Skip to main content

Preview build: sign-in and grading run on the server. MFA is not enabled, and storage is in server memory so it does not survive a restart.

LearnDefend
Create account

This course is coming soon. It is not yet open for enrollment, and no payment is taken.

The outline and outcomes below reflect what this course will cover. Check back soon.

Coming soonIntermediate

Incident Response Playbooks

From alert to eradication with a calm, repeatable process.

By LearnDefend DFIR Unit · Incident Response

About this course

Build the muscle memory of incident response: scope with evidence, contain without tipping off the adversary, eradicate the root cause, recover safely, and write the report leadership actually needs.

What you'll learn

  • Apply the IR lifecycle to a live scenario.
  • Scope an incident from evidence, not assumption.
  • Choose containment that does not alert the adversary.

Course outline

  1. 1Preparation and the IR lifecycle
  2. 2Scoping and containment
  3. 3Eradication and recovery
  4. 4The incident report

Prerequisites

  • Familiarity with logs, endpoints and basic triage.