INVESTIGATION & RESPONSE

Incident Response and Investigation

Turn incomplete evidence into defensible findings: intelligence requirements, collection, analysis, digital forensics and incident communication.

In development10 chapters57 lessonsEnglish

Explore the course topics ↓

INSIDE THE COURSE

Explore the course, chapter by chapter.

This is the current outline of a course in development. Explore the chapters, subchapters and lesson topics below. The programme may change as we develop and review it.

Explore the outline. Open a section to see the lessons and topics inside.

Chapter 01

Becoming an investigator

Connect technical work, investigation and business decisions.

1.1

Role and working habits

Become an investigator, not just a tool operator

Turn an incident report into questions, evidence and decisions that support the wider response.

Topics you will explore

The same person can wear three different hats
Follow the consequence beyond the infected host
Communicate early without turning suspicion into blame

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 02

Intelligence Essentials — requirements and direction

Turn business and response needs into useful intelligence work.

2.1

Decisions, the cycle and useful products

Intelligence starts with a decision, not a feed

Convert an ambiguous request into an answerable requirement with an owner and deadline.

Topics you will explore

What makes information useful intelligence?
Separate the external problem from our information need
Write a requirement that another analyst can act on

Includes practical AI use, verification and information risks.

Link to this lesson

The intelligence cycle is a working loop

Use feedback between requirements, collection, processing, analysis and delivery.

Topics you will explore

Why the arrows go both ways
Coordinate the loop without a large intelligence department
Six useful checks on every product

Includes practical AI use, verification and information risks.

Link to this lesson

Choose the right intelligence product

Distinguish background research, current warning, operational support and conditional forecasts.

Topics you will explore

One subject can produce different answers
Match detail to the job
Source disciplines are different ways of learning

Includes practical AI use, verification and information risks.

Link to this lesson

2.2

Choose the right kind of analysis

Choose a method that fits the question

Distinguish lookup, calculation, explanation and uncertain future scenarios.

Topics you will explore

Not every question is a search problem
Bounded choices and open situations
Make uncertainty operational

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 03

Intelligence Essentials — collection and processing

Plan collection, assess sources and preserve meaning.

3.1

Plan, select sources and manage collection

Build a collection plan from expected evidence

Translate a requirement into discriminating evidence, collection tasks and stopping rules.

Topics you will explore

Ask what you would expect to see
Choose evidence that separates explanations
Write an executable task

Includes practical AI use, verification and information risks.

Link to this lesson

Select sources and manage collection limits

Combine people, artifacts, telemetry and records without overstating their coverage.

Topics you will explore

Use the source for what it can observe
Availability is not the same as authority
Fill gaps with complementary sources

Includes practical AI use, verification and information risks.

Link to this lesson

Task collectors and verify delivery

Control parallel collection, handovers and incomplete results.

Topics you will explore

Turn a request into owned work
Inspect the delivery, not just the success icon
Reprioritise visibly when the case changes

Includes practical AI use, verification and information risks.

Link to this lesson

3.2

Collation, source evaluation and claim evaluation

Collate information so another analyst can continue

Organise heterogeneous evidence without losing provenance or imposing a premature story.

Topics you will explore

Processing changes form; collation builds useful relationships
Use a schema that survives new information
Do not let the database become the investigation
Worked example: normalise time without rewriting the original

Includes practical AI use, verification and information risks.

Link to this lesson

Evaluate the source separately from the claim

Apply reliability, proximity and subject competence without reducing judgement to a trust score.

Topics you will explore

Reliability is a track record, not immunity from error
Trace how the information reached you
Ask whether the source can know this particular thing

Includes practical AI use, verification and information risks.

Link to this lesson

Test plausibility, expectations and independent support

Avoid treating a familiar or widely repeated claim as established evidence.

Topics you will explore

Ask what would have to be true
Use prior knowledge without trapping the investigation
Count origins, not repetitions

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 04

Intelligence Essentials — analysis, methods and bias

Build and challenge explanations through practical investigation.

4.1

Findings, induction, deduction and hypothesis testing

Facts, findings and forecasts: how far can the evidence take you?

Separate observation, inference and conditional prediction.

Topics you will explore

Facts and findings do different work
A forecast needs assumptions and triggers
Break a large conclusion into smaller claims

Includes practical AI use, verification and information risks.

Link to this lesson

Induction: learn from patterns without inventing a rule

Use repeated observations while checking sampling and counterexamples.

Topics you will explore

A pattern is a useful lead
Ask what your sample excludes
Try to break the proposed generalisation

Includes practical AI use, verification and information risks.

Link to this lesson

Deduction: check the premises before trusting the conclusion

Test conditional reasoning and avoid reversing an implication.

Topics you will explore

Valid logic can start from a false premise
Do not reverse the implication
An adversary can imitate the expected sequence

Includes practical AI use, verification and information risks.

Link to this lesson

Abduction and testing: explain an anomaly, then challenge it

Generate alternative mechanisms and choose safe discriminating tests.

Topics you will explore

Generate a new explanation when familiar ones fail
State a prediction for each candidate mechanism
A successful test narrows the question

Includes practical AI use, verification and information risks.

Link to this lesson

4.2

Opportunity, linchpin and analogy analysis

Opportunity analysis: find the defensive move that changes the case

Identify leverage, dependencies and adverse consequences before recommending action.

Topics you will explore

Look for a controllable dependency
Include what could undermine the action
Compare options by consequences

Includes practical AI use, verification and information risks.

Link to this lesson

Linchpin analysis: test the assumptions holding the conclusion up

Find pivotal premises and monitor indicators that could overturn an assessment.

Topics you will explore

Find the few assumptions that matter most
Support each pivotal premise
Define what would reverse the assessment

Includes practical AI use, verification and information risks.

Link to this lesson

Use analogies without copying the last incident’s conclusion

Compare mechanisms and dissimilarities before transferring a lesson.

Topics you will explore

Similarity is a starting point
List the differences before making the recommendation
Transfer a test, not an unverified conclusion

Includes practical AI use, verification and information risks.

Link to this lesson

4.3

Evidence, organisational, adversary and estimation bias

Bias in the evidence: anchoring, closure and false confirmation

Recognise how early stories and familiar patterns distort evidence evaluation.

Topics you will explore

The first plausible story can become the default
Supporting one explanation does not eliminate the others
Noisy history does not invalidate a new report

Includes practical AI use, verification and information risks.

Link to this lesson

Bias between teams: secrecy, loyalty and imagined coordination

Prevent organisational incentives and information boundaries from distorting the case.

Topics you will explore

An organisation is not a single coordinated mind
Specialisation can become a blind spot
Protect sensitive evidence without blocking necessary review

Includes practical AI use, verification and information risks.

Link to this lesson

Bias about the adversary: motives, rationality and effort

Avoid projecting your preferences onto another actor’s decisions.

Topics you will explore

The attacker does not share your priorities
Unexpected behaviour is not proof of irrationality
Do not infer importance directly from visible effort

Includes practical AI use, verification and information risks.

Link to this lesson

Bias in estimates: optimism, pessimism and refusing to update

Review confidence and scenarios without wishful thinking or automatic worst cases.

Topics you will explore

Threatening evidence is easy to explain away
Confidence must match the evidence, not the speaker
Prepare for severe outcomes without calling them established

Includes practical AI use, verification and information risks.

Link to this lesson

4.4

Analysis of competing hypotheses

Compare hypotheses using evidence that could prove you wrong

Build and revise a small competing-hypotheses matrix.

Topics you will explore

Choose explanations that could change the response
Mark inconsistency and dependence
Use the matrix to choose the next check

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 05

Intelligence Essentials — production and feedback

Make the assessment usable, timely and accountable.

5.1

Write, distribute and improve the product

Write the decision first and show its support

Produce an intelligence brief that preserves evidence and uncertainty.

Topics you will explore

Lead with what the recipient needs to decide
Build a short, checkable argument
Preserve the route back to evidence

Includes practical AI use, verification and information risks.

Link to this lesson

Warn early without pretending to know exactly what happens next

Write an actionable warning that separates evidence, uncertainty, decision urgency and review triggers.

Topics you will explore

A warning buys decision time
Define a trigger and an owner
Check whether your warning still applies

Includes practical AI use, verification and information risks.

Link to this lesson

Time, scope, distribution and feedback

Deliver intelligence safely, confirm use and improve the next cycle.

Topics you will explore

Agree when and how the answer will arrive
Send it to the people authorised to act
Evaluate whether the product helped

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 06

Sensemaking, critical thinking and people

Build and challenge a case from digital traces and human accounts.

6.1

Reasoning and the digital scene

Critical thinking under pressure: challenge the first story

Use competing hypotheses and a peer challenge to counter premature closure, group pressure and deception.

Topics you will explore

Use a practical reasoning check
Four ways good-looking analysis can fail
Review the reasoning without hindsight punishment
Five-minute peer review: find the weakest part of the case

Includes practical AI use, verification and information risks.

Link to this lesson

Sensemaking: build a working picture when the facts keep changing

Maintain a useful incident picture without forcing sparse observations into a complete causal narrative.

Topics you will explore

Connect observations without merging them prematurely
Your intervention can change the problem
Use bounded closure instead of claiming perfect understanding

Includes practical AI use, verification and information risks.

Link to this lesson

Choose the next evidence source when time is limited

Spend a short collection window on evidence that changes a decision, while preserving expiring records.

Topics you will explore

More records are not always more understanding
Look broadly, inspect deeply, then extract what matters
Define a stopping rule before you feel certain

Includes practical AI use, verification and information risks.

Link to this lesson

Revise the case when new evidence breaks the first explanation

Update a case board without hiding previous conclusions or treating every anomaly as deception.

Topics you will explore

A case explanation is a versioned working model
Change only what the new evidence changes
Keep a small revision ledger

Includes practical AI use, verification and information risks.

Link to this lesson

Crime-scene thinking: traces, disturbance and time

Apply forensic scene reasoning to digital systems while respecting the limits of artifacts.

Topics you will explore

A digital action leaves different traces in different places
A timestamp is not a universal clock
Record how the investigator changed the scene
Test a trace relationship with a simple example

Includes practical AI use, verification and information risks.

Link to this lesson

Read the missing trace: coverage, decay and investigator effects

Decide when a missing artifact is meaningful and preserve the context needed to interpret digital traces.

Topics you will explore

A trace must survive several stages before you can see it
The digital scene includes configuration and collection history
Test the collection method without changing the incident evidence

Includes practical AI use, verification and information risks.

Link to this lesson

6.2

Investigative interviews

Interview employees and witnesses without contaminating the account

Collect useful human evidence through neutral questions, accurate notes and corroboration.

Topics you will explore

Prepare around information gaps, not a desired confession
Let the person describe their sequence first
Separate exact statements, recollection and interpretation
Turn the account into testable leads

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 07

DFIR essentials and triage

Preparation, shared case records, evidence-led triage and OSINT.

7.1

Terms, readiness and case management

DFIR essentials: use terms precisely

Distinguish indicators, findings, containment and detection errors in a shared case record.

Topics you will explore

Containment is specific to an access or harm path
An indicator points to an observation, not a verdict
False positives and false negatives need a reference

Includes practical AI use, verification and information risks.

Link to this lesson

Prepare the lab, documents and on-call handover

Establish an investigation environment and response kit before collecting suspicious material.

Topics you will explore

Design the analysis environment before handling evidence
Decide whether network access is needed
Plan storage, copies and access
Make the response documents agree

Includes practical AI use, verification and information risks.

Link to this lesson

The case system: connect incidents without inventing a link

Record artifacts, actions and relationships so another responder can reconstruct the work.

Topics you will explore

Record the fields that make later correlation possible
Link cases while preserving their separate evidence
Use metrics to learn, not to reward premature closure

Includes practical AI use, verification and information risks.

Link to this lesson

7.2

General, malware and phishing triage

Triage: arrival, execution, impact and spread

Prioritise an incident and use peer review to decide the next evidence and response step.

Topics you will explore

Ask five different questions
Use peer review at the points where it can change the outcome
A disposition needs support and an owner

Includes practical AI use, verification and information risks.

Link to this lesson

Malware triage: file identity, type and external disclosure

Assess a suspicious file safely while distinguishing hash lookup from uploading its contents.

Topics you will explore

Identify the bytes before trusting the filename
Distinguish lookup from submission
A verdict is one input into triage
Preserve the time dimension

Includes practical AI use, verification and information risks.

Link to this lesson

IP, URL, email and modern phishing triage

Investigate the historical user action and resulting access when infrastructure has already changed.

Topics you will explore

A vanished page is a collection problem
Trace delivery, interaction and access separately
Ask what the person approved, not only what password they typed
Report malicious infrastructure without distributing secrets

Includes practical AI use, verification and information risks.

Link to this lesson

7.3

Disruption and closure review

DDoS and service-disruption triage

Separate traffic-driven harm, application failure and legitimate demand while coordinating service protection.

Topics you will explore

An overloaded service has more than one possible cause
Coordinate the layers that can actually reduce load
Preserve representative evidence and decision history

Includes practical AI use, verification and information risks.

Link to this lesson

Closure triage: prove what is resolved and transfer what is not

Review the case, verify actions and turn findings into owned detection and prevention improvements.

Topics you will explore

Revisit the whole chain before final closure
Transfer improvements into owned work
Close the incident without erasing uncertainty

Includes practical AI use, verification and information risks.

Link to this lesson

7.4

OSINT and image analysis

OSINT, image analysis and relationship mapping

Follow public-source leads reproducibly without confusing metadata or graph links with proof.

Topics you will explore

Follow leads with a recorded purpose
Use image metadata as a clue, not proof of place or authorship
Correlate across public and authorised internal sources
Choose tools that preserve the investigation record

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 08

Forensic science, collection, logs and disks

Preserve and interpret endpoint traces.

8.1

Forensic collection

Forensic science: collect the right traces and preserve their provenance

Select targeted or full acquisition and document the changes, gaps and custody of the evidence.

Topics you will explore

Choose live, targeted or full acquisition for a reason
Make custody and integrity verifiable
Think about what will disappear next
Collect the application context, not only operating-system files

Includes practical AI use, verification and information risks.

Link to this lesson

8.2

Log and disk analysis

Log analysis: from a text search to a reproducible timeline

Inspect logs with appropriate tools while validating timestamps, fields, parsing and missing intervals.

Topics you will explore

Find which system could have recorded the action
Search large logs without hiding the data model
Build a timeline with event and ingestion times
Read a small sequence before drawing the large conclusion
Worked example: a filename is not a process identity

Includes practical AI use, verification and information risks.

Link to this lesson

Disk forensics: MFT, USN, Prefetch, registry and browsers

Combine filesystem and application artifacts to distinguish presence, execution and changes.

Topics you will explore

Ask a different question of each artifact
Keep parser output connected to the original
Deleted recovery is conditional
Work through a download-to-execution claim
Worked example: file presence, change and execution

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 09

Network, memory, reports and the historical case

Connect network and memory evidence to technical reporting and the historical case study.

9.1

Network analysis and covert channels

Network forensics and packet analysis at scale

Move from network scope to conversations and host correlation without losing capture limitations.

Topics you will explore

The capture point defines what you can see
Capture filters and display filters solve different problems
Reconstructed objects need context and careful handling
Reduce the search while preserving a route back
Worked example: a filter cannot recover unrecorded traffic

Includes practical AI use, verification and information risks.

Link to this lesson

Covert channels: DNS, ICMP and concealed content

Investigate unusual communication without equating an encoding or protocol with malicious intent.

Topics you will explore

Separate the carrier from the instruction or data
Look for relationships and change
Test a hypothesis with bounded evidence

Includes practical AI use, verification and information risks.

Link to this lesson

9.2

Memory analysis

Memory forensics: processes, connections and incomplete views

Interpret memory artifacts with acquisition, tool and visibility limitations.

Topics you will explore

A memory capture is a partial moment in a changing system
Use supported tooling and check prerequisites
Compare views before alleging concealment
Connect a memory lead back to the investigation
Worked example: an extra process in a memory scan

Includes practical AI use, verification and information risks.

Link to this lesson

9.3

Technical reporting and real-case reasoning

Write an incident report another analyst can reproduce

Separate evidence, interpretation, actions and limitations in a coherent case report.

Topics you will explore

Give readers a reproducible account
Use wording that matches what was observed
Version and review the report

Includes practical AI use, verification and information risks.

Link to this lesson

Historical case study: read the WannaCry complaint critically

Separate observations, inferences and source dependence in a real historical investigative document.

Topics you will explore

Read the document as the kind of source it is
Build a claim-to-evidence worksheet
Transfer the method to a company investigation

Includes practical AI use, verification and information risks.

Link to this lesson

Chapter 10

Malware analysis, continued practice and presentation

Analyse samples, validate content rules, coordinate support and communicate decisions.

10.1

Static, dynamic and YARA analysis

Malware analysis: static examination and useful leads

Extract and evaluate file characteristics without executing the sample or overclaiming behaviour.

Topics you will explore

Static examination asks questions without running the sample
Packing and encoding affect what you can see
Understand a remote-access tool through its possible behaviours

Includes practical AI use, verification and information risks.

Link to this lesson

Dynamic malware analysis: observe behaviour in a controlled environment

Interpret a sandbox report within its environment and avoid treating non-execution as safety.

Topics you will explore

Define the observation before execution
Observe several layers and preserve their timing
Report capabilities separately from incident impact

Includes practical AI use, verification and information risks.

Link to this lesson

YARA: build and validate an evidence-based content rule

Turn distinctive sample content into a tested rule and report matches without claiming infection.

Topics you will explore

A content rule answers a bounded matching question
Build a small positive and negative test set
Treat enterprise searching as a controlled collection
Worked example: two markers, three outcomes

Includes practical AI use, verification and information risks.

Link to this lesson

10.2

Partners and continuing practice

Build partner relationships and a continuing practice plan

Prepare useful external coordination and turn gaps into measurable skill development.

Topics you will explore

Build relationships before the urgent request
Make a useful, bounded assistance request
Develop competence through reviewed work

Includes practical AI use, verification and information risks.

Link to this lesson

10.3

Plan and deliver the incident presentation

Plan the incident presentation around the audience and decision

Choose a purpose, opening and evidence structure that lets the audience act.

Topics you will explore

Identify the people and the decision
State the change you want the presentation to produce
Build the body, then plan the opening

Includes practical AI use, verification and information risks.

Link to this lesson

Close clearly, use honest visuals and rehearse difficult questions

Prepare a decision-focused ending, evidence-faithful visuals and accurate answers under pressure.

Topics you will explore

End with decisions, owners and dates
Use visuals that preserve meaning
Prepare for difficult questions without inventing answers
Practise the transfer from technical detail to decision

Includes practical AI use, verification and information risks.

Link to this lesson

10.4

Integrated investigation

Integrated investigation: from the first question to the final briefing

Produce a source-linked case file combining collection, analysis, forensic interpretation and response decisions.

Topics you will explore

Produce a connected investigation package
Evaluate quality through decisions, not length
Respond to the delayed evidence

Includes practical AI use, verification and information risks.

Link to this lesson

Practical AI use, with human judgement.

This course includes role-specific ways to use approved AI assistance, relevant AI threats and failure cases, and checks for evidence, data handling and human approval. Optional prompts use fictional information; an AI account is not required.

AI examples are practical learning activities. They do not add statutory training requirements or replace your organisation’s policies, qualified advice or accountable decisions.