Incident Response

Lessons

1. 1

   What is Incident Response?

   Understand what counts as a security incident and why preparation matters more than reaction.

   Beginner·30 min
2. 2

   Preparation and Planning

   Build an IR plan with defined roles, communication protocols, and tabletop exercises.

   Beginner·35 min
3. 3

   Detection and Analysis

   Learn how incidents are detected via logs and alerts, and triage true positives from false positives.

   Intermediate·40 min
4. 4

   Containment and Eradication

   Apply short- and long-term containment strategies, remove threats, and preserve forensic evidence.

   Intermediate·35 min
5. 5

   Recovery and Post-Incident

   Restore systems, verify threat elimination, conduct post-incident review, and write an IR report.

   Intermediate·30 min
6. 6

   Incident Response in Practice

   Study real breach case studies, build playbooks, and walk through a simulated incident scenario.

   Intermediate·50 min
7. 7

   Hands-on: SIEM Basics with Splunk

   Stand up Splunk Free, query logs in SPL, and build a basic detection alert.

   Intermediate·60 min
8. 8

   Tabletop Exercise: Credential Compromise

   Lead a credential-compromise tabletop end-to-end and produce concrete action items.

   Intermediate·45 min
9. 9

   Incident Response Resources and Next Steps

   Explore curated NIST guides, certifications (CySA+, GCIH, BTL1), and practice platforms.

   Beginner·25 min
10. 10

    Incident Response Job Readiness

    Translate IR skills into a resume, portfolio plan, and interview prep for SOC analyst and IR roles.

    Beginner·30 min