Skip to content
SudoSecurity

Sections

Course

Incident Response & Digital Forensics

Respond like a professional: triage and scope intrusions, preserve evidence, work memory and disk forensics, build the timeline, contain and eradicate, and write the postmortem that prevents the next breach.

9 lessons

Course Q&A

First Response: Triage, Scoping & Evidence

The first hour decides the case: classify the alert, scope the blast radius, and preserve evidence without contaminating the scene.

  1. 01The First Hour: Triaging a Security AlertClassify an EDR alert with evidence, not vibes — process trees, connections, and the five questions every responder asks.18mOpen
  2. 02Scoping the Incident: How Far Did They Get?Sweep the fleet for IOCs and tradecraft, separate compromised from exposed, and draw the blast radius explicitly.22mOpen
  3. 03Evidence Preservation and the Order of VolatilityCapture RAM before disk, image with dd, hash everything, and keep a chain of custody that holds up later.25mMembers

Forensic Fundamentals: Memory, Disk & Timelines

Work the evidence: Volatility memory analysis, NTFS/ext4 artifacts and deleted files, and fusing every source into one timeline.

  1. 01Memory Forensics with Volatility 3pslist vs psscan, malfind, netscan, and hashdump — find injected code, hidden processes, and credentials in RAM.30mMembers
  2. 02Disk Forensics: Artifacts and Deleted FilesRead $MFT, Prefetch, Shimcache, and bash history; recover deleted files with the Sleuth Kit; spot timestomping.30mMembers
  3. 03Building the Attack TimelineFuse every artifact with plaso into one UTC spine, pivot on anomalies, and write the narrative that answers how they got in.25mMembers

Containment, Communications & the Postmortem

Decide when and how to evict, who needs to know what (and on which channel), and how to write a postmortem with teeth.

  1. 01Containment vs Eradication: Making the CallFrom EDR isolation to coordinated eviction — pick containment that preserves evidence and eradicate every way back in.25mPremium
  2. 02Communications During an IncidentOut-of-band war rooms, exec updates without speculation, disclosure clocks like GDPR's 72 hours, and holding statements.20mPremium
  3. 03The Blameless Postmortem That Prevents the Next OneTurn the incident into detections and fixes: blameless timelines, action items with owners, and the metrics that matter.20mPremium