Incident Response Simplified

Developing a Tactical IR Plan

·      The Three Threat Vectors

·      The Two Most Important IR Playbooks

·      Asking the Right Incident-Response Questions

Identity Attack Surface

·      Identity: Your Most Critical IT Asset

·      M365 Identity Overview

·      Active Directory for IR Overview

Endpoint Attack Surface

·      Understanding How Threat-Actors/Malware Impact Endpoints

·      Windows Attack Surface

·      Linux Attack Surface

Rapid Endpoint Investigations Methodology

·      Endpoint Artifact Selection

·      Endpoint Artifact Acquisition

·      Investigative Workflow

Rapid Endpoint Investigations Tools & Techniques

·      Tools & Techniques Overview

·      Building an Artifact Collector (lab)

·      Parsing Triage Data (lab)

Case Study: Business Compromise Investigation

·      Reviewing Identity Indicators (lab)

·      Investigating Endpoint Artifacts (lab)

·      Deriving Actionable Intelligence (lab)

·      Answering the Right Incident-Response Questions

Conclusion

·      Workflow and Tooling Review

·      Reference and Additional Resources