Every intrusion event has four features — adversary, capability, infrastructure, victim — and analysis proceeds by pivoting from one to another.
Use
Organizing what is known about an intrusion and finding the next question.
Limit
A structure for evidence, not a source of it. The adversary vertex is usually the emptiest.