AI-ASSISTED INVESTIGATION & RESPONSE

AI-Assisted Incident Response & Investigation

Investigate and respond with ChatGPT, OpenAI agents and local, on-prem LLMs. Use Omarchy to organize forensic work, verify AI findings, contain incidents and test recovery.

ChatGPT & OpenAI
Claude & Kimi
Omarchy
Local & on-prem LLMs

In development10 chapters30 lessonsEnglish

Explore the course topics ↓

INSIDE THE COURSE

Explore the course, chapter by chapter.

This is the current outline of a course in development. Explore the chapters, subchapters and lesson topics below. The programme may change as we develop and review it.

Explore the outline. Open a section to see the lessons and topics inside.

Chapter 01

Direct the investigation and the AI assistant

Establish the decision, evidence boundary and a reproducible analysis loop.

1.1

Decision and evidence handling

Start with a decision, not “find everything suspicious”

Turn a vague breach alert into a bounded decision and competing explanations.

Topics you will explore

Start with the decision, not the tool

Includes practical AI use, verification and information risks.

Link to this lesson

Prepare evidence the assistant can actually inspect

Preserve originals and distinguish raw artifacts, normalized extracts and model interpretations.

Topics you will explore

Preserve an original you can return to

Includes practical AI use, verification and information risks.

Link to this lesson

1.2

First verified AI workflow

Run the first AI analysis and verify its work

Use a plan–execute–inspect–revise loop with approved hosted or local assistants.

Topics you will explore

Make each answer earn the next question
Build your evidence and analysis workspace

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 02

Investigate file-system evidence

Use MFT leads, timestamps and file identity to choose the next check.

2.1

Candidates and timestamp meaning

Use MFT metadata to find useful leads

Ask useful file-system questions without mistaking metadata for execution.

Topics you will explore

A suspicious file is a lead, not a verdict

Includes practical AI use, verification and information risks.

Link to this lesson

Investigate timestamp disagreement without inventing timestomping

Compare different timestamp meanings and find independent corroboration.

Topics you will explore

A timestamp is not the whole timeline

Includes practical AI use, verification and information risks.

Link to this lesson

2.2

Renames, deletion and record reuse

Follow renames, deletion and MFT entry reuse

Track a file through snapshots without merging unrelated objects.

Topics you will explore

Follow the file identity through the rename

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 03

Reconstruct process and account activity

Connect process instances, sessions, resource access and change context.

3.1

Process and session joins

Reconstruct process ancestry without PID mistakes

Build a supported process chain and preserve gaps in command visibility.

Topics you will explore

Follow process instances, not reused PIDs

Includes practical AI use, verification and information risks.

Link to this lesson

Follow accounts, sessions and file-share access

Distinguish account activity, a logon session, an access check and actual data transfer.

Topics you will explore

An access check is not a stolen document
Public evidence lab · use your own AI, then verify and respond

Includes practical AI use, verification and information risks.

Link to this lesson

3.2

Persistence and untrusted evidence

Test persistence and legitimate-change explanations

Compare suspicious activity with exact change scope and resist instructions embedded in logs.

Topics you will explore

Task creation does not prove task execution
Public Linux lab · turn a suspicious pattern into a response decision

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 04

Interpret network evidence

Identify conversations, reproduce measurements and investigate opaque traffic.

4.1

Flow selection and byte accounting

Start PCAP analysis with conversations and capture limits

Select the right network conversation and avoid borrowing context from another flow.

Topics you will explore

Keep separate network conversations separate
Tool orientation · follow a claim back to packet bytes

Includes practical AI use, verification and information risks.

Link to this lesson

Count TCP bytes correctly and catch AI arithmetic errors

Reproduce a network measurement and distinguish observed payload from unique data.

Topics you will explore

Count retransmissions once for unique payload

Includes practical AI use, verification and information risks.

Link to this lesson

4.2

Disclosure hypotheses and missing links

Investigate suspected exfiltration when content is opaque

Build a disclosure hypothesis without presenting correlation as proof.

Topics you will explore

Show the gaps in a disclosure claim
Tool orientation · follow TCP without losing direction
Public network lab · investigate the root-access allegation

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 05

Correlate, scope and challenge the analysis

Build supported relationships and choose questions that change the response.

5.1

Timeline and scope

Build a cross-source timeline that does not manufacture causality

Correlate events with source identity, time uncertainty and explicit relationship types.

Topics you will explore

Build relationships before writing the story

Includes practical AI use, verification and information risks.

Link to this lesson

Scope the incident and ask the next useful question

Expand investigation by a testable pivot rather than a flood of unbounded queries.

Topics you will explore

Expand scope with a purpose

Includes practical AI use, verification and information risks.

Link to this lesson

5.2

Independent AI and human review

Make the assistant challenge the case—and challenge the assistant

Use independent checks and adversarial review without treating model agreement as validation.

Topics you will explore

Keep evidence outside the instruction channel

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 06

Contain harm and preserve control

Choose urgent actions, preserve evidence and close the relevant host and identity paths.

6.1

Authority, urgency and preservation

Turn findings into a bounded response and verify effect

Separate recommendation, approval, accepted action and independently verified outcome.

Topics you will explore

Verify the effect, not just the request

Includes practical AI use, verification and information risks.

Link to this lesson

Stop ongoing harm without losing the case

Choose an urgent, scoped containment action while preserving useful evidence and business continuity.

Topics you will explore

Contain harm and preserve what matters

Includes practical AI use, verification and information risks.

Link to this lesson

6.2

Credentials, sessions and ambiguous results

Contain identity abuse across credentials and live sessions

Revoke the relevant access paths, handle ambiguous action results and verify legitimate access still works.

Topics you will explore

A new password does not end every session

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 07

Eradicate, restore and verify recovery

Repair the trusted state, test security and business gates, and roll back a failed pilot.

7.1

Eradication and trustworthy restoration

Remove persistence and rebuild trust without destroying evidence

Choose scoped eradication and clean replacement while keeping the entry-path and persistence investigation open.

Topics you will explore

Remove the observed persistence; keep investigating

Includes practical AI use, verification and information risks.

Link to this lesson

Restore from a trustworthy source and test the business result

Evaluate restore inputs and require both security and business validation before staged return.

Topics you will explore

A booted system is not a recovered service

Includes practical AI use, verification and information risks.

Link to this lesson

7.2

Monitored return and rollback

Stage the return, detect recurrence and roll back

Operate explicit stop conditions, preserve new evidence and return safely to containment when recovery fails.

Topics you will explore

A stop condition still matters after a successful preflight

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 08

Use Omarchy as an AI investigation workbench

Apply the investigation and response method in a reproducible desktop workflow.

8.1

Workspace boundaries and two-pass analysis

Prepare an Omarchy workspace for a bounded AI investigation

Separate evidence, agent working files and verified outputs before using Omarchy for a case.

Topics you will explore

Make the desktop support the investigation

Includes practical AI use, verification and information risks.

Link to this lesson

Direct and cross-check AI analysis from the Omarchy workbench

Run a question-driven file, process and packet investigation with separate analyst and reviewer passes.

Topics you will explore

Use a second pass to challenge the first

Includes practical AI use, verification and information risks.

Link to this lesson

8.2

Response rehearsal and portable handover

Rehearse response, rollback and an auditable handover on Omarchy

Use an AI workbench to compare response plans, inspect failed gates and hand over a reproducible open incident.

Topics you will explore

Hand over a result someone else can reproduce

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 09

Connect to company-hosted AI

Use shared enterprise hardware without losing case boundaries, verifiability or response continuity.

9.1

Service architecture and bounded agent connection

Design a shared on-prem AI service for investigators

Separate the investigator’s agent, the shared model service and the case evidence boundary.

Topics you will explore

Shared AI hardware needs separate access boundaries

Includes practical AI use, verification and information risks.

Link to this lesson

Connect an agent harness or Omarchy to the company model

Configure a private model endpoint and verify a bounded evidence-reading agent loop.

Topics you will explore

Prove the connection in layers

Includes practical AI use, verification and information risks.

Link to this lesson

9.2

Shared access and failure acceptance

Validate shared access, service failure and response continuity

Test isolation and failure behaviour before relying on a company-wide investigation assistant.

Topics you will explore

Test denied access as carefully as allowed access

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 10

Command, communicate and demonstrate the response

Coordinate actions, report actual outcomes and make an independent recovery decision.

10.1

Command board and evidence-backed handover

Command the response, communicate decisions and prevent recurrence

Use AI to maintain an accurate action board, communicate uncertainty and turn findings into verified improvements.

Topics you will explore

An action needs an owner and an acceptance test

Includes practical AI use, verification and information risks.

Link to this lesson

Write and proofread the investigation and response handover

Use AI to draft technical and executive reports without losing evidence, uncertainty or action state.

Topics you will explore

Write a report that survives checking
Build an analysis package the next shift can use

Includes practical AI use, verification and information risks.

Link to this lesson

10.2

Birch investigation and response

Investigate and respond at Birch: make the recovery decision

Investigate the evidence, assess containment, reject unsafe repair and make a justified go/no-go recovery decision.

Topics you will explore

Make the recovery decision at Birch

Includes practical AI use, verification and information risks.

Link to this lesson

HOW YOU WILL WORK

From AI questions to verified response.

Use your own approved AI subscription or a company-hosted model to work through file-system, Windows and Linux log, and network evidence. Learn what to ask, how to drill deeper, how to check the answer against the original evidence, and how to turn a finding into a controlled response.

Investigate with ChatGPT and OpenAI agents

Direct ChatGPT, OpenAI-powered agents, Claude or Kimi through a bounded investigation. Plan the evidence reads, inspect actual results, test competing explanations, and check every report claim against its source.

Build an Omarchy investigation workbench

Organize evidence, terminal work, AI analysis and independent review in Omarchy. Run the supplied investigation and response exercises, preserve originals and hand over results another analyst can reproduce.

Connect to local and company-hosted AI systems

Connect an agent harness or an Omarchy workstation to local and on-prem LLM services, including shared enterprise GPU servers. Define case access, model permissions and retention, then test connection paths, revocation, service failures and manual fallback.

Investigate, respond and verify recovery

Use AI to help choose and document containment, preservation, eradication, restoration and rollback. Require scoped approval and independent effect checks; proofread technical reports and executive briefs against the evidence and actual action results.

The draft combines visual slides, downloadable evidence, guided investigation labs and response rehearsals. Core exercises run offline without paid AI. Optional model-connected work uses your own approved AI service; an AI subscription or enterprise deployment is not included.

Practical AI use, with human judgement.

This course includes role-specific ways to use approved AI assistance, relevant AI threats and failure cases, and checks for evidence, data handling and human approval. Optional prompts use fictional information; an AI account is not required.

AI examples are practical learning activities. They do not add statutory training requirements or replace your organisation’s policies, qualified advice or accountable decisions.