Diamond Model Activity Threads; The Diamond Model of Intrusion Analysis pg. 31