AI-ASSISTED INVESTIGATION & RESPONSE

AI-Assisted Incident Response & Investigation

Investigate a Microsoft 365 phishing attack and a backdoored Claude skill before taking on the Binance breach. Use OpenAI, Claude or an approved local model to trace the evidence and decide how to respond.

Claude
Codex / OpenAI
Optional local & on-prem LLMs

Available now11 chapters4.2 h49 lessonsEnglish

Open course →Explore the course topics ↓

After this course, learners will…

What learners can do

Classify incidents, connect observed behavior to ATT&CK and investigate logs, disk artifacts, malware indicators and network evidence using Claude, Codex/OpenAI OR an approved local model.
Run reproducible evidence queries and verify an assistant’s findings while keeping credentials, case access and response permissions under control. Omarchy and on-prem setup are optional.
Challenge AI-generated timelines and reports, rehearse containment and recovery, and verify the result before recommending service restoration.

Benefits for your company

Analysts can delegate bounded analysis tasks while retaining responsibility for evidence, interpretation and response decisions.
Teams can choose an approved cloud or company-hosted assistant and apply the same confidentiality, evidence and verification requirements.
Response plans include preservation, approval, acceptance and rollback checks instead of relying on an assistant’s assurance that the incident is resolved.

Investigation scenarios

Start here

Binance breach investigation

INSIDE THE COURSE

Explore the course, chapter by chapter.

11 chapters · 49 lessons4.2 hExercises take additional time.

Build your skills in sequence, practise with the supplied cases and verify your decisions. Explore the chapters and lesson objectives below.

Explore the outline. Open a section to see the lessons and topics inside.

Chapter 01

Start with the incident and a working method

0.6 h

1.1

Start with the incident and a working method

Welcome: investigate the breach, not the AI’s story

7 slides · 3 practical activities

Explain the incident, your authority and the investigation you will complete before making a response decision.

Topics you will explore

Welcome to the Binance breach investigation
Run the investigation with your assistant

Link to this lesson

Understand the services and access paths

7 slides · 3 practical activities

Trace how a device, deployment identity and service permission can combine into a serious incident.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Set up the response team and one shared case record

7 slides · 3 practical activities

Assign investigation and response responsibilities, and establish a case record that colleagues can continue without your chat history.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Triage the alert without guessing the root cause

7 slides · 3 practical activities

Separate urgent containment from hypotheses that still need evidence.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Check an AI finding against its actual source

7 slides · 3 practical activities

Reject invented references and misleading interpretations without outsourcing the decision to another model.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Choose shared or separate AI investigation sessions

7 slides · 3 practical activities

Use shared context for joint decisions and separate scoped sessions for parallel or restricted work, without losing the common investigation.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Chapter 02

Reconstruct the engineering compromise

0.6 h

2.1

Reconstruct the engineering compromise

Reconstruct the recruitment lure and delivery

7 slides · 3 practical activities

Connect a message, downloaded archive and execution without assuming that delivery equals compromise.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Investigate a replaced developer tool

7 slides · 3 practical activities

Explain a file replacement using path, process and trusted baseline evidence.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Use VirusTotal without uploading the investigation

7 slides · 3 practical activities

Use a hash lookup as enrichment while protecting confidential files and API credentials.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Analyze malware capability without inventing execution

7 slides · 3 practical activities

Separate what recovered code could do from what the incident evidence shows it did.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Build a timeline that survives timestamp traps

7 slides · 3 practical activities

Distinguish file metadata, observed event time and collection time when ordering events.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Follow the process tree and preserve missing fields

7 slides · 3 practical activities

Join process and file activity using stable identity and context, not a reused name or PID.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Attribute network activity to the right process

7 slides · 3 practical activities

Connect a suspicious destination to a process while keeping DNS, transport and content claims separate.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Find persistence beyond startup entries

7 slides · 3 practical activities

Explain how replacing a frequently used tool can preserve execution without a new startup task.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Chapter 03

Investigate email: Microsoft 365 or Google Workspace

0.2 h

3.1

Investigate email: Microsoft 365 or Google Workspace

Investigate the compromised account: choose Microsoft or Google

7 slides · 3 practical activities

Identify suspicious account activity using the evidence schema of your chosen mail platform.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Find mail forwarding and application access

7 slides · 3 practical activities

Find persistent mail access without confusing a settings snapshot, audit event and application grant.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Determine mailbox impact without inventing visibility

7 slides · 3 practical activities

State what was accessed or delivered and what your selected platform’s evidence cannot establish.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Chapter 04

Follow internal AI access and stolen credentials

0.2 h

4.1

Follow internal AI access and stolen credentials

Investigate the internal AI tool as an access path

7 slides · 3 practical activities

Trace a cross-device AI action through requester, target authorization and actual execution.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Distinguish prompt injection from broken authorization

7 slides · 3 practical activities

Explain two different AI-related risks and choose evidence and controls appropriate to each.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Scope a stolen credential by what it can do

7 slides · 3 practical activities

Connect credential exposure to later use without overstating its permissions or the attacker’s identity.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Chapter 05

Verify network evidence, API abuse and company scope

0.6 h

5.1

Verify network evidence, API abuse and company scope

Decide which credential to revoke on Maya’s workstation

7 slides · 3 practical activities

Trace a suspicious connection to the process that opened a credential file, then give the incident commander a scoped containment recommendation.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Explain what encrypted or missing content leaves unknown

7 slides · 3 practical activities

Use network evidence without confusing a suspicious connection with proof of a particular disclosure.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Follow exposure across sources without inventing the missing link

7 slides · 3 practical activities

Build a qualified causal chain from endpoint activity to credential use.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Investigate API and signing authorization abuse

7 slides · 3 practical activities

Identify authorized identities performing unauthorized actions and design meaningful denial tests.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Merge parallel findings into one incident timeline with AI

7 slides · 3 practical activities

Have AI merge analyst contributions, normalize timestamps, remove duplicate events and preserve disputed interpretations and evidence gaps.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Hunt across the company and measure coverage

7 slides · 3 practical activities

Expand scope with reproducible queries while distinguishing no match from no data.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Use ATT&CK to improve the next question

7 slides · 3 practical activities

Map supported behavior to ATT&CK without treating a technique label as proof or forcing every event into one.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Chapter 06

Investigate the deployment and infrastructure

0.4 h

6.1

Investigate the deployment and infrastructure

Test alternative incident explanations

7 slides · 3 practical activities

Investigate a competing alert without forcing every suspicious event into the same breach.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Investigate Linux access without confusing attempts and sessions

7 slides · 3 practical activities

Distinguish failed host authentication from successful execution inside a container.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Investigate an unauthorized Kubernetes deployment

7 slides · 3 practical activities

Join API acceptance, workload execution, image provenance and service identity.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Scope cloud access with the right audit sources

7 slides · 3 practical activities

Separate management events, data access and uncollected cloud activity.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Verify build provenance instead of trusting a scanner score

7 slides · 3 practical activities

Distinguish an approved build from a merely available or apparently clean artifact.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Investigate the AI service without blaming the model

7 slides · 3 practical activities

Scope AI-service compromise across tool access, runners, identities and change history.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Chapter 07

Protect the analysis and brief the response team

0.1 h

7.1

Protect the analysis and brief the response team

Handle hostile evidence in your own AI investigation

7 slides · 3 practical activities

Analyze adversarial content without allowing it to control the investigator’s tools or report.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Write an interim report that changes the response

7 slides · 3 practical activities

Produce a short decision brief with source-backed findings, priorities and uncertainty.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Chapter 08

Contain each surviving access path

0.4 h

8.1

Contain each surviving access path

Coordinate containment across people and AI sessions

7 slides · 3 practical activities

Turn parallel recommendations into one approved response plan with named owners, dependencies, actual results and effect checks.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Remove account, forwarding and OAuth persistence

7 slides · 3 practical activities

Verify account recovery using actual denied-access and mail-delivery tests in your chosen platform.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Stop deployed workloads and test derived access

7 slides · 3 practical activities

Verify both credential revocation and removal of the effects it created.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Revoke the authority that survives a service shutdown

7 slides · 3 practical activities

Explain persistent delegated authority and verify revocation separately from stopping an application.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Chapter 09

Use a repeatable analyst workspace

0.3 h

9.1

Use a repeatable analyst workspace

Organize the analyst workbench, including optional Omarchy

7 slides · 3 practical activities

Use a practical workspace with preserved originals, readable evidence and controlled agent access.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Run parallel AI workstreams without splitting the case

7 slides · 3 practical activities

Delegate bounded investigation tasks, reconcile conflicting session outputs and maintain a reproducible shared case revision.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Use an approved local or shared company model when available

7 slides · 3 practical activities

Evaluate a company model connection without making on-prem hardware necessary for the investigation.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Chapter 10

Prove recovery with technical tests

0.2 h

10.1

Prove recovery with technical tests

Define recovery gates the technical team can test

7 slides · 3 practical activities

Specify observable conditions for safe service return instead of vague “all clear” language.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Restore a clean workstation without restoring the compromise

7 slides · 3 practical activities

Verify a replacement device, developer tooling and identity before returning access.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Run a pilot, stop on failure and retest the repair

7 slides · 3 practical activities

Use a failed technical acceptance test to guide a controlled repair and a meaningful repeat test.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Chapter 11

Report, improve and defend the complete case

0.4 h

11.1

Report, improve and defend the complete case

Hand over the investigation and response without losing context

7 slides · 3 practical activities

Use AI to prepare a source-backed shift handover with current scope, restrictions, unresolved work, accepting owners and a clear next review.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Produce the final investigation and response report

7 slides · 3 practical activities

Deliver a report that distinguishes public facts, reconstructed evidence, verified response and remaining uncertainty.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Turn findings into detections and control tests

7 slides · 3 practical activities

Create practical detection and prevention work with positive cases, negative controls and operational owners.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

Capstone: defend the investigation and the service-return decision

7 slides · 3 practical activities

Use the same case notebook to defend your findings, response verification and remaining work.

Topics you will explore

Run the investigation with your assistant

Link to this lesson

HOW YOU WILL WORK

One incident. One investigation. A response you can verify.

Start with the people, systems and alert. Build the same case notebook across 49 lessons, connecting endpoint compromise, email access, internal AI, stolen credentials, deployment and signing abuse. Public reporting and fictional training evidence are clearly separated.

Choose one assistant

Use OpenAI/Codex, Claude or an approved company model. Copy the displayed evidence into browser chat, or use an authorized terminal assistant. On-prem hardware, Omarchy and multiple subscriptions are optional.

Choose Microsoft 365 or Google Workspace

Investigate sign-ins, forwarding rules or Gmail filters, forwarding settings and OAuth access. Follow your chosen provider through containment and verification. These are fictional extensions, not claims about Binance’s email environment.

Work as one response team

Assign roles, choose shared or separate AI sessions, merge analyst findings into one timeline, coordinate containment and hand over the case. Practice alone or with colleagues using the same case pack and one approved AI platform.

Investigate and prove the response worked

Trace findings to source fields, challenge the assistant’s interpretation and connect the evidence to ATT&CK. Separate proposed actions from executed changes. Inspect failed recovery tests, verify repairs and defend the final service-return decision.

The English edition contains 11 chapters, 49 lessons and 343 narrated slides, plus practical work. Every lesson compares an established investigation workflow with AI-assisted analysis and the checks the investigator retains. Use your own approved assistant; its subscription is not included. No live tenant, funded wallet or executable malware is needed. The separate Arabic edition is awaiting this case rebuild.

Available now

Built for practical work.

SOC analysts, incident responders and cybersecurity investigators.

Before you start

SOC analysts, incident responders and IT investigators with basic account, endpoint, log and TCP knowledge. Use one approved assistant. No live tenant, funded wallet or local model is required; the optional read-only helper uses Node.js 20 or later.

How learning works

Self-paced lessons with readings, diagrams, practical activities and knowledge checks. Pause and resume at your own pace. Practice time varies; an overall study-time estimate has not yet been validated in a learner pilot.

Course language: English
Enrolment: Contact the academy

English narration, captions, 49 practical lessons and a named completion certificate. Exercises use supplied evidence; completion requires studying the slides, recording your decisions and passing the knowledge check.

The certificate records course completion, not accreditation or an independently proctored professional certification.

Open course →Contact sales ↗

Practical AI use, with human judgement.

This course includes role-specific ways to use approved AI assistance, relevant AI threats and failure cases, and checks for evidence, data handling and human approval. Optional prompts use fictional information; an AI account is not required.

AI examples are practical learning activities. They do not add statutory training requirements or replace your organisation’s policies, qualified advice or accountable decisions.