Module 10: Blue Team Essentials - Detection, Logging & Incident Response
Switch sides: read logs and SIEM data, triage and tune alerts, and run an incident through the NIST SP 800-61 lifecycle, including a ransomware response. Detection and response skills are what turn the attacks from Modules 5-9 into something an organisation can survive.
- Level
- Advanced
- Study time
- 6 hours
- Lessons
- 5
- Practice labs
- 3
- Assessments
- 2
- Format
- Self-paced, online
What you will learn
By the end of this course you will be able to:
- Detect common attacks and respond to an incident (syllabus outcome for Module 10).
- Triage a queue of alerts, separating true positives from authorised activity, and propose a rule tuning.
- Build an incident timeline from correlated log data and write a prioritised containment, eradication and recovery plan.
Before you start
Modules 1-9 of the bootcamp (or equivalent attack knowledge); basic Windows and Linux log familiarity
Tools you will use
Course outline
5 lessons in 2 modules.
Sub-module 10.1: Detection & monitoring
- Logs and SIEM concepts
- Detections, ATT&CK mapping and alert triage
- Worked example: triaging a morning alert queue
Sub-module 10.2: Incident response
- The incident response lifecycle (NIST SP 800-61)
- Containing, eradicating and ransomware response
Practice labs and assessments
Labs run in the browser as simulations. They never touch a real system.
3 practice labs
- Read the SIEM export Beginner, 25 min
- Triage the alert queue Intermediate, 35 min
- Catch the attacker Advanced, 50 min, final lab
2 assessments
- Module 10 knowledge check
- Module 10 final quiz
The pass mark is 70%. You can retake an assessment.
Take Module 10: Blue Team Essentials - Detection, Logging & Incident Response
Request access and your instructor will set up your account.