CySA+ exam prep: incident response
You read an incident through attack frameworks, build a timeline from memory and disk images, contain and eradicate, and report the root cause and lessons.
Level 301 · 14 lessons · 12 practice labs
Lessons
Frameworks and preparation
- Attack frameworks: the kill chain, ATT&CK and the diamond model
- Preparation: playbooks, communication plan, toolkit
- Detection and first triage
- Short task: map an alert to an ATT&CK technique
Analysis and containment
- Scoping: affected systems and the timeline
- Memory analysis: processes, connections, injected code
- Disk analysis: timelines and deleted files
- Containment: isolation, disabling accounts, blocking
- Chain of custody and legal hold
- Short task: build the timeline of a compromised server
Recovery and after
- Eradication and recovery
- Root cause analysis
- Post-incident review and improvement
- Capstone: handle an incident that starts with phishing, end to end
Practice labs
- Map an alert to an ATT&CK technique: You map six alert summaries to the right tactic and technique and point to the evidence line for each.
- Place an incident on the kill chain: You place a phishing incident's records onto the chain from reconnaissance to objectives and identify the missing stage.
- Link two incidents with the diamond model: You compare the infrastructure, capability and victim details of two incidents and argue whether the same adversary is behind both.
- Gather the facts in the first five minutes: You answer who, what, where and when for an alert from the logs and write a first triage note.
- Determine the affected hosts: You search all logs for the account and IP the attacker used and list the hosts touched and the time window.
- Build a compromised server's timeline: You merge authentication, web and file system timestamps into a minute-by-minute timeline from first access to exfiltration.
- List processes in a memory dump: With Volatility you extract the process tree from a memory dump and flag the process spawned by an unusual parent.
- Find connections and injected code in memory: You find the suspicious process's open connections and injected memory region and report the outside address.
- Find a deleted tool and its traces in a disk image: With The Sleuth Kit you recover a deleted file, find when it ran in the timeline and add its hash to the evidence list.
- Disable a compromised account: You lock an account, end its open sessions, remove its keys and write what you did into the incident record.
- Isolate a host without spoiling evidence: You apply rules letting a server talk only to the analysis machine after first collecting memory and logs.
- Find the root cause and verify recovery: You close the root cause so a rebuilt server cannot be compromised the same way and verify with indicators that it is clean.
About this course
You read an incident through attack frameworks, build a timeline from memory and disk images, contain and eradicate, and report the root cause and lessons.
What you will learn
- Frameworks and preparation
- Analysis and containment
- Recovery and after
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.