Training
Incident Response Training
Master security incident response: detection, forensic analysis, containment, eradication and crisis communication following NIST and PRIS frameworks.
Duration
12h
Level
Advanced
Category
Training
Prerequisites
System administration experience (Linux/Windows) and knowledge of basic SOC concepts (logs, alerts, SIEM).
What you will learn
- Apply the NIST incident response cycle (Preparation, Detection, Containment, Eradication, Recovery)
- Conduct forensic analysis on a compromised system (logs, artifacts, timeline)
- Use a SIEM to correlate events and identify an attack chain
- Write a structured incident report and communicate during a crisis
- Implement a response playbook adapted to the most common incidents
Program
IR preparation and planning
Setting up an incident response plan, defining roles, establishing a war room and managing intervention tools.
Detection and initial analysis
SIEM alert correlation, event triage, identification of indicators of compromise (IOC) on a real case.
Forensic analysis
Evidence collection (memory dump, disk image), Windows/Linux log analysis, reconstruction of an attack timeline.
Containment, eradication and recovery
Isolating compromised systems, removing malicious artifacts, secure service restoration.
Crisis communication and post-incident review
Incident report writing, communication to management and regulators, post-incident review meeting.
Who is this for?
Why on CyberAct?
Incident scenarios are AI-generated and injected into a real SIEM environment with realistic fake logs. Each learner receives a unique incident to investigate, making cheating impossible and the experience directly transferable to real incidents.
Related content
Ready to train your teams?
Access the full CyberAct catalog on your dedicated platform.