Incident Response Course – Expert Cybersecurity

By the end of the course you will be able to do this, and to prove it:

• Lead the response to a major incident from the first alert to the final report, knowing at every point what comes next and who decides.
• Build your own methodology grounded in NIST SP 800-61 Rev. 3, ISO/IEC 27035 and MITRE ATT&CK, and apply it to situations no written procedure anticipates.
• Acquire evidence without destroying it and hold the chain of custody before an auditor, an insurer or a court.
• Investigate on Windows and on Linux, because the adversary moves between them and whoever looks at only one closes the case with the intruder still inside.
• Meet the real legal deadlines of GDPR, the Spanish LOPDGDD, the ENS and NIS2: what to report, to whom and within how many hours.
• Write the report — technical, executive and forensic — in the format delivered to a client and able to withstand cross-examination.

1. Introduction to incident response

Before touching a keyboard you need to know who decides and what may be done. This module prevents the most expensive mistake of all: improvising the chain of command at three in the morning.

• What counts as an incident and what does not
• The incident response lifecycle
• Roles, authority and decisions under pressure

2. Reference frameworks

Working to a recognised framework is what separates a report that stands up to an auditor from one that is merely a technical opinion.

• NIST SP 800-61 Rev. 3 and the Cybersecurity Framework 2.0
• ISO/IEC 27035, parts 1 to 4
• MITRE ATT&CK as a shared language

3. Legal and regulatory framework

In a serious incident the legal clock runs alongside the technical one. You will learn what to report, to whom and within how many hours, under European and Spanish law.

• GDPR and LOPDGDD: notification deadlines
• The Spanish ENS and the CCN-STIC 817 guide
• Actual status of the NIS2 transposition in Spain

4. Telemetry on Windows and Active Directory

Most companies fail to detect because they fail to log. This module leaves the domain ready so that, when something happens, there is a trail to follow.

• Advanced audit policy and command-line logging
• Sysmon: which events matter and why
• Kerberos, logon types and the events that count

5. Detection and SIEM

You will write rules that catch the attack in the real case used throughout the course, not textbook examples, and learn to tell a useful alert from the noise that swamps teams.

• Sigma rules and how they translate to each platform
• Wazuh: deployment, rules and use cases
• What a use case really detects, and what is noise

6. Log analysis and timeline building

The timeline is the deliverable that holds everything together and the one management and counsel will read. You will learn to build it with the source of every line evidenced.

• Normalisation, UTC and ISO 8601
• Correlating across sources
• Hayabusa, Chainsaw and Plaso

7. Phishing analysis

Nine out of ten incidents start in an email. Being able to reconstruct the entry point stops you closing a case with the door still open.

• Headers, SPF, DKIM and DMARC
• Attachment analysis and the initial access vector
• Reconstructing the point of origin

8. Disk and memory forensics

Volatile evidence is lost the moment you power off. Here you acquire it defensibly, with the tools used in expert work and the chain of custody a court requires.

• Acquisition with Wintriage and LinTriage
• Order of volatility and chain of custody
• Volatility 3, TSK and the Eric Zimmerman suite

9. Malware analysis

Without running anything dangerous, you will extract indicators and write YARA rules that catch the threat without firing false positives on your own software.

• Static analysis without executing anything
• Persistence: services, scheduled tasks, registry and systemd
• YARA rules: writing and validating them

10. Network analysis and exfiltration

The question that decides whether you must notify the authority is how much data left. This module teaches you to answer it with figures rather than guesses.

• Zeek: conn, dns and ssl
• Detecting beacons and DNS tunnels
• Quantifying the volume exfiltrated

11. Internal investigation and insider exfiltration

This is the most common engagement in a Spanish SME: a salesperson leaving for a competitor. You will learn to investigate it without infringing rights, which is where most cases collapse.

• Lawful basis: article 87 of the Spanish LOPDGDD
• USB history, ShellBags, shortcuts and the recycle bin
• Evidence containers and defending your conclusions

12. Containment and eradication

Containing badly either destroys the evidence or leaves the adversary inside. This module settles in advance what may be done immediately and what needs authorisation.

• Pre-authorised measures and those that are not
• Full eradication: persistence and credentials
• The mistakes that destroy evidence

13. Domain recovery

Restoring in the wrong order is how a company gets encrypted again the following Tuesday. You will learn the correct sequence and why identity comes first.

• Restoration order: identity before services
• Rotating krbtgt and service accounts
• Criteria for returning to production

14. Incident response in OT environments

In a factory, stopping the line costs thousands per hour and the call is not purely technical. Someone able to respond on the plant floor is scarce and paid accordingly.

• The Purdue model and IEC 62443
• Why a production line gets stopped
• Acquiring evidence without disturbing the process

15. Expert report and crisis management

The job does not end when you understand what happened, but when someone non-technical makes a decision based on what you wrote. It is marked to client-deliverable standard.

• Technical, executive and expert reports
• What you assert, what you evidence and what stays an indicator
• Communicating with management, insurer and regulator

16. Response and recovery policies

You leave with two templates ready to adapt in your own company, and the criteria to audit existing ones and find their gaps before an incident does.

• Policy, plan, procedure and runbook
• How to audit someone else’s policy
• Defensible RTO and RPO, and backups that survive the adversary

Annexes included

Material you can reuse at work from day one, not only during the course.

• Incident Response Policy template, ready to complete
• Disaster Recovery Plan template, ready to complete
• Both worked through on the course case study
• Lab build guide and the full set of incident artefacts

X. Final exam and Case Study · JMSec Certificate of Completion

A different incident from the one studied, with the artefacts supplied: no lab needed to sit the exam. The report is marked by a tutor with expert-witness experience.

• A single assessed piece: the final case study. Four hours, 100 points, 50 to pass
• Case study on an incident other than the one covered in class
• Technical report, executive summary and timeline with chain of custody
• Personal marking and a verifiable certificate of achievement

• All the material as PDF, downloadable so you can study offline.
• Your own lab: a full build guide for the four virtual machines that reproduce the network in the case study. They are run in phases, never all four powered on at once, so a machine with 16 GB RAM and around 230 GB of disk is enough. With 32 GB they can all stay up.
• One exercise per module on the real evidence from the incident: network logs, Windows and Linux events, the original phishing email and the ransom note.
• No lab needed for the exam: you receive the artefacts already prepared, just as an expert witness receives an image and an instruction.
• Personal marking of your report by a tutor with expert-witness experience.

• A single assessed piece: the final case study, four hours, 100 points, 50 to pass.
• Certificate of achievement, verifiable by code and QR.
• 12 months of access, extendable by 3 months for the practical.
• Spanish companies: eligible for FUNDAE funding. If your employer pays for it, we handle the paperwork together with our partner training body.