions, an analyst is using the Diamond Model of Intrusion Analysis. The analyst identifies the likely adversary, the infrastructure involved, and the target…

The correct answer is B. Capabilities. The Diamond Model of Intrusion Analysis requires the documentation of capabilities, as this refers to the adversary’s tools, techniques, and procedures (TTPs) used during the attack. Identifying and documenting the adversary's capabilities is essential for effective…

Submitted by jaden.t· Mar 6, 2026Security Operations

Question

While performing threat-hunting functions, an analyst is using the Diamond Model of Intrusion Analysis. The analyst identifies the likely adversary, the infrastructure involved, and the target. Which of the following must the threat hunter document to use the model effectively?

Options

AKnowledge
BCapabilities
CPhase
DMethodologies

How the community answered

(30 responses)

A
3% (1)
B
93% (28)
D
3% (1)

Explanation

The Diamond Model of Intrusion Analysis requires the documentation of capabilities, as this refers to the adversary’s tools, techniques, and procedures (TTPs) used during the attack. Identifying and documenting the adversary's capabilities is essential for effective threat-hunting, as it helps understand how the adversary operates and can guide the detection of similar future

Community Discussion

No community discussion yet for this question.

Full CAS-005 Practice