◆CyberHUBBlue Team Level 1
Blue Team Level 1 domain

Incident Response

Preparation, detection, analysis, containment, eradication, recovery, case management and lessons learned.

45 lessons7 sections205 source pages
Open glossary →
45 lessons
01

Introduction to Incident Response

7 lessons

001Section Introduction, Incident ResponsePDF pages 1-1001What is Incident Response?PDF pages 1-2002Why is Incident Response Needed?PDF pages 2-4004Security Events vs Security IncidentsPDF pages 4-6006Incident Response LifecyclePDF pages 6-10010CSIRT and CERT ExplainedPDF pages 10-12012Further Reading Material, Incident ResponsePDF pages 12-19
02

Preparation Phase

9 lessons

020Preparation: Incident Response TeamsPDF pages 20-22022Preparation: Asset inventory and Risk AssessmentsPDF pages 22-25025Prevention: DMZPDF pages 25-29029Prevention: Host DefensesPDF pages 29-33033Prevention: Network DefensesPDF pages 33-39039Activity) Setting up a FirewallPDF pages 39-63063Prevention: Email DefensesPDF pages 63-67067Prevention: Physical DefensesPDF pages 67-70071Prevention: Human DefensesPDF pages 71-73
03

Detection and Analysis Phase

6 lessons

074Common Events & IncidentsPDF pages 74-81081Using Baselines & Behaviour ProfilesPDF pages 81-84084Introduction to Wireshark (GUI)PDF pages 84-90090Introduction to Wireshark (Analysis)PDF pages 90-97097CMD and PowerShell For Incident ResponsePDF pages 97-108108DeepBlueCLI For Event Log AnalysisPDF pages 108-113
04

Case Management

1 lesson

114What are Case Management Tools?PDF pages 114-115
05

Containment, Eradication, and Recovery Phase

4 lessons

115Incident ContainmentPDF pages 115-118119Taking Forensic ImagesPDF pages 119-120120Identifying and Removing Malicious ArtifactsPDF pages 120-124124Identifying Root Cause and RecoveryPDF pages 124-127
06

Lessons Learned and Reporting

4 lessons

127What Could be Improved?PDF pages 127-130130Incident Response MetricsPDF pages 130-133133Reporting FormatPDF pages 133-136136Reporting ConsiderationsPDF pages 136-139
07

MITRE ATT&CK Framework

14 lessons

139Section Introduction, ATT&CKPDF pages 139-140140Initial AccessPDF pages 140-145145ExecutionPDF pages 145-148148PersistencePDF pages 148-152152Privilege EscalationPDF pages 152-156156Defense EvasionPDF pages 156-160160Credential AccessPDF pages 160-165165DiscoveryPDF pages 165-170170Lateral MovementPDF pages 170-172172CollectionPDF pages 172-178178Command and ControlPDF pages 178-183183ExfiltrationPDF pages 183-186186ImpactPDF pages 186-190191Activity) ATT&CK NavigatorPDF pages 191-205