Enterprise Incident Responder

This incident response course teaches you how to detect, investigate and recover from cyber attacks in an enterprise network. It is hands-on incident response training: you build a response plan, collect evidence from Windows systems and follow an attacker's steps from the first foothold to lateral movement.

What you will learn

• An incident response program: preparation, detection, analysis and remediation, and the main incident response frameworks.

• Response plans and playbooks: roles and responsibilities, communication channels, and creating and testing playbooks.

• Threat intelligence: what it is, where it comes from and when to use it to detect incidents.

• Windows evidence: network connections, browser history, prefetch, the file system, the registry, event logs and memory analysis.

• Investigating persistence: the attack lifecycle, common persistence mechanisms and remote access techniques.

• Investigating lateral movement: Windows credentials, logon events and remote command execution.

• Investigating web attacks: reading web logs and spotting common web attacks.

• After the incident: post-incident reviews, finding gaps, and updating plans and playbooks.

By the end you will have the core digital forensics and incident response skills that enterprise SOC and incident response teams use every day.

Who is this course for?

• Cybersecurity professionals

• IT administrators

• SOC analysts

• Incident response team members

• Risk and compliance officers

• IT managers