Incident Response Fundamentals

Prepare for, investigate, contain and learn from security incidents, using the Linux command line to build timelines and preserve evidence you can prove is unchanged.

Intermediate · Cybersecurity · about 9.5 hours · 4 modules · certificate on completion

Taught by Carlòs Ramirèz, Cataliná Ionescù, AI Learning Companions.

About this course

Every organisation has security incidents; what differs is how well they respond. This course teaches the work of incident response from preparation to lessons learned, following the lifecycle in NIST's incident handling guide: preparation; detection and analysis; containment, eradication and recovery; and post-incident activity.

You'll practise on one realistic case that runs through the course: a web server where an account was taken over overnight. You'll prepare a response kit with a script that collects a system's live state and hashes it, build a minute-by-minute UTC timeline from authentication and web server logs written in different time zones, preserve the evidence and prove with sha256sum that a returned copy was altered, then plan the containment, eradication, recovery and communications, and finish with a lessons-learned report and a playbook. The capstone is a fresh case, investigated end to end. Everything runs on your own Linux machine against sample data that comes with the course.

What you'll learn

  • Explain the incident response lifecycle and prepare a team, a plan and a response kit for it
  • Classify and prioritise incidents by their impact on the business
  • Build a UTC timeline of an incident from several logs with grep, sort and date
  • Preserve evidence and prove it's unchanged with SHA-256 hashes and a chain of custody
  • Plan containment, eradication and recovery, and communicate clearly while an incident runs
  • Run a lessons-learned review and turn it into a playbook

Skills you'll gain

Incident response lifecycle, Incident triage and severity, Log analysis, Timeline building, Evidence preservation, Hashing with SHA-256, Chain of custody, Containment and recovery, Incident communication, Playbooks and lessons learned

Tools

Linux command line, sha256sum, grep, sort and awk

Before you start

Comfort with the Linux command line: cd, ls, less, pipes and running a script. A Linux environment of your own: a Linux computer, a virtual machine such as Ubuntu in VirtualBox, or WSL on Windows. macOS's own date and sha256 tools differ, so use a Linux virtual machine there. No security background is assumed beyond the basics of accounts, logs and networks.

Modules

  1. The incident response lifecycle and preparation

    What counts as an incident, the four phases of responding to one, and the preparation that decides how well the first hour goes: plans, roles, tools and a way to judge severity.

    • Incidents and the response lifecycle (10 min)
    • Preparation: plans, roles and tools (12 min)
    • Classifying and prioritising incidents (10 min)
    • Hands-on lab: Build your incident response kit

  2. Detection and analysis: building a timeline

    Confirm an incident and find out what happened, in order: validating the first report, lining up events from several logs in UTC, and following indicators to find the full scope.

    • From first report to confirmed incident (10 min)
    • Building a timeline from logs (12 min)
    • Scoping: indicators and pivoting (10 min)
    • Hands-on lab: Build an incident timeline from sample logs

  3. Evidence: preserve it and prove it's unchanged

    Collect evidence in the right order, fingerprint it with SHA-256 so any change can be detected, and keep a chain of custody that shows who handled it and when.

    • Order of volatility and live collection (10 min)
    • Hashes and verification (10 min)
    • Chain of custody and handling evidence (10 min)
    • Hands-on lab: Preserve and verify evidence

  4. Containment, recovery and lessons learned

    Stop the harm without destroying evidence, remove what the intruder left, restore service safely, keep everyone informed, and turn what the team learned into a playbook.

    • Containment, eradication and recovery (12 min)
    • Communicating during an incident (10 min)
    • Lessons learned and playbooks (12 min)
    • Hands-on lab: Write the response plan and lessons learned for case 2026-014

Project: Investigate case 2026-021 from start to finish

Early on 3 October 2026 an administrator noticed a 2 GB outbound transfer from files01, the shared project file server, in the overnight flow report. The account involved belongs to a contractor whose contract ended on 30 September. You receive copies of the server's authentication log, the account's shell history (with epoch timestamps), a flow log from the network and the case notes. Investigate as you've learned: preserve and verify the evidence, build a UTC timeline across all three sources, work out what happened, to what data and how, then plan the containment, eradication and recovery, write updates for the technical team and for the firm's leadership, and finish with a lessons-learned report and an updated playbook.

Part of

The products this course names are trademarks of their owners, who haven't made or endorsed it.

Start the course free