Detect — Analyse — Contain
Incident response timeline
Rebuild five simulated incidents event by event from the defender's point of view: a SOC (Security Operations Center) analyst who reads the alerts, sets priorities and coordinates containment, eradication and recovery.
Module overview
- Who it is for
- Junior SOC analysts, security students, developers and system administrators who want to understand how an incident is handled.
- Level
- Intermediate
- Duration
- About 60 minutes (10–15 minutes per scenario)
- Prerequisites
- Basic knowledge of networking (IP, ports, HTTP), Linux and Windows systems, and authentication (passwords, MFA, sessions).
Learning objectives
- recognise the stages of an attack (reconnaissance, initial access, persistence, exfiltration and impact) from logs and alerts;
- tell a weak signal from a confirmed incident and decide when to declare an incident;
- choose containment actions while preserving evidence for forensic analysis;
- link each event to the mitigations that would have prevented it or detected it sooner;
- know the notification duties (for example the GDPR's 72-hour deadline for notifying the supervisory authority).
Point of view: you are in the SOC. For each event the panel shows what happened, what you see in your tools, the key decision and the mitigations. Offensive techniques are described only as far as you need to recognise them: read Ethics and law before trying any technique, and only on systems for which you hold written authorisation.
Teaching simulation.
No real logs and no real systems compromised. Times and events are modelled on typical cases; IP addresses and domains are those reserved for documentation (RFC 5737 and the reserved domain .example).
—
—