SOC107 · Incident Handling and Digital Forensics Basics

Categories: Cybersecurity
Wishlist Share

About Course

Handle security incidents with a structured process and collect digital evidence correctly. You practice triage, containment, evidence preservation and timeline building on your own lab system.

Advance · 8 hours · 4 lessons, a lab, an assessed assignment and a portfolio piece

Who it is for

Analysts, IT administrators and small-business tech leads who must respond when something goes wrong.

Prerequisites

Complete SOC103 and SOC105, or have experience investigating alerts in a SIEM.

What you will be able to do

  • Apply an incident response lifecycle aligned with NIST SP 800-61 Rev. 3 and CSF 2.0
  • Choose containment actions that limit damage while preserving evidence
  • Collect and document volatile and non-volatile evidence with hashing and chain of custody
  • Build an incident timeline from endpoint artifacts and logs and write a clear incident report

Lessons

  • Lesson 1 · The incident response lifecycle
  • Lesson 2 · Triage, containment and eradication
  • Lesson 3 · Digital forensics basics and evidence handling
  • Lesson 4 · Lab and assignment

Lab: Triage a simulated incident on your own VM

You set up a harmless scenario on your own Windows VM: a new local account, a scheduled task that launches a script from the Downloads folder and a renamed copy of a system tool. You then collect triage artifacts with Velociraptor, hash and log the evidence, and build a timeline showing what happened and in what order.

Free tools: Velociraptor (free, open source) in local GUI mode, a Windows 10/11 evaluation virtual machine, Eric Zimmerman's free tools (Timeline Explorer) and a spreadsheet

Assessed assignment

Write an incident report for the simulated incident in your lab, as if it had occurred on a bookkeeping firm's front-desk PC. Include an executive summary, scope, a timeline of at least ten events with sources, containment and eradication actions, evidence log with hashes and chain of custody, notification analysis under the relevant US state breach law, and three lessons-learned improvements.

Criterion Weight What excellent work looks like
Process and decisions 25% Actions follow the incident lifecycle and containment choices are justified against evidence preservation.
Evidence handling 25% Evidence is hashed, logged with chain of custody and collected in order of volatility.
Timeline and analysis 30% The timeline is accurate, sourced and explains how the activity occurred and was detected.
Reporting and lessons learned 20% The report is clear for executives and technical readers, with concrete, owned improvements.

Portfolio piece

An incident report with timeline, evidence log and lessons learned from a hands-on triage.

Self-paced, 12-month access. Questions are answered in writing through the student panel. A completion record is issued when you finish the course.

Next step

Continue with SOC108 · Security Automation and Response (SOAR) · 8 hours · $56.00

Continue to the next course

Prefer the whole program? Program in Security Operations & Threat Defense · $378.00 (10% less than buying the courses separately)

Show More

What Will You Learn?

  • Apply an incident response lifecycle aligned with NIST SP 800-61 Rev. 3 and CSF 2.0
  • Choose containment actions that limit damage while preserving evidence
  • Collect and document volatile and non-volatile evidence with hashing and chain of custody
  • Build an incident timeline from endpoint artifacts and logs and write a clear incident report

Course Content

SOC107 · Incident Handling and Digital Forensics Basics (8 h)
Handle security incidents with a structured process and collect digital evidence correctly. You practice triage, containment, evidence preservation and timeline building on your own lab system.

  • Lesson 1 · The incident response lifecycle
  • Lesson 2 · Triage, containment and eradication
  • Lesson 3 · Digital forensics basics and evidence handling
  • Lesson 4 · Lab and assignment
  • SOC107 Assessment · Incident Handling and Digital Forensics Basics
Scroll to Top