Enterprise Scale Incident Response and Threat Hunting
Enterprise incident response is a different discipline from single-host casework. When an adversary has been inside thirty thousand endpoints for months, method that works on one machine simply does not scale, and neither does one analyst.
This course covers mass collection, data reduction, scoping a patient adversary, planning a coordinated eviction, and running the command structure that keeps a long response coherent.
- Duration
- 10 weeks
- Format
- Live online, instructor-led
- Prerequisites
- Advanced Incident Response and Threat Hunting
- Class size
- Capped at 12 learners
What you will be able to do
- Design a collection that scales to thousands of endpoints
- Choose between sampling and full sweeps with a defensible rationale
- Reduce bulk triage output using stacking, baselines and automation
- Identify every compromised credential before planning an eviction
- Find dormant and secondary persistence a first pass missed
- Sequence a coordinated remediation event across multiple teams
- Verify that an adversary is actually gone rather than assuming it
- Run incident command across shifts, vendors and executive reporting
Course outline
6 modules
- Where single-host method stops working
- Designing an investigation that scales
- Sampling versus full sweep decisions
- Asset discovery and the truth about your estate
- Running a long investigation as a project
What you need before you start
- Hands-on intrusion investigation experience or the advanced hunting course
- Familiarity with Active Directory and large Windows estates
- Basic scripting ability for processing collected data
- A machine with 16 GB of RAM and 200 GB free for data sets
Who this course is for
- Incident response leads running large engagements
- Senior analysts stepping into incident command
- Consultants delivering enterprise compromise assessments
- Security managers who own remediation planning
- Threat hunters working across very large estates
Questions about this course
More in digital forensics and incident response
Entry-levelDigital Evidence Acquisition and Rapid Triage
Hands-on digital forensics training in Toronto covering defensible imaging, live triage, write blocking and hashing that stands up to challenge.
6 weeks · live online
Contact for pricingView outline
Entry-levelWindows Forensic Analysis
Windows forensics training in Toronto covering registry, execution artifacts, shell items, USB history, email and browsers through a full capstone case.
10 weeks · live online
Contact for pricingView outline
CoreAdvanced Incident Response and Threat Hunting
Threat hunting training for responders ready to find intrusions in progress using memory forensics, lateral movement evidence and super timeline analysis.
10 weeks · live online
Contact for pricingView outline
Ready to launch your cyber security career?
Join the next live online cohort. No experience required, just bring the curiosity.