A public-health SOC uses Diamond Model capability alongside ATT&CK…

Question

A public-health SOC uses Diamond Model capability alongside ATT&CK techniques on the same campaign. What should the analyst conclude?

Accepted Answer

Industry practice combines models: Diamond capability often maps to the tool or technique without making either framework illegal — These models are stacked lenses, not rival sports teams. Diamond capability is usually the tool or technique the actor brought; ATT&CK still names that method. Nobody has to throw one map away.

Answer

Only one framework is valid in Enterprise Security, so Diamond Model fields must be deleted before ATT&CK annotations can be used

Answer

Diamond capability is the victim identity, so it cannot relate to a TTP or tool

Answer

ATT&CK techniques replace the Diamond Model, so civic SOCs must pick a single legal framework

A public-health SOC uses Diamond Model capability alongside ATT&CK techniques on the same campaign. What should the analyst conclude?

Short Explanation

Full Explanation