A public-health SOC uses Diamond Model capability alongside ATT&CK techniques on the same campaign. What should the analyst conclude?
Select an answer to reveal the explanation.
Short Explanation
These models are stacked lenses, not rival sports teams. Diamond capability is usually the tool or technique the actor brought; ATT&CK still names that method. Nobody has to throw one map away.
Full Explanation
Industry practice routinely combines analytic models. Using Diamond Model capability alongside ATT&CK techniques on the same public-health campaign is valid: Diamond capability often maps to the tool or technique the adversary brought, while ATT&CK still supplies the shared technique IDs Enterprise Security annotations expect. Neither framework makes the other illegal; stacked lenses give richer campaign understanding for civic defenders.
Insisting only one framework is valid in Enterprise Security so Diamond fields must be deleted before ATT&CK annotations can be used invents a false exclusivity—ES annotations use ATT&CK (and other control frameworks) without banning Diamond analysis in case notes or intel products. Defining Diamond capability as the victim identity fails by mixing Diamond vertices—victim is its own vertex; capability relates to what the adversary can do (often tools/techniques). Claiming ATT&CK techniques replace the Diamond Model so civic SOCs must pick a single legal framework again forces a false choice the industry does not require.
Exam caveat: multi-model fluency is expected; distractors often say you must delete one framework to use another.
Operational check: in the public-health case file, record Diamond adversary, capability, infrastructure, and victim alongside ATT&CK technique IDs on related notables; keep ES annotations on ATT&CK/CIS/NIST while Diamond enrichments live in investigation notes or intel objects.