Skill UI

Analyzes multi-source evidence to attribute cyber campaigns via ACH and the Diamond Model, correlating infrastructure, TTPs, malware, timing, and language signals for SOC investigations and monitoring validation.

Structures completed intrusion investigations with the Diamond Model by documenting adversaries, capabilities, infrastructure, and victims plus their relationships, metadata, and pivots to cluster incidents and support campaign attribution, confidence scoring, and analytic write-ups.

Implements the Diamond Model of Intrusion Analysis in Python to classify and correlate adversary, capability, infrastructure, and victim data, build activity threads, identify pivots, and generate ready-to-use intelligence for SOCs.