Offensive Lab 03 — Diamond Model Event Correlator

Lens: The Diamond Model (adversary / capability / infrastructure / victim). WARMUP: Chapter 2.

The problem

A single malicious event tells you little; the power of intelligence analysis is pivoting — using one observed vertex to discover related events. Two events that share infrastructure (the same C2 IP/domain) or capability (the same malware/tool) are likely the same campaign, even when the adversary is unknown. This engine pivots from one event to its relatives, clusters events into campaigns, and infers attribution by association — while honestly flagging when that inference conflicts (the danger of over-attributing on shared infrastructure).

What you build (lab.py)

  • pivot(events, event_id) — events sharing capability or infrastructure with a given one (the core analyst move).
  • correlate(events) — connected components over shared infra/capability = campaigns.
  • infer_adversary(events, cluster) — the single known adversary across a cluster, or conflicting, or None (attribution by association, with its failure mode).
  • campaign_summary(events) — per-cluster rollup of adversary, victims, infrastructure, capabilities.

Attack cases the tests cover

  • Pivoting from ev2 finds ev1 (shared capability) and ev3 (shared infrastructure).
  • Three events chain into one campaign cluster; a separate pair forms another; an event with no observables stays isolated.
  • Attribution by association: an unattributed event in a known actor's cluster inherits the attribution — and a second actor in the same cluster is flagged conflicting (don't over-attribute).
  • Deterministic clustering and campaign summaries.

Run

pip install -r requirements.txt
LAB_MODULE=solution pytest -q
pytest -q

Hardening / extensions

  • Weight pivots by confidence (a unique C2 domain is stronger evidence than a shared commodity tool).
  • Add time so infrastructure reuse is only a pivot within an overlapping active window.
  • Ingest STIX bundles and export clusters as STIX grouping/relationship objects.
  • Add the other Diamond meta-features (timestamp, phase, result, direction, methodology, resources).

Interview / resume

"Built a Diamond Model correlator that pivots events on shared infrastructure/capability, clusters them into campaigns, and performs attribution by association while flagging conflicting attribution — the analytic core of threat intelligence, including its over-attribution failure mode."

Limitations: pivots on capability/infrastructure equality only (no fuzzy/confidence matching, no time window); attribution is single-actor-or-conflict; synthetic intel records.