Executing Diamond Model Analysis When to Use Use this skill when: - Analyzing a confirmed intrusion to understand the complete adversary-capability-infrastructure-victim relationship - Attempting to link two or more incidents to a common threat actor using shared infrastructure or capability indicators - Structuring a finished intelligence product that explains adversary behavior in a formal analytic framework Do not use this skill during active incident containment — Diamond Model analysis is a post-event or concurrent intelligence activity, not a response procedure. Prerequisites - Complete…