Diamond Model Meta-Features vs Core Features

CAS-005 By islever Editorial Last updated

Given a scenario, apply threat-hunting and threat intelligence concepts.

Short answer

A Direction is a meta-feature of the Diamond Model, whereas Capabilities and Infrastructure are core features.

Question

An analyst is using the Diamond Model of Intrusion Analysis to identify the likely chain of activities associated with an attacker's activities. The threat hunter has completed the core components of the model but needs to consider meta factors to more deeply understand the situation. Which of the following should the threat hunter seek to understand within the model?
  1. Direction Correct Answer
  2. Velocity
  3. Capabilities
  4. Infrastructure

Key Takeaways

The main trap is confusing core features (Adversary, Capability, Infrastructure, Victim) with meta-features (Timestamp, Phase, Result, Direction).

This page explains how to distinguish between core features and meta-features in the Diamond Model of Intrusion Analysis, identifying Direction as the correct meta-factor among the options provided.

Common mistake: Candidates often select Infrastructure (D) because it is a critical part of the model, but it is a core feature, not a meta-feature, which is what the question specifically asks for.

Expert Analysis

The Diamond Model of Intrusion Analysis is a framework used to describe the components of a cyber attack. It consists of four core features: Adversary, Capability, Infrastructure, and Victim. These are the concrete entities involved in the intrusion.

Beyond these core features, the model includes meta-features that provide context about the event itself. According to official documentation (e.g., Mandiant), the meta-features are:

  1. Timestamp: When the activity occurred.
  2. Phase: The specific stage of the kill chain or attack lifecycle.
  3. Result: The outcome of the activity (success/failure).
  4. Direction: The origin and target vectors of the event.

The question specifically asks for a meta-factor.

  • Option C (Capabilities) and Option D (Infrastructure) are core features, not meta-factors. They represent what tools were used and where they came from/went to, but they are fundamental nodes in the diamond, not contextual metadata.
  • Option A (Direction) is explicitly listed as one of the four meta-features. It describes the vector of the attack (origin to target).
  • Option B (Velocity) is not a standard component of the Diamond Model's defined meta-features.

Therefore, the threat hunter should seek to understand Direction to gain deeper contextual insight into the attack's movement and targeting.

Official Reference

https://www.mandiant.com/resources/diamond-model-intrusion-analysis

This link opens the official vendor documentation in a new tab.

Exam Strategy

When analyzing frameworks like the Diamond Model, always categorize terms into their specific groups (e.g., core vs. meta). Memorizing the exact lists for each group prevents confusion between similar-sounding concepts during the exam.

Frequently Asked Questions

What are the four core features of the Diamond Model?

The four core features are Adversary, Capability, Infrastructure, and Victim. These represent the tangible elements of an intrusion.

Why is Velocity not a meta-feature in the Diamond Model?

Velocity is not part of the standard Diamond Model definition. The recognized meta-features are Timestamp, Phase, Result, and Direction.

More CAS-005 FAQ →

Community Votes

A
67%
D
33%

67% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. jamestkd 👍 1 Answered A
    The correct answer is A. Direction. Explanation: The Diamond Model Meta-Features: The Diamond Model of Intrusion Analysis includes four core features (Adversary, Capability, Infrastructure, and Victim) and four meta-features (Timestamp, Phase, Result, and Direction). Direction: Within the model, "Direction" describes the origin and target vectors of the event (such as whether the activity flowed from the victim back to the adversary, or vice versa, and the flow of the intrusion event), helping analysts understand the broader context and trajectory of the attack campaign. Why others are incorrect: Capabilities and Infrastructure are core components of the model, not meta-factors. Velocity is not a standard feature within the Diamond Model.
  2. Skri113xX 👍 1 Answered D
    I’m cool with D, unless someone’s got a better take based on the docs.
  3. MartinRB 👍 1 Answered A
    A is the only metafeature

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Cloud Security Logic Flaw: False Negative in Device Compliance

S-grade

Which Threat Best Explains Inaccurate AI Output

S-grade

What Should an Org Do First with Threat Intelligence on a Targeted Web Server?

S-grade

Differentiating Global Endpoint Telemetry by Office

S-grade

Practice All CAS-005 Questions

Access 135 questions with complete answers and detailed explanations.

View Full CAS-005 Practice Test →

← Back to CAS-005 Study Guide