Incident Response Learning Path

Learn the fundamentals of incident response.

15 hours, 49 minutes

Start 7-Day Free Trial
View All Training

Quick facts

About this learning path

  • courses

    100% online

  • Duration

    15 hours, 49 minutes

  • Assessment

    questions

About Incident Response

This learning path starts with a high-level discussion of what happens at each phase of responding to an incident, followed by a technical deep dive into some of the more exciting parts of memory, network and host analysis and forensics. This learning path is for anyone wishing to apply learned forensics and offensive knowledge such as ethical hacking to the incident response process.

 

Syllabus

Incident Response Skill Assessment

Assessment - 51 questions
Introduction to Incident Response

Course - 00:56:00
In this course, we will dig into the NIST phases of incident response. We will also talk about business continuity and DR, specifically how it relates to incident response. Lastly, we dig into creating a playbook that fits your organization and its business needs. We also address the team required to realize the playbook and policies.
Stage 1 - Preparation

Course - 00:33:00
This course goes into some detail with common definitions and severity criteria, with special attention being paid to making sure the student understands that the severity criteria should be based on overall organizational definitions and procedures. The latter part of the course goes into the importance of asset inventory and identification as a basis for establishing severity criteria. All these pieces are required for proper preparation for any incident.
Stage 2 - Identification

Course - 00:38:00
This course deals specifically with how incidents are identified, as well as the classification levels that incidents might fall within. It also reminds the student that these classification levels are established with input from upper management and the rest of the organization. We go into details of notifying the appropriate parties of the incident and how to do that properly. We end this course with a discussion of common tools and techniques.
Stage 3 - Containment

Course - 00:37:00
This course explores containment, and the proper scoping and management of it. We examine the details of how to contain an incident and, more importantly, how to define what containment means. We also explore common containment tools.
Stage 4 - Investigation

Course - 00:23:00
In this course, you’ll learn the questions asked in normal investigations and how to properly answer them. You’ll explore the important data sources these answers are pulled from and the role this process plays in incident response overall.
Stage 5 - Eradication

Course - 00:27:00
Dive into what it takes to remove threats from and environment after the threat has been contained. We’ll also take a look at how to verify the threat has been eradicated and address proper notification of eradication to other authorized parties. Lastly, we’ll discuss some common tools for eradication.
Stage 6 - Recovery

Course - 00:19:00
This course shows how we tie directly into business continuity and disaster recovery at this phase. We deal with how to restore systems in the least disruptive and most efficient way, as well as defining what constitutes "recovered." Finally, we look at validation and sign-off of recovery.
Stage 7 - Follow Up/Lessons Learned

Course - 00:13:00
This course deals with how to effectively assess how well the team responded. It also looks at implementing needed improvements and how to ingest feedback from the rest of the organization or even outside organizations.
Technical Deep Dives with Tools of the Trade

Course - 04:01:00
Incident Response Project Course

Course - 07:32:00
Use your incident response skills along with tools like Wireshark, Zeek and Volatility to respond to real-world scenarios. In the first project, you'll investigate a "watering hole attack" that may have affected someone in the IT department. In the second project, you'll need to investigate an SQL injection attack that may have led to credit card data being exfiltrated.

Meet the author

Keatron Evans

Keatron Evans is at the forefront of AI-driven cybersecurity innovation. As VP of Portfolio Product and AI Strategy at Infosec, he leads the development of cutting-edge solutions that are redefining industry standards. Keatron is a sought-after speaker at major industry events like the RSA Conference and a trusted expert for media outlets, including CNN and Fox News. 

Learn More

The details

Learning path insights

How to claim CPEs

Should you complete this learning path, you’ll be able to download a certificate of completion. Use this to claim your CPEs or CPUs.

Associated NICE Work Roles

All Infosec training maps directly to the NICE Workforce Framework for Cybersecurity to guide you from beginner to expert across 52 Work Roles.

  • All-Source Analyst
  • Mission Assessment Specialist
  • Exploitation Analyst

No software. No set up. Unlimited access.

Skip the server racks and spin up a realistic environment with one click. Infosec Skills cyber ranges require no additional software, hardware or server space so your team can spend less time configuring environments and more time learning. Unlimited cyber range access is included in every Infosec Skills subscription so your team can skill up however they learn best.

Start 7-Day Free Trial

Unlock 7 days of free training

  • 1,400+ hands-on courses and labs
  • Certification practice exams
  • Skill assessments
Start a Free Trial

Plans & pricing

Infosec Skills Personal

$299 / year

Buy Now 7-Day Free Trial
  • 190+ role-guided learning paths (e.g., Ethical Hacking, Threat Hunting)
  • 100s of hands-on labs in cloud-hosted cyber ranges
  • Custom certification practice exams (e.g., CISSP, Security+)
  • Skill assessments
  • Infosec peer community support

Infosec Skills Teams

$799 per license / year

Book a Meeting
  • Team administration and reporting
  • Dedicated client success manager
  • Single sign-on (SSO)
    Easily authenticate and manage your learners by connecting to any identity provider that supports the SAML 2.0 standard.
  • Integrations via API
    Retrieve training performance and engagement metrics and integrate learner data into your existing LMS or HRS.
  • 190+ role-guided learning paths and assessments (e.g., Incident Response)
  • 100s of hands-on labs in cloud-hosted cyber ranges
  • Create and assign custom learning paths
  • Custom certification practice exams (e.g., CISSP, CISA)
  • Optional upgrade: Guarantee team certification with live boot camps

Learn about scholarships and financing with

Affirm logo