Duration: 4-days instructor-led course

Course Description

Cyber Security First Responder: Threat Detection and Response is a 4-day instructor-led course designed to prepare IT professionals to analyze threats, secure systems, and respond to security incidents effectively. Participants will gain hands-on experience with tools and techniques used to detect suspicious activity, investigate indicators of compromise, and execute containment strategies across modern network and endpoint environments.

Through real-world exercises and guided labs, learners will understand how to respond confidently during the first critical hours of a cyber security incident. This course blends practical defensive tactics, situational awareness, and response strategies using widely adopted frameworks and tools.

Target Audience

• Security operations center (SOC) analysts
• IT and network administrators
• Incident response team members
• Security engineers
• Professionals preparing for the CFR or similar security certifications

Prerequisites

Participants should have:

• Basic knowledge of operating systems (Windows and Linux)
• Familiarity with TCP/IP and networking fundamentals
• Understanding of common cyber threats and attack methods
• Experience with system administration or IT operations is recommended

Key Learning Objectives

By the end of this course, participants will be able to:

• Understand the role and responsibilities of a first responder during a cyber security incident
• Identify and analyze threats using log files, network traffic, and system behavior
• Use threat intelligence and indicators of compromise to support investigations
• Apply containment, eradication, and recovery steps in accordance with industry frameworks
• Communicate findings clearly during incident reporting and post-mortem reviews

Course Takeaways

• Real-world practice detecting, analyzing, and responding to threats
• Familiarity with key tools such as Wireshark, Sysinternals, Elastic Stack, and OSQuery
• A practical incident response playbook and investigation templates
• Exposure to MITRE ATT&CK, NIST CSF, and SANS incident handling models

Module 1: Understanding Threats and the Role of the First Responder

Topics Covered

• Roles and responsibilities during incident response
• Overview of threat types, actors, and attack lifecycle
• Introduction to the MITRE ATT&CK framework
• Indicators of compromise and tactics, techniques, and procedures (TTPs)
• The value of cyber threat intelligence in detection and response

Hands-On Labs

• Lab 1: Map a simulated attack to the MITRE ATT&CK matrix
• Lab 2: Analyze threat intelligence data to identify relevant IOCs
• Lab 3: Classify incident types based on provided scenarios

Module 2: Network and Endpoint Threat Detection

Topics Covered

• Collecting and analyzing network traffic
• Common attack signatures in network packets
• Endpoint behavior monitoring and EDR concepts
• Log correlation and detection rules
• DNS tunneling, lateral movement, and beaconing activity

Hands-On Labs

• Lab 4: Use Wireshark to detect suspicious traffic and HTTP exfiltration
• Lab 5: Investigate endpoint artifacts using Sysinternals tools (Autoruns, Process Explorer)
• Lab 6: Configure and monitor logs with Wazuh or OSQuery for endpoint detection

Module 3: Incident Investigation and Triage

Topics Covered

• Incident detection and triage workflow
• Prioritization and severity classification
• Timeline reconstruction and root cause analysis
• Using ELK Stack or Splunk for investigation
• Data preservation and evidence handling

Hands-On Labs

• Lab 7: Reconstruct an attack timeline using log files
• Lab 8: Use Kibana dashboards to investigate alert data
• Lab 9: Perform triage and document findings in an incident report template

Module 4: Containment, Response, and Recovery

Topics Covered

• Containment strategies for network and endpoints
• Eradication and system restoration
• Post-incident analysis and lessons learned
• Communication and coordination during incidents
• Creating a basic incident response plan

Hands-On Labs

• Lab 10: Isolate and remediate a compromised machine
• Lab 11: Conduct a simulated response drill using a prepared scenario
• Lab 12: Build and present a summary report of the incident investigation