Incident Response Training

By the end of this course students will be able to do the following:

• Create and Deploy incident capabilities within your organization
• Build a solid foundation for acquiring and handling suitable evidence for later analysis
• Analyze collected evidence and determine the root cause of a security incident
• Learn to integrate digital forensic techniques and procedures into the overall incident response process
• Integrate threat intelligence in digital evidence analysis
• Prepare written documentation to use internally or with external parties such as regulators or law enforcement agencies.

Incident Response

• Incident response process
• Incident response framework
• Incident response plan
• Incident response playbook

Forensic Fundamentals

• Legal aspects
• Digital forensic fundamentals

Network Evidence Collection

• Preparation
• Network device evidence
• Packet capture
• Evidence collection

Host-Based Evidence

• Evidence volatility
• Evidence acquisition
• Evidence collection procedures
• Non-volatile data

Understanding Forensic Imaging

• Overview of forensic imaging
• Preparing a stage drive
• Imaging

Network Evidence Analysis

• Analyzing packet captures
• Analyzing network log files

Analyzing System Memory

• Memory evidence overview
• Memory analysis

Analyzing System Storage

• Forensic platforms

Forensic Reporting

• Documentation overview
• Incident tracking
• Written reports

Malware Analysis

• Malware overview
• Malware analysis overview
• Analyzing malware
• Dynamic analysis

Threat Intelligence

• Threat intelligence overview
• Threat intelligence methodology
• Threat intelligence direction
• Threat intelligence sources
• Threat intelligence platforms
• Using threat intelligence