ForensicSpot10 modules
Incident Response and Management
Handling security incidents end to end: the IR lifecycle, forensic readiness, triage, containment, recovery, live response, the SOC, and post-incident reporting.
- 60hours
- 30topics
- 10modules
Module 16 hrs3 topics
Incident Response Foundations
What an incident is, why response matters, and key terms.
Start module- What Is a Security IncidentDefines a security incident versus an event, alert, or breach, and introduces incident types: breaches, ransomware, insider threats, disruptions.13 min
- Incident Response Goals and PrinciplesExplains why organisations formalise incident response and the guiding principles: speed, proportionality, chain-of-custody discipline, communication integrity.13 min
- Key Terms and Stakeholders in Incident ResponseDefines IOC, TTPs, threat actor, CSIRT, and escalation path, and maps stakeholders from technical responders to legal counsel, executives, and regulators.13 min
Module 26 hrs3 topics
The Incident Response Lifecycle
The NIST and SANS models and how the phases connect.
Start module- The NIST SP 800-61 Incident Response LifecycleWalks through the NIST SP 800-61 lifecycle: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity.13 min
- The SANS PICERL ModelDescribes the SANS PICERL model (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) and when practitioners prefer it over NIST.13 min
- Comparing Incident Response FrameworksCompares NIST SP 800-61, SANS PICERL, ISO/IEC 27035, and CREST on scope and phase granularity to help choose or blend frameworks.13 min
Module 36 hrs3 topics
Preparation and Forensic Readiness
Plans, teams, tooling and readiness before an incident hits.
Start module- Incident Response Policy and PlanCovers the incident response policy and plan: scope, authority, communication channels, and links to business continuity and disaster recovery.13 min
- Building a Computer Security Incident Response TeamCovers CSIRT models (internal, outsourced, hybrid), core roles, staffing, on-call rotation, and relationships with national CERTs and retainer firms.13 min
- Forensic Readiness and Response ToolkitsDefines forensic readiness as collecting and preserving evidence at incident declaration, and inventories jump-bag tools for rapid capture.13 min
Module 46 hrs3 topics
Detection and Analysis
Alerting, triage, scoping and confirming an incident.
Start module- Detection Sources and Alert PipelinesSurveys alert sources including SIEM, EDR, IDS/IPS, cloud monitoring, and threat intel feeds, and how signals reach analysts via correlation.13 min
- Triage and Incident PrioritisationDescribes triage methods for confirming a real incident and setting escalation urgency, using severity matrices and business-impact scoring.13 min
- Scoping and Confirming an IncidentExplains scoping from an alert to a full picture of affected systems, accounts, and data, through lateral-movement tracing and timeline construction.13 min
Module 56 hrs3 topics
Containment Strategies
Short- and long-term containment without destroying evidence.
Start module- Short-Term Containment TechniquesCovers immediate containment such as network isolation, account lockouts, and traffic blocking, balanced against tipping off the attacker or losing evidence.13 min
- Long-Term Containment and System HardeningCovers durable mitigations such as patching, credential rotation, and firewall changes that replace temporary controls while operations continue.13 min
- Evidence Preservation During ContainmentCovers chain-of-custody discipline during containment: write-blocker use, forensic image acquisition priority, and legally defensible documentation.13 min
Module 66 hrs3 topics
Eradication and Recovery
Removing the threat and restoring operations safely.
Start module- Threat Eradication MethodsExplains removing an incident's root cause: malware removal, backdoor elimination, rogue account deletion, and verifying eradication before recovery.13 min
- Safe System Recovery and RestorationCovers restoring affected systems from validated clean backups through staged reintroduction, dependency mapping, rollback plans, and recovery criteria.13 min
- Validating Recovery and Monitoring for RecurrenceDescribes verifying restored systems are clean before lifting elevated monitoring, using an extended observation window and recurrence criteria.13 min
Module 76 hrs3 topics
Live Response and Volatile Data
Capturing memory, processes and network state during response.
Start module- Volatile Data and the Order of VolatilityIntroduces the order of volatility, from CPU registers and RAM through processes and disk artefacts, per RFC 3227 capture-sequence guidance.13 min
- Memory Acquisition and Analysis in Incident ResponseExplains capturing live memory with tools like Magnet RAM Capture, WinPmem, and LiME, and the injected code and attacker tooling it can surface.13 min
- Live Network State and Process CaptureCovers capturing transient artefacts such as connections, listening ports, ARP tables, and running processes to guide containment before full acquisition.13 min
Module 86 hrs3 topics
The Security Operations Centre
The SOC, roles, monitoring and escalation.
Start module- SOC Structure and the Tier ModelDescribes SOC analyst tiers from Tier 1 triage through Tier 2/3 response and threat intelligence, and contrasts in-house, co-managed, and outsourced models.13 min
- SOC Tooling and the SIEMSurveys the SOC technology stack centred on the SIEM, alongside SOAR, EDR, threat intelligence platforms, and case management for faster detection and response.13 min
- Escalation Procedures and SLA ManagementDefines SOC escalation paths, contact trees, and handoff documentation, and how SLAs govern response-time commitments and breach tracking.13 min
Module 96 hrs3 topics
Threat Hunting and Playbooks
Proactive hunting and repeatable response playbooks.
Start module- Proactive Threat Hunting MethodologyExplains threat hunting as human-led work assuming a breach occurred, covering hypothesis-driven, IOC-driven, and TTP-based approaches.13 min
- Developing and Using Incident Response PlaybooksDescribes building scenario-specific playbooks for ransomware, phishing, and credential compromise, tested via tabletop exercises and kept current.13 min
- MITRE ATT&CK in Threat Hunting and Incident ResponseIntroduces MITRE ATT&CK as a knowledge base of adversary tactics and techniques used to prioritise controls, map behaviour, and guide hunting.13 min
Module 106 hrs3 topics
Post-incident Review and Notification
Lessons learned, reporting, and breach-notification duties.
Start module- Post-Incident Review and Lessons LearnedDescribes the after-action review once an incident closes: timeline reconstruction, root-cause analysis, and turning findings into concrete fixes.13 min
- Incident Reporting and DocumentationCovers documentation from the initial ticket through the final report, including evidence custody records and chain-of-evidence requirements.13 min
- Breach Notification Laws and ObligationsSurveys breach-notification duties under GDPR, US state laws, India's DPDP Act, and sector regulators like RBI and HIPAA, and their triggers and deadlines.13 min