Incident Response in Practice

What you will be able to do

• You will be able to run an incident through the full response lifecycle, from detection and analysis to containment, eradication, and recovery.
• You will be able to triage and scope an incident, preserve evidence in the right order, and build a defensible timeline of what happened.
• You will be able to work a ransomware incident end to end, including isolating affected hosts and deciding how to recover safely.
• You will be able to investigate a business email compromise (BEC), find the malicious mailbox rules, and lock the attacker out of the account.
• You will be able to handle an insider threat carefully, coordinating with Human Resources and Legal while preserving evidence discreetly.
• You will be able to respond to a cloud incident using identity and activity logs, and contain a compromised account or access key.
• You will be able to coordinate containment and eradication across the technical, business, and communications teams involved in a response.
• You will be able to write a clear incident report and run a lessons-learned review that turns one incident into lasting improvements.

What is inside

4 modules, 8 lessons. Each module ends in a graded quiz and most carry an assignment.

1. 01

   How Incident Responders Work

   Before you touch a live incident, you need a mental model for how a response actually runs. This module walks through the incident response lifecycle, based on the widely used incident handling guide from the National Institute of Standards and Technology (NIST), Special Publication 800-61 (SP 800-61). It shows where an incident response analyst fits, and you will practice the core moves that every later incident depends on: triaging alerts, scoping the damage, preserving evidence in the correct order, and building a timeline.

   2 lessons · 5 quiz questions

2. 02

   Ransomware and Business Email Compromise

   Now you put the lifecycle to work on the two incidents analysts see most often. You will handle a ransomware outbreak from the first encrypted file to a safe recovery, isolating hosts, preserving evidence, and weighing restore options without making the damage worse. Then you will work a business email compromise, tracing how an attacker took over a mailbox, hunting the hidden forwarding rules, and shutting the fraud down.

   2 lessons · 5 quiz questions · assignment

3. 03

   Insider Threat and Cloud Incidents

   These two incident types break the usual playbook, so they get their own module. An insider case is as much a people problem as a technical one; you will learn to preserve evidence quietly and coordinate with Human Resources and Legal before anyone tips off the subject. A cloud incident moves the fight to identity and configuration; you will investigate using activity and audit logs, respect the shared responsibility model, and contain a compromised account or access key.

   2 lessons · 5 quiz questions

4. 04

   Reporting and Lessons Learned

   An incident is not closed until the story is written down and the team has learned from it. In this module you will write an incident report that a technical peer, a manager, and an auditor can all read, covering the timeline, the impact, the root cause, and the actions taken. Then you will run a blameless lessons-learned review that turns what went wrong into concrete fixes, so the next response is faster and calmer.

   2 lessons · 5 quiz questions · assignment