🎯 What You'll Learn
- Apply a structured IR lifecycle
- Preserve and analyse evidence
- Contain and eradicate threats
- Run a clean recovery and review
About This Workbook
This track teaches incident response as a discipline. You learn to prepare, detect and analyse, contain and eradicate, and recover — while preserving evidence and communicating clearly under pressure.
Chapter 1 — Preparation
Readiness is most of incident response.
- Runbooks and roles
- Tooling
- Logging readiness
Chapter 2 — Detection & Analysis
Confirming and scoping an incident.
- Validating alerts
- Evidence preservation
- Scoping
Chapter 3 — Containment & Eradication
Stopping the bleeding and removing the threat.
- Short vs long-term containment
- Eradication
- Avoiding tip-off
Chapter 4 — Recovery & Lessons Learned
Getting back to normal and improving.
- Recovery
- Reporting
- Post-incident review
Keep going. Work through each chapter in order, then apply what you learned in the matching labs.