Choose the model that answers your question

The Cyber Kill Chain describes seven stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. It helps a defender discuss where an intrusion could have been interrupted. A message filter might address delivery, while an endpoint control might prevent execution associated with exploitation or installation. This is a useful planning view, rather than a substitute for an incident timeline.

Your visibility rarely covers every stage. An adversary may prepare a payload outside your environment, and a stolen cloud session may not involve installing anything on a workstation. Leave unsupported stages unknown instead of filling every box. Start from the records you possess, identify the control that should have affected the observed action, and state what evidence would demonstrate that the control actually worked.

MITRE ATT&CK provides a vocabulary for describing adversary behaviour. A tactic expresses the purpose of an action, a technique describes a method, and a subtechnique supplies a more specific variation. A procedure is the concrete implementation observed in a case. This distinction lets teams compare behaviour even when file names, user accounts, or the software used in an intrusion change.

A matching technique label is a classification, not proof of malicious intent. Administrators and intruders can both create scheduled tasks or use scripting interpreters. Record the command context, identity, parent process, timing, and authorisation evidence before deciding what happened. Select only the level of detail supported by those records. A broad but defensible mapping is more useful than a precise label built on guesswork.

The Diamond Model relates four features of an intrusion event: adversary, capability, infrastructure, and victim. Capability describes the means used; infrastructure covers the supporting systems or services; victim identifies the target; adversary identifies the operator, which may remain unknown. Recording these separately prevents a familiar domain or tool from becoming an unsupported claim about who conducted the attack.

Connections between events suggest investigation paths. A certificate, delivery service, or recurring tool characteristic may connect two observations, but shared hosting and widely available software create innocent overlap. Annotate each relationship with its source and confidence. Then ask a narrow question, such as whether the same unauthorised account accessed another victim, before grouping the events into a single campaign.