Detecting a threat is only the start. Once an analyst confirms that something real is happening, the team has to contain it, work out how far it spread, remove it, and get back to normal, all while preserving the evidence needed to understand what happened. This module covers how that work is organised and the techniques used to investigate.
You'll start with the incident response lifecycle, the stages a team moves through from preparation to recovery. Then you'll see how SOC teams turn that into playbooks for common incidents, learn the fundamentals of digital forensics, and finish with memory forensics, where an analyst examines what was running on a machine at the time of an attack.
Once you're comfortable here, move on to Vulnerability Management to look at finding and fixing weaknesses before attackers can use them.
How security teams structure their response using the NIST framework, its phases, and the kind of tasks an analyst handles at each stage.
A step-by-step look at how a SOC handles a common incident, using a phishing playbook as the worked example.
The basics of digital forensics and digital investigations, explained for people with no prior IT background.
A practical tutorial on analysing a memory dump with Volatility, covering hidden processes, executed commands, extracted files, and password hashes.