Back to learning pathsInvestigation & Response
Connect evidence across endpoints and networks. Reconstruct the story and communicate it.
Learn structured incident investigation workflows: from initial alert triage through multi-host timeline reconstruction and defensible executive reporting.
Intended goal
Confidently answer the three essential responder questions: What happened? What evidence proves it? What should the team do next?
Suggested baseline skills
Understanding of network protocols (DNS, HTTP/S, SMB, Kerberos)- Basic endpoint forensics concepts (process trees, timestamps, persistence points)
Learning progression
Initial Alert Triage & Scope Determination
Quickly separate high-fidelity signals from benign noise, identifying the affected hosts and user accounts.
Multi-Source Evidence Correlation
Pivot between endpoint Sysmon logs, Zeek network connections, and authentication records to uncover lateral movement.
Reconstruct an Objective Timeline
Assemble an unbroken chronological sequence of attacker activity, noting dwell time, access points, and exfiltration attempts.
Produce Defensible Incident Briefings
Draft clear, actionable technical reports and executive summaries that explain the root cause and immediate remediation actions.
Your first resource
Begin with this free, practical session before advancing through the sequence.
Think Like a Defender: Tabletop Exercise
43 min
Blue vs. Red with AI
From Attacker Playbooks to Defender Detections: the flagship curriculum that goes deep in this area.
