Enterprise Incident Responder

The importance of incident response in an enterprise

Key components of incident response program

Preparation, Detection, Analysis and Remediation

Overview of incident response frameworks

Components of an Incident Response Plan

Defining roles and responsibilities

Establishing communication channels and protocols

Creating and testing playbooks

Testing and updating the incident response plan

Introduction to threat intelligence

How and when to use threat intelligence

Source of threat intelligence

Network connections

Browser history

Windows prefetch

File system analysis

Windows registry

Event logs

Memory analysis

Understanding the attack lifecycle

Common persistence mechanisms

Investigating remote access techniques

Understanding Windows Credentials

Understanding Windows Credentials

Analyzing Logon Events

Investigating remote command execution

Introduction to Web Logs

Investigating common web attacks

Conducting a post-incident review

Identifying gaps and areas for improvement

Updating incident response plans and playbooks

Continuous improvement and training