Incident response: from preparation to lessons learned
Following NIST SP 800-61, you detect, contain, eradicate and recover from incidents, managing chain of custody, communication and lessons learned.
Level 301 · 20 lessons · 18 practice labs
Lessons
Preparation
- NIST SP 800-61 and the incident response lifecycle: You link preparation, detection and analysis, containment, eradication, recovery and lessons learned to NIST CSF 2.0.
- The incident response plan and the CSIRT: You prepare an incident response plan defining team roles, decision rights and the communication chain.
- Events versus incidents: classification and severity: You decide whether a finding counts as an incident and set its severity by impact.
- Readiness: contact list, access and jump kit: You prepare the contact list, emergency access and toolkit in advance so nothing has to be hunted for during an incident.
- Short task: prepare a jump-kit list for a small company
Detection and analysis
- First response: what to do in the first hour: You carry out the first-hour steps in order: gather facts, open a record, preserve evidence and call in the team.
- Scoping: affected systems and accounts: You search for indicators across the environment to establish which systems, accounts and data are affected.
- Order of volatility and collecting from live systems: You collect data that can vanish, such as memory, network connections and process lists, in the right order with minimal footprint.
- Chain-of-custody forms and evidence logs: You keep complete records of who collected each piece of evidence, when, and whose hands it passed through.
- Building an incident timeline from logs: You merge logs from different sources, minding time zones, into a timeline that shows how the incident unfolded.
- Short task: scope an alert and list what is affected
Containment, eradication, recovery
- Containment: isolate, disable accounts, block: You choose a containment option that stops the spread without destroying evidence or halting the business unnecessarily.
- Eradication: removing the root cause and persistence: You find the entry point, planted accounts and persistence mechanisms and confirm they are fully removed.
- Recovery and heightened monitoring: You restore systems from clean backups or rebuilds and use heightened monitoring for a while to catch any return.
- Short task: justify a containment decision for a compromised server
Communication and closure
- Incident communication: internal, customers, regulators: You decide who learns what, when and through which channel, and prepare accurate, consistent messages.
- Legal notification deadlines and working with counsel: You put GDPR, NIS2 and sector reporting deadlines on a timeline and decide together with legal counsel.
- Writing the incident report: You write a clear incident report with an executive summary, timeline, root cause, impact and recommendations.
- Lessons-learned meeting and tracking improvements: You lead a blameless review meeting and track the resulting actions with owners and dates.
- Capstone: handle a compromised mailbox incident end to end: In a fictional company, you detect, contain and preserve evidence for a compromised mailbox, plan notifications and write the report.
Practice labs
- Order the incident response life cycle: Place ten actions into the NIST SP 800-61 phases.
- Prepare a jump bag list: Write a jump bag list for a small company with contact list, access and tools.
- Find the gaps in a response plan: Review a fictional response plan and report the missing roles, access and decision points.
- Routine log or security incident: Classify eight reports as incident or not and assign a severity.
- Order the first-hour actions: Order the first-hour actions for a phishing report by priority and write each one's owner.
- Derive the scope from an alert: Start from one endpoint alert and list the affected systems and accounts using prepared logs.
- Start a chain of custody form: Fill in the form for three collected items with hash, time and receiver.
- Collect volatile data from a live system: Collect process, connection and session data from the lab server in order of volatility and hash it.
- Build an incident timeline from logs: Combine three log sources into a timeline from first access to detection.
- Match the containment options: Match isolation, account disabling and blocking options to six situations.
- Justify a containment decision: Choose between shutdown and network isolation for a compromised server and weigh evidence against business impact.
- Isolate the lab server and verify: Isolate the server with firewall rules and prove by testing that only responder access stays open.
- List the persistence points: Find the added account, key and scheduled job on the prepared lab server.
- Remove the root cause: Close the entry path, clean the persistence and prove each step with a verification command.
- A recovery and close-monitoring plan: Write a plan with the order of returning the server to service, indicators to watch and the rollback condition.
- Write a status update for a stakeholder: Write a five-sentence status update for a non-technical manager.
- Calculate the notification deadlines: Derive the notification deadlines for a personal data breach under the rules of different countries.
- Manage an email account incident end to end: Manage and document the compromised email account scenario at Mercanköşk Otelcilik from detection to lessons learned.
About this course
Following NIST SP 800-61, you detect, contain, eradicate and recover from incidents, managing chain of custody, communication and lessons learned.
What you will learn
- Preparation
- Detection and analysis
- Containment, eradication, recovery
- Communication and closure
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.