Volver a las rutas de aprendizajeInvestigation & Response
Connect evidence across endpoints and networks. Reconstruct the story and communicate it.
Learn structured incident investigation workflows: from initial alert triage through multi-host timeline reconstruction and defensible executive reporting.
Objetivo
Confidently answer the three essential responder questions: What happened? What evidence proves it? What should the team do next?
Habilidades base sugeridas
Understanding of network protocols (DNS, HTTP/S, SMB, Kerberos)- Basic endpoint forensics concepts (process trees, timestamps, persistence points)
Progresión del aprendizaje
Initial Alert Triage & Scope Determination
Quickly separate high-fidelity signals from benign noise, identifying the affected hosts and user accounts.
Multi-Source Evidence Correlation
Pivot between endpoint Sysmon logs, Zeek network connections, and authentication records to uncover lateral movement.
Reconstruct an Objective Timeline
Assemble an unbroken chronological sequence of attacker activity, noting dwell time, access points, and exfiltration attempts.
Produce Defensible Incident Briefings
Draft clear, actionable technical reports and executive summaries that explain the root cause and immediate remediation actions.
Tu primer recurso
Comienza con esta sesión gratuita y práctica antes de avanzar en la secuencia.
Think Like a Defender: Tabletop Exercise
43 min
Blue vs. Red with AI
From Attacker Playbooks to Defender Detections: el plan de estudios insignia que profundiza en esta área.
