CYBER LIBRARY
Explore the bootcamp
← All learning paths
INVESTIGATE & RESPOND

Follow a breach from signal to response

Connect detection, evidence, containment, and recovery. Follow the sequence or open any note that catches your interest.

10 connected notes31 min reading
01
MILESTONE 1 OF 3

Find the signal

0/3 read
  1. 01
    Detection & response · 3 min

    Logs and telemetry

    Records support investigation only when you know what they represent.

  2. 02
    Detection & response · 3 min

    Security information and event management

    Centralize records and detection workflows without confusing collection with certainty.

  3. 03
    Detection & response · 3 min

    Alert triage

    Decide what the signal means, how urgent it is, and who owns the next step.

02
MILESTONE 2 OF 3

Follow the evidence

0/3 read
  1. 04
    Detection & response · 3 min

    Indicators of compromise

    A technical clue becomes useful when its context and confidence are known.

  2. 05
    Detection & response · 3 min

    MITRE ATT&CK

    Use a shared vocabulary for adversary behavior and defensive coverage.

  3. 06
    Detection & response · 3 min

    Incident response

    Follow an account-compromise example to understand investigation, containment, recovery, communication, and incident ownership.

03
MILESTONE 3 OF 3

Respond & recover

0/4 read
  1. 07
    Detection & response · 3 min

    Incident containment

    Limit the attacker’s access and the harm while preserving investigation options.

  2. 08
    Evidence & investigation · 4 min

    Chain of custody

    Understand evidence identifiers, handling records, transfers, and integrity checks through a digital-investigation example.

  3. 09
    Evidence & investigation · 3 min

    Incident timelines

    Reconstruct events without treating proximity as proof of causation.

  4. 10
    Detection & response · 3 min

    Cloud incident response

    Investigate identities, APIs, and delegated access as well as workloads.

Keep connecting the dots.

Follow another path or take your next question into the library.

Find your next direction
Start with a concept. Follow its connections.
Detection & responseAbuse Elevation Control MechanismElevation-control abuse bypasses or misuses mechanisms governing privileged execution.Making change happenAcceptance criteriaDefine observable conditions for a deliverable to be accepted.Security essentialsAccess controlUnderstand subjects, resources, permissions, and enforcement through a shared-drive example, including how access changes over time.Detection & responseAccess Token ManipulationAccess token manipulation changes or adopts operating-system security contexts.Risk & resilienceAccount Access RemovalAccount access removal disrupts legitimate users by changing, deleting, or restricting their identities.Evidence & investigationAccount DiscoveryAccount discovery enumerates identities available in a system or environment.Detection & responseAccount ManipulationAccount manipulation changes identity settings to preserve or expand access.Adversarial thinkingAcquire InfrastructureInfrastructure acquisition obtains domains, servers, or other resources used to support operations.Adversarial thinkingActive ScanningActive scanning probes target infrastructure to learn reachable services or weaknesses.Security essentialsAdversary in the middleAn intermediary may observe or alter a communication path.Security essentialsAESA symmetric block cipher whose safe use depends on its mode and implementation.Making change happenAgile deliveryUse short feedback cycles to adapt toward a useful outcome.
ESC to close Searches titles and note content