Incident Response

Curriculum

The 30 lessons are grouped into six chapters. Working through from chapter 1 is recommended, but you can also dip into the parts you need. * Standard-library Python runs right in the browser. All commands and logs come from fictional hosts.

Chapter 1 — The big picture (lessons 1–5)

What an incident is, the response lifecycle, the team, preparation and how to judge severity.

What Is an Incident?

The difference between an event and an incident, and the point at which an alert becomes something you respond to, using a fictional company.

Free

The Incident Response Lifecycle

The response cycle in NIST SP 800-61: the four phases of Revision 2 (2012) compared with Revision 3 (2025), which reorganises them around CSF 2.0.

Free

The CSIRT: Roles and Structure

Splitting the roles of command, technical lead, communications and scribe, the departments to involve, and outside partners such as JPCERT/CC.

Free

Preparation

Contact lists, runbooks, access and tools, logs and tabletop exercises: what to put in place and test before anything happens.

🔒 Basic

Deciding Severity

A severity matrix based on impact and spread, what each level sets in motion, and a Python exercise classifying fictional incidents.

🔒 Basic

Chapter 2 — Detection and first response (lessons 6–10)

What to record, what to protect and whom to tell in the first hours after something looks wrong.

The First 30 Minutes

Confirm it is real, get a rough sense of scope, open a ticket and start the action log, and know what not to do in the first 30 minutes.

🔒 Basic

Keeping a Journal as You Work

What to put in a timestamped action log, handling time zones, recording late entries and corrections, and tidying a log with Python.

🔒 Basic

Estimating the Scope

Estimating the affected assets, users and data, sorted into confirmed, possible and unknown, and counting from a log with Python.

🔒 Basic

Preserving Evidence

Preserving the most volatile data first and why not to reboot in a hurry; securing logs, keeping custody records and handing over to forensics.

🔒 Basic

First Notifications

What goes in the first notice, escalation by severity, sharing on a need-to-know basis, and out-of-band channels.

🔒 Basic

Chapter 3 — Analysis (lessons 11–15)

Building a timeline, tracing entry and lateral movement, and compiling IOCs, plus the common analysis traps.

Building a Timeline

Merging several logs into one sequence in UTC, watching for time zones, missing years and clock drift, and keeping the source of every entry.

🔒 Basic

Finding the Way In

Listing possible entry points as hypotheses, looking for the traces each would leave, and grading them on evidence both for and against.

🔒 Basic

Tracing Lateral Movement

Following the spread to other hosts through authentication logs, by turning logins into a source-to-destination graph and walking it in time order.

🔒 Basic

Compiling Indicators of Compromise

Turning hashes, IPs, domains and other IOCs into a list with context and confidence, sharing it safely with defanging and TLP, and minding expiry and false positives.

🔒 Basic

Pitfalls in Analysis

Typical ways analysis goes wrong, such as confirmation bias, reading missing logs as no activity, and time mix-ups, and the habits that guard against them.

🔒 Basic

Chapter 4 — Containment and eradication (lessons 16–20)

Containing accounts, hosts and networks and removing the cause, including how to respond to ransomware.

Choosing a Containment Strategy

Short-term versus long-term containment, and choosing how and when to act by weighing business impact, evidence preservation and the risk of tipping off the attacker.

🔒 Basic

Containing Accounts

Disabling compromised accounts and revoking not only passwords but sessions, tokens and keys, then checking for persistence the attacker left behind.

🔒 Basic

Containing Hosts and Networks

Isolating a compromised host without powering it off, stopping the spread with segmentation and blocking, and deciding the side effects and the conditions for lifting each block.

🔒 Basic

Eradication

Removing the persistence the attacker left, fixing the cause of the intrusion, deciding between rebuilding and cleaning, and verifying the system is clean.

🔒 Basic

Responding to Ransomware

What to do first in a ransomware incident: isolation and protecting backups, why paying is a decision for management and legal, and how recovery and reporting fit in.

🔒 Basic

Chapter 5 — Recovery and communication (lessons 21–25)

Bringing services back safely and explaining and reporting to people inside and outside the organisation.

Recovery procedures

Why you restore from a known-good state and how to choose the source. Checking integrity before going live, and the period of heightened monitoring afterwards.

🔒 Basic

Deciding when to return to service

The criteria for returning to service and a staged restart. Deciding from checklist status whether you can move to the next stage.

🔒 Basic

Explaining the incident inside and outside

Decide what to tell each audience and how often, and write in plain language. Always cover what is known, what is not, and when the next update comes.

🔒 Basic

Statutory reporting and notifying customers

Requirements and deadlines for breach reports to Japan's Personal Information Protection Commission and notices to individuals. Contractual notices, overseas users, and involving legal early.

🔒 Basic

Working with outside organisations

Police, JPCERT/CC, IPA, vendors and cyber insurers, and what each can do for you. Marking sharing limits with TLP and preparing contacts in advance.

🔒 Basic

Chapter 6 — Review and improvement (lessons 26–30)

Post-incident reviews, preventing recurrence, metrics and tabletop exercises. The course ends with an incident response plan.

The post-incident review

Running a blameless review. Revisiting the timeline to find the decision points, and turning findings into improvements with owners and due dates.

🔒 Basic

Root causes and preventing recurrence

Using the five whys to trace from the direct cause to causes in the system. Planning preventive, detective and corrective controls and tracking them to completion.

🔒 Basic

Measuring improvement with metrics

Defining MTTD, MTTC and MTTR and computing them from records. Mean versus median, not over-reading small samples, and not making the number the goal.

🔒 Basic

Designing a tabletop exercise

Setting the goal and scope and building a scenario from your own risks. Writing injects that add to the situation over time, and capturing improvements afterwards.

🔒 Basic

Wrap-up: writing an incident response plan

Bringing the whole course together in an incident response plan for Sample Inc. Keeping the plan alive, and where to go next.

🔒 Basic

Once you have finished all 30 lessons, move on to the Introduction to Digital Forensics course. See the order of courses on the security track page. Membership unlocks every course.