← Back to all courses

Incident Responder Course

Learn how to stop cyberattacks, prioritize incidents, and mitigate damage

Enroll now

Format

Online, onsite (for private groups)

Duration

3 days

Level

Intermediate

Language

English

Arabic

Vietnam

Target participants

Incident response team members

Investigate, contain, and mitigate security incidents by mastering the full incident response lifecycle, triage collection, root cause analysis, and post-incident activities.

Technical specialists with cybersecurity experience

Strengthen incident management skills through hands-on analysis of Windows event logs, file system artifacts, registry data, and malicious documents.

Information security specialists

Improve analytical depth, reporting quality, and decision-making by applying structured forensic techniques, interpreting evidence, and leveraging threat intelligence during investigations.

SOC/CERT employees

Enhance response efficiency and technical readiness by performing triage, analyzing system and application artifacts, correlating events, and supporting coordinated incident handling.

Course modules

Foundations of incident response (self-paced pre-course material)

Cyber Kill Chain and MITRE ATT&CK frameworks
Incident response process and team roles
Foundational data collection

Forensic data collection and triage

Data collection techniques and formats
Essential triage tools

Event logs

Event log analysis
Key event IDs and how to interpret them

System files

File system metafiles and timeline creation
Prefetch analysis
System files and application files critical for investigation

Windows registry

Registry analysis techniques
Most valuable registry keys

Malicious files

Analysis of malicious documents and scripts
Script decoding
Yara and

Common incident types and response

Hi-tech crime trends
Incident types and investigation methodology

Course certificate

At the end of the course, you will receive a personal certificate confirming your expertise and strengthening your professional credibility

Trainers

Ahmed Nosir

Cybersecurity Consultant

Ahmed Nosir

Ahmed has been working in the Security Operations Center over the last three years, transitioning his expertise from penetration testing to Digital Forensics and Incident Response and regularly takes part in complex incident response operations.

Ahmed has conducted numerous training sessions, molding the new age cybersecurity professionals. His expertise doesn’t just stop at identifying digital threats but extends to fostering a culture of continuous learning and curiosity among aspiring cyber experts.

Moataz Nasr

Cybersecurity Consultant

Moataz Nasr

Moataz carries over three years of specialized cybersecurity expertise, particularly in the realm of red teaming and penetration testing, where he has honed his skills in identifying and mitigating vulnerabilities within various systems and networks. Moataz has led several training sessions, playing a pivotal role in shaping and developing the next generation of cybersecurity professionals helping them navigate the landscape of modern cyber threats.

Svetlana Ostrovskaya

Head of Education Practice

Svetlana Ostrovskaya

With a background in incident response and digital forensics, Svetlana has designed many DFIR training programs and crisis management masterclasses. She has also co-authored articles and books on cybersecurity, such as Practical Memory Forensics, Incident Response for Windows, and the e-guide Human-Centric Assessments. She has trained specialists in more than 30 countries and spoken at leading conferences worldwide, from FS-ISAC Japan to GITEX UAE.

Nam Le Phuong

Senior Digital Forensics & Incident Response Specialist

Nam Le Phuong

Nam has over 13 years of experience in cybersecurity and specializes in digital forensics and incident response. At Group-IB, he investigates advanced cyber threats and supports organizations during complex security incidents, including ransomware attacks and post-compromise activity in enterprise and critical infrastructure environments.

Nam is a contributor to the MITRE ATT&CK® framework and has published technical research on advanced threat actor techniques, including ransomware operations and Linux-based evasion methods.