Course Objective & Scope
During a ransomware outbreak, data breach or unauthorised access incident, unprepared teams risk destroying forensic evidence, tipping off the attacker or taking critical systems offline unnecessarily. Following NIST SP 800-61, this course covers preparation, detection and analysis, containment, eradication, recovery and post-incident lessons learned end to end.
In a controlled incident simulation, participants collect endpoint and log artefacts, reconstruct an attack timeline, make tabletop containment decisions and draft an adaptable Incident Response Playbook for their organisation.
Who Should Attend?
- SOC analysts, CSIRT/CERT members and DFIR specialists
- Systems, network and cloud administrators involved in major security incidents
- Cybersecurity managers and crisis coordination leads
- Prerequisite: basic familiarity with operating systems, network protocols and security logs
Key Takeaways
- Run an enterprise incident response process aligned with NIST SP 800-61 and SANS phases
- Collect volatile and non-volatile digital evidence while preserving forensic integrity
- Make sound containment decisions (host isolation, credential/token revocation) that halt lateral spread
- Build an attack timeline and root-cause analysis from logs and endpoint artefacts
- Author actionable playbooks and communication plans for ransomware, BEC and data breach scenarios
Curriculum
Incident Response Lifecycle and Preparation
- NIST SP 800-61 phases, CSIRT roles, escalation matrices and communication protocols
- Pre-incident log retention, EDR readiness and the forensic triage toolkit
Detection, Triage and Rapid Evidence Collection (DFIR Triage)
- Initial alert validation, incident scoping and IOC/IOA analysis
- Collecting memory, process, network and persistence artefacts on Windows and Linux
Containment, Eradication and Recovery
- Short- and long-term containment: network isolation and Active Directory/IAM actions
- Removing attacker persistence and validating clean system recovery
Cloud, Identity and Ransomware Scenarios
- Responding to compromised cloud/M365 accounts, leaked API keys and BEC incidents
- Ransomware crisis handling, backup integrity checks and decision checkpoints
Timeline Reconstruction, Reporting and Playbook Design
- Building the incident timeline, root-cause analysis and lessons-learned reviews
- Drafting an internal Incident Response Playbook and tabletop exercise checklist
Other Courses in This Category
-
Log architecture, normalization, correlation rules, MITRE ATT&CK-based detection, alert triage and threat hunting for SOC analysts and security engineers reducing alert fatigue and catching real threats.
- Live Course
- 5 modules
-
SOAR playbooks, LLM and security agents for automated enrichment, alert triage, case summarization and human-in-the-loop response for SOC and security engineers scaling operations.
- Live Course
- 5 modules
-
Evasion, data poisoning, backdoors, model extraction and membership inference attacks and defenses under MITRE ATLAS for data science and security teams testing ML model robustness.
- Live Course
- 5 modules
-
OWASP Top 10 for LLM & Agentic Applications, direct/indirect prompt injection, RAG data leakage, MCP/tool-calling authorization and guardrail architectures for engineers building secure AI systems.
- Live Course
- 5 modules
-
ISO/IEC 27001:2022 clauses, asset and risk assessment, Annex A controls, Statement of Applicability (SoA) and internal audit readiness for teams establishing and operating an ISMS.
- Live Course
- 5 modules
-
The Linux network stack, nftables/iptables, SSH and privilege hardening, SELinux/AppArmor, auditd and packet analysis for systems and security engineers securing production Linux servers.
- Live Course
- 5 modules
Get in touch
