ForensicSpot10 modules
Incident Response and Management
Handling security incidents end to end: the IR lifecycle, forensic readiness, triage, containment, recovery, live response, the SOC, and post-incident reporting.
- 60hours
- 30topics
- 10modules
Module 16 hrs3 topics
Incident response foundations
What an incident is, why response matters, and key terms.
Start module- What Is a Security IncidentDefines what constitutes a security incident, distinguishing it from an event, alert, and breach. Introduces the taxonomy of incident types including data breaches, ransomware, insider threats, and service disruptions.13 min
- Incident Response Goals and PrinciplesExplains why organisations invest in formal incident response, covering the core objectives of minimising impact, preserving evidence, and restoring operations. Outlines guiding principles such as speed, proportionality, chain-of-custody discipline, and communication integrity.13 min
- Key Terms and Stakeholders in Incident ResponseDefines essential vocabulary including IOC, TTPs, threat actor, CSIRT, and escalation path. Maps the stakeholders involved in an incident response from technical responders to legal counsel, executives, and regulators.13 min
Module 26 hrs3 topics
The incident response lifecycle
The NIST and SANS models and how the phases connect.
Start module- The NIST SP 800-61 Incident Response LifecycleWalks through the four phases of the NIST Computer Security Incident Handling Guide: Preparation, Detection and Analysis, Containment/Eradication/Recovery, and Post-Incident Activity. Explains what activities and decisions belong to each phase and how they sequence together.13 min
- The SANS PICERL ModelDescribes the SANS six-step model: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. Compares PICERL to the NIST lifecycle and explains when practitioners prefer each framework.13 min
- Comparing Incident Response FrameworksPlaces NIST SP 800-61, SANS PICERL, ISO/IEC 27035, and CREST guidelines side by side on scope, phase granularity, and applicability. Helps organisations choose or blend frameworks to fit their regulatory context and operational maturity.13 min
Module 36 hrs3 topics
Preparation and forensic readiness
Plans, teams, tooling and readiness before an incident hits.
Start module- Incident Response Policy and PlanExplains how organisations document their commitment to incident response through a policy and a supporting plan that defines scope, authority, and communication channels. Covers the key sections of an IR plan and how it ties to business continuity and disaster recovery documents.13 min
- Building a Computer Security Incident Response TeamCovers CSIRT models including internal, outsourced, and hybrid teams, along with the core roles of team lead, analyst, legal liaison, and communications officer. Addresses staffing, on-call rotations, and relationships with national CERTs and external retainer firms.13 min
- Forensic Readiness and Response ToolkitsDefines forensic readiness as the organisational capability to collect and preserve digital evidence at the moment an incident is declared. Inventories the hardware and software tools, jump bags, and pre-positioned agents that enable rapid evidence capture without disrupting live systems.13 min
Module 46 hrs3 topics
Detection and analysis
Alerting, triage, scoping and confirming an incident.
Start module- Detection Sources and Alert PipelinesSurveys the systems that generate security alerts including SIEM, EDR, IDS/IPS, cloud-native monitoring, and threat intelligence feeds. Explains how raw signals flow through aggregation, correlation, and deduplication before reaching an analyst.13 min
- Triage and Incident PrioritisationDescribes structured triage methods for determining whether an alert represents a real incident and, if so, how urgently it must be escalated. Covers severity matrices, business-impact scoring, and the risk of false positives consuming analyst time.13 min
- Scoping and Confirming an IncidentExplains how responders expand from an initial alert to a full picture of affected systems, accounts, and data. Covers lateral movement tracing, timeline construction, and the declaration threshold that moves a suspected event into a confirmed incident with formal tracking.13 min
Module 56 hrs3 topics
Containment strategies
Short- and long-term containment without destroying evidence.
Start module- Short-Term Containment TechniquesCovers immediate actions to stop an incident from spreading while preserving the ability to investigate, including network isolation, account lockouts, and traffic blocking. Balances speed of containment against the risk of alerting the attacker or destroying volatile evidence.13 min
- Long-Term Containment and System HardeningAddresses the intermediate phase where temporary controls are replaced with durable mitigations such as patching, credential rotation, firewall rule changes, and access revocation. Explains how to maintain business operations safely during prolonged containment.13 min
- Evidence Preservation During ContainmentDetails the chain-of-custody disciplines and technical steps required to ensure evidence integrity while the threat is being isolated. Covers write-blocker use, forensic image acquisition priority, and documentation standards that hold up in legal or regulatory proceedings.13 min
Module 66 hrs3 topics
Eradication and recovery
Removing the threat and restoring operations safely.
Start module- Threat Eradication MethodsExplains how responders remove the root cause of an incident, including malware removal, backdoor elimination, rogue account deletion, and unauthorised configuration cleanup. Discusses the verification steps needed to confirm eradication before moving to recovery.13 min
- Safe System Recovery and RestorationCovers the ordered process of bringing affected systems back into production, from validated clean backups through staged reintroduction and enhanced monitoring. Addresses dependency mapping, rollback plans, and the criteria used to declare recovery complete.13 min
- Validating Recovery and Monitoring for RecurrenceDescribes how organisations verify that restored systems are clean and operationally sound before lifting elevated monitoring. Explains the extended observation window, tripwire placements, and recurrence criteria that confirm the incident is fully resolved.13 min
Module 76 hrs3 topics
Live response and volatile data
Capturing memory, processes and network state during response.
Start module- Volatile Data and the Order of VolatilityIntroduces the concept that digital evidence degrades or disappears at different rates, from CPU registers and RAM through running processes, network connections, and on-disk artefacts. Explains RFC 3227 guidance on the sequence in which live data should be captured.13 min
- Memory Acquisition and Analysis in Incident ResponseExplains how responders capture a snapshot of physical memory from a live system using tools such as Magnet RAM Capture, WinPmem, and LiME. Describes what artefacts memory analysis can surface including injected code, encryption keys, and attacker tooling that leaves no disk trace.13 min
- Live Network State and Process CaptureCovers the collection of transient network artefacts including active connections, listening ports, ARP tables, and DNS cache alongside running process trees and open file handles. Explains how this live triage data guides containment decisions before a full forensic acquisition begins.13 min
Module 86 hrs3 topics
The security operations centre
The SOC, roles, monitoring and escalation.
Start module- SOC Structure and the Tier ModelDescribes how Security Operations Centres are organised into analyst tiers ranging from alert monitoring and initial triage at Tier 1 through incident response and threat intelligence at Tiers 2 and 3. Contrasts in-house, co-managed, and fully outsourced SOC models and the trade-offs each involves.13 min
- SOC Tooling and the SIEMSurveys the core technology stack of a modern SOC, centred on the SIEM for log aggregation and correlation, with supporting tools such as SOAR, EDR, threat intelligence platforms, and case-management systems. Explains how these tools integrate to reduce mean time to detect and respond.13 min
- Escalation Procedures and SLA ManagementDefines the escalation paths SOC analysts follow when an alert exceeds the scope of their tier, including criteria, contact trees, and handoff documentation requirements. Explains how service-level agreements govern response time commitments and how breaches are tracked and reported.13 min
Module 96 hrs3 topics
Threat hunting and playbooks
Proactive hunting and repeatable response playbooks.
Start module- Proactive Threat Hunting MethodologyExplains threat hunting as a human-led iterative process that assumes a breach has already occurred and seeks to uncover threats that automated detection missed. Covers hypothesis-driven, IOC-driven, and TTP-based hunting approaches and the data sources hunters rely on.13 min
- Developing and Using Incident Response PlaybooksDescribes how organisations create scenario-specific response playbooks that codify the exact steps, tools, and decision gates for common incident types such as ransomware, phishing, and credential compromise. Explains how playbooks are tested through tabletop exercises and kept current as the threat landscape evolves.13 min
- MITRE ATT&CK in Threat Hunting and Incident ResponseIntroduces the MITRE ATT&CK framework as a structured knowledge base of adversary tactics, techniques, and procedures used to prioritise detective controls and map observed attacker behaviour. Explains how IR teams use ATT&CK Navigator to identify coverage gaps and guide both hunting hypotheses and playbook design.13 min
Module 106 hrs3 topics
Post-incident review and notification
Lessons learned, reporting, and breach-notification duties.
Start module- Post-Incident Review and Lessons LearnedDescribes the structured after-action review process conducted once an incident is closed, including timeline reconstruction, root-cause analysis, and identification of control failures. Explains how findings are translated into concrete improvements to policies, tooling, and training rather than left as narrative reports.13 min
- Incident Reporting and DocumentationCovers the internal and external documentation produced during and after an incident, from the initial incident ticket through the final incident report used by management and auditors. Addresses evidence custody records, timeline logs, and the chain-of-evidence requirements that support legal action.13 min
- Breach Notification Laws and ObligationsSurveys the data-breach notification requirements imposed by major frameworks including GDPR, US state laws, India's DPDP Act, and sector-specific regulators such as RBI and HIPAA. Explains how organisations determine notification triggers, mandatory timelines, required content, and the legal consequences of non-compliance.13 min