IR-200: Foundational Incident Response (OSIR)

Introduces the core concepts of incident response, focusing on NIST Special Publication 800-61

Learn about the roles and responsibilities of an incident response analyst and incident response teams, and the frameworks they use (CREST, SANS, NIST)

Dive into NIST SP800-61’s four phases of Incident Response

Review examples of good and bad external communications to learn the importance of incident response communication plans

Identify commonly used opportunistic and targeted attacks to improve your ability as an incident handler to respond and recover from security incidents

Recognize and analyze malicious activities to decide which actions you should take to manage and mitigate them

Identify, collect, analyze, and preserve digital evidence from cybersecurity attacks

Walk through the process of opening a case, adding assets, creating an event timeline, and identifying through an IRIS lab

Isolate and neutralize detected threats using isolation techniques and containment strategies

Focus on identifying and eliminating threats quickly to restore normal operations

Develop assessments to evaluate the effects a security incident has or could have on an organization

Create technical records of incidents to improve responses to future incidents and reinforce the value of information security services