Skip to main content
back to List back
on this page

Modern Large-scale and Enterprise Incident Response (Arabic)

pre-event
price $3,900
Saleh Muhaysin, Abdulaziz Alwashmi
Intermediate / Advanced
2 Days
Forensics, incident response
Sun 12 Nov - Mon 13 Nov
price $3,900
Register


Summary

This course is designed to equip you with the necessary skills and knowledge to investigate challanging enterprise and large-scale cybersecurity incidents effectively. Drawing from our experience of handling diverse incidents, we will guide you through the modern process of effectivly invistigsting and handling cybersecurity incidents.

It will give you a comprehensive understanding and practical skills of dealing with large environments and time constraints. By the end of this course, you will have the technical expertise to handle real-world cybersecurity incidents with confidence and precision.

Detailed Description

The current scope of incidents on enterprises and large environments cannot be covered within a reasonable time with traditional Digital Forensics and Incident Response (DFIR) methods. Some incident response investigations need to cover tens or even hundreds of endpoints with more than one investigator working on it at the same time.

Not to mention the current interconnectivity and variation in technologies and locations of these endpoints. Taking images will require an unacceptable time for IR, and relaying solely on network does not allow for enough visibility; hence, incomplete eradication plans. Moreover, current speed of connectivity, maturity of attacks, and business requirements cannot bare the time taken for traditional incident response to get the business safely back to normal operation.

This course focuses on modern methods of large-scale and enterprise DFIR investigation that allow for fast triage, effective enrichment, automation, and collaborative analysis to meet the requirements of today's business and threat landscape.

Benefits

  • Good understanding and preparation for large-scale and enterprise incident investigations.
  • Be more efficient and effective in responding to incidents.
  • Know how to discover the root cause and scope of the incident in a large network.
  • Clearly report the findings during the investigation and produce proper, effective, and complete containment and remediation plans.K26

Agenda / Topics to be Covered

Day 1:

  • Introduction and basics
  • Large-scale and enterprise incident response process
  • Preparation
  • Collection, parsing, and enrichment:
  • Data sources
  • Parsers
  • Enrichment – IoCs/IoAs/EoC

Day 2:

  • Root cause analysis and scoping:
  • Investigation - monitoring
  • Investigation – forensics
  • Containment and recovery
  • CTI and OSINT
  • Reporting
  • Eradication and remediation
  • Examples - threats and incidents

Target audience / Who should take this course?

  • IT and Cybersecurity professionals wanting to get practical and real-world skills of dealing with modern and enterprise level Incidents

What students should bring with them to the class: 

  • General cybersecurity concepts and understanding of forensics artifacts and incidents
  • Hardware: Trainee should bring laptop of the following requirement minimum (USB 3.0 support, 8 GB of RAM or higher (recommended 16GBs), 50 GB of free HDD space reserved for the VM, Local administrator access with full control on the machine to install application, etc.). + Ability to connect to the internet.
  • Software: VMware Workstation or VMware Fusion (recommended to have version able to run multiple VM at the same time) + Microsoft Office

What students will be provided with onsite:  

  • Course VM (that includes tools) and Course Slides