CYBERSECURITY TRAINING ACADEMY
BlueTeamACADEMY
Start 30-day demo

FROM TOOL USER TO INVESTIGATOR

Incident Response and Investigation

Turning tool users into world-class analysts and investigators. Intelligence-analysis disciplines taught to NSA, CIA and FBI professionals, adapted to cybersecurity investigations and DFIR/SOC work. Learn to connect evidence, challenge explanations and make defensible response decisions.

Available now6 chapters3.4 h35 lessonsEnglish
Explore the course topics ↓

After this course, learners will…

What learners can do

  • Turn an ambiguous incident into answerable questions, a collection plan and a source-linked case notebook.
  • Distinguish observations from assumptions, test competing explanations and revise conclusions when the evidence changes.
  • Choose proportionate response actions under uncertainty and brief technical teams and decision-makers with clear evidence and limits.

Benefits for your company

  • Investigations can focus scarce analyst time on evidence that changes a response decision.
  • Case notes and handovers make reasoning easier to challenge, continue and review across shifts.
  • Leaders receive defensible findings and response options instead of confident claims unsupported by the evidence.

INSIDE THE COURSE

Explore the course, chapter by chapter.

6 chapters · 35 lessons3.4 hExercises take additional time.

Build your skills in sequence, practise with the supplied cases and verify your decisions. Explore the chapters and lesson objectives below.

Explore the outline. Open a section to see the lessons and topics inside.

Chapter 01

Frame the incident and the decision

0.8 h

Turn an alert into a bounded investigation, an initial case board and an owned decision.

1.1

From alert handling to investigative work

01

Become an investigator, not just a tool operator

10 slides · 2 practical activities · Knowledge checks

Turn an incident report into questions, evidence and decisions that support the wider response. Apply it to the evolving Meridian case.

Topics you will explore

  • The same person can wear three different hats
  • Follow the consequence beyond the infected host
  • Communicate early without turning suspicion into blame

Includes practical AI use, verification and information risks.

Link to this lesson
02

Intelligence starts with a decision, not a feed

10 slides · 2 practical activities · Knowledge checks

Convert an ambiguous request into an answerable requirement with an owner and deadline. Apply it to the evolving Meridian case.

Topics you will explore

  • What makes information useful intelligence?
  • Separate the external problem from our information need
  • Write a requirement that another analyst can act on

Includes practical AI use, verification and information risks.

Link to this lesson
03

Choose a method that fits the question

10 slides · 2 practical activities · Knowledge checks

Distinguish lookup, calculation, explanation and uncertain future scenarios. Apply it to the evolving Meridian case.

Topics you will explore

  • Not every question is a search problem
  • Bounded choices and open situations
  • Make uncertainty operational

Includes practical AI use, verification and information risks.

Link to this lesson
1.2

Keep a case record others can use

04

Case notes another investigator can trust

12 slides · 2 practical activities · Knowledge checks

Create a source-linked case journal that distinguishes observation, interpretation, decisions and unfinished work. Apply it to the evolving Meridian case.

Topics you will explore

  • Write for the next investigator, including yourself
  • Give every entry a time, type and source
  • Make a finding recoverable, not just memorable
  • Correct the record without rewriting your past
  • Turn a journal into a usable handover

Includes practical AI use, verification and information risks.

Link to this lesson
05

Choose and organise your investigative notebook

12 slides · 2 practical activities · Knowledge checks

Select a note-taking workflow and maintain a useful visual case view without losing the authoritative record. Apply it to the evolving Meridian case.

Topics you will explore

  • Choose the workflow before the application
  • Build a CherryTree case tree that stays navigable
  • Use linked Markdown when portability matters
  • Use a mind map to expose questions, not manufacture proof
  • Keep working views aligned with the team record

Includes practical AI use, verification and information risks.

Link to this lesson
1.3

Build a working picture and keep it open

06

Sensemaking: build a working picture when the facts keep changing

10 slides · 2 practical activities · Knowledge checks

Maintain a useful incident picture without forcing sparse observations into a complete causal narrative. Apply it to the evolving Meridian case.

Topics you will explore

  • Build the missing link, not a convincing story
  • Look at the event from more than one working role
  • Give the current decision a finish line

Includes practical AI use, verification and information risks.

Link to this lesson
07

The intelligence cycle is a working loop

10 slides · 2 practical activities · Knowledge checks

Use feedback between requirements, collection, processing, analysis and delivery. Apply it to the evolving Meridian case.

Topics you will explore

  • Why the arrows go both ways
  • Coordinate the loop without a large intelligence department
  • Six useful checks on every product

Includes practical AI use, verification and information risks.

Link to this lesson
Chapter 02

Find the evidence that matters

0.7 h

Protect the context, choose complementary sources and turn human accounts into testable leads.

2.1

Understand the scene before interpreting it

08

Crime-scene thinking: traces, disturbance and time

11 slides · 2 practical activities · Knowledge checks

Apply forensic scene reasoning to digital systems while respecting the limits of artifacts. Apply it to the evolving Meridian case.

Topics you will explore

  • Treat the evidence view as a sample of the scene
  • Reconstruct time without inventing precision
  • Keep the responder in the reconstruction
  • Connect records through a mechanism

Includes practical AI use, verification and information risks.

Link to this lesson
09

Read the missing trace: coverage, decay and investigator effects

10 slides · 2 practical activities · Knowledge checks

Decide when a missing artifact is meaningful and preserve the context needed to interpret digital traces. Apply it to the evolving Meridian case.

Topics you will explore

  • A trace must survive several stages before you can see it
  • The digital scene includes configuration and collection history
  • Test the collection method without changing the incident evidence

Includes practical AI use, verification and information risks.

Link to this lesson
2.2

Choose sources and spend time wisely

10

Build a collection plan from expected evidence

10 slides · 2 practical activities · Knowledge checks

Translate a requirement into discriminating evidence, collection tasks and stopping rules. Apply it to the evolving Meridian case.

Topics you will explore

  • Work backwards from the answer Priya needs
  • Ask what each possible result would change
  • Make the request usable by another person

Includes practical AI use, verification and information risks.

Link to this lesson
11

Select sources and manage collection limits

10 slides · 2 practical activities · Knowledge checks

Combine people, artifacts, telemetry and records without overstating their coverage. Apply it to the evolving Meridian case.

Topics you will explore

  • Use the source for what it can observe
  • Availability is not the same as authority
  • Fill gaps with complementary sources

Includes practical AI use, verification and information risks.

Link to this lesson
12

Choose the next evidence source when time is limited

10 slides · 2 practical activities · Knowledge checks

Spend a short collection window on evidence that changes a decision, while preserving expiring records. Apply it to the evolving Meridian case.

Topics you will explore

  • More records are not always more understanding
  • Look broadly, inspect deeply, then extract what matters
  • Define a stopping rule before you feel certain

Includes practical AI use, verification and information risks.

Link to this lesson
2.3

Collect an account and accept useful evidence

13

Interview employees and witnesses without contaminating the account

11 slides · 2 practical activities · Knowledge checks

Collect useful human evidence through neutral questions, accurate notes and corroboration. Apply it to the evolving Meridian case.

Topics you will explore

  • Prepare around information gaps, not a desired confession
  • Let the person describe their sequence first
  • Separate exact statements, recollection and interpretation
  • Turn the account into testable leads

Includes practical AI use, verification and information risks.

Link to this lesson
14

Task collectors and verify delivery

10 slides · 2 practical activities · Knowledge checks

Control parallel collection, handovers and incomplete results. Apply it to the evolving Meridian case.

Topics you will explore

  • Turn a request into owned work
  • Inspect the delivery, not just the success icon
  • Reprioritise visibly when the case changes

Includes practical AI use, verification and information risks.

Link to this lesson
Chapter 03

Establish what the evidence supports

0.4 h

Create a shared record, distinguish source quality from claim strength and audit the reasoning.

3.1

Organise and qualify the evidence

15

Collate information so another analyst can continue

10 slides · 2 practical activities · Knowledge checks

Organise heterogeneous evidence without losing provenance or imposing a premature story. Apply it to the evolving Meridian case.

Topics you will explore

  • Processing changes form; collation builds useful relationships
  • Use a schema that survives new information
  • Do not let the database become the investigation

Includes practical AI use, verification and information risks.

Link to this lesson
16

Evaluate the source separately from the claim

10 slides · 2 practical activities · Knowledge checks

Apply reliability, proximity and subject competence without reducing judgement to a trust score. Apply it to the evolving Meridian case.

Topics you will explore

  • Reliability is a track record, not immunity from error
  • Trace how the information reached you
  • Ask whether the source can know this particular thing

Includes practical AI use, verification and information risks.

Link to this lesson
3.2

Corroboration and the missing inference

17

Test plausibility, expectations and independent support

10 slides · 2 practical activities · Knowledge checks

Avoid treating a familiar or widely repeated claim as established evidence. Apply it to the evolving Meridian case.

Topics you will explore

  • Unpack the sentence before accepting its conclusion
  • A surprising observation calls for a better question
  • Find where the certainty was added

Includes practical AI use, verification and information risks.

Link to this lesson
18

Critical thinking under pressure: challenge the first story

11 slides · 2 practical activities · Knowledge checks

Use competing hypotheses and a peer challenge to counter premature closure, group pressure and deception. Apply it to the evolving Meridian case.

Topics you will explore

  • Use a practical reasoning check
  • Four ways good-looking analysis can fail
  • Review the reasoning without hindsight punishment
  • Peer review: make the next step better

Includes practical AI use, verification and information risks.

Link to this lesson
Chapter 04

Build, test and revise explanations

0.7 h

Combine observations, make alternatives testable and change the case when new evidence arrives.

4.1

Use reasoning for a practical question

19

Facts, findings and forecasts: how far can the evidence take you?

10 slides · 2 practical activities · Knowledge checks

Separate observation, inference and conditional prediction. Apply it to the evolving Meridian case.

Topics you will explore

  • Facts and findings do different work
  • A forecast needs assumptions and triggers
  • Break a large conclusion into smaller claims

Includes practical AI use, verification and information risks.

Link to this lesson
20

Induction: learn from patterns without inventing a rule

10 slides · 2 practical activities · Knowledge checks

Use repeated observations while checking sampling and counterexamples. Apply it to the evolving Meridian case.

Topics you will explore

  • A pattern is a useful lead
  • Ask what your sample excludes
  • Try to break the proposed generalisation

Includes practical AI use, verification and information risks.

Link to this lesson
21

Deduction: check the premises before trusting the conclusion

10 slides · 2 practical activities · Knowledge checks

Test conditional reasoning and avoid reversing an implication. Apply it to the evolving Meridian case.

Topics you will explore

  • Valid logic can start from a false premise
  • Do not reverse the implication
  • An adversary can imitate the expected sequence

Includes practical AI use, verification and information risks.

Link to this lesson
22

Abduction and testing: explain an anomaly, then challenge it

10 slides · 2 practical activities · Knowledge checks

Generate alternative mechanisms and choose safe discriminating tests. Apply it to the evolving Meridian case.

Topics you will explore

  • Explain the mismatch without inventing an actor
  • Make the explanation risk being wrong
  • Separate a failed explanation from a failed check

Includes practical AI use, verification and information risks.

Link to this lesson
4.2

Challenge the explanation before committing

23

Compare hypotheses using evidence that could prove you wrong

10 slides · 2 practical activities · Knowledge checks

Build and revise a small competing-hypotheses matrix. Apply it to the evolving Meridian case.

Topics you will explore

  • Choose explanations that could change the response
  • Mark inconsistency and dependence
  • Use the matrix to choose the next check

Includes practical AI use, verification and information risks.

Link to this lesson
24

Linchpin analysis: test the assumptions holding the conclusion up

10 slides · 2 practical activities · Knowledge checks

Find pivotal premises and monitor indicators that could overturn an assessment. Apply it to the evolving Meridian case.

Topics you will explore

  • Find the few assumptions that matter most
  • Support each pivotal premise
  • Define what would reverse the assessment

Includes practical AI use, verification and information risks.

Link to this lesson
25

Use analogies without copying the last incident’s conclusion

10 slides · 2 practical activities · Knowledge checks

Compare mechanisms and dissimilarities before transferring a lesson. Apply it to the evolving Meridian case.

Topics you will explore

  • Similarity is a starting point
  • List the differences before making the recommendation
  • Transfer a test, not an unverified conclusion

Includes practical AI use, verification and information risks.

Link to this lesson
26

Revise the case when new evidence breaks the first explanation

10 slides · 2 practical activities · Knowledge checks

Update a case board without hiding previous conclusions or treating every anomaly as deception. Apply it to the evolving Meridian case.

Topics you will explore

  • Let the new record change the picture
  • Do not swing from accusation to all-clear
  • Send a correction that someone can act on

Includes practical AI use, verification and information risks.

Link to this lesson
Chapter 05

Make a response decision under pressure

0.5 h

Challenge bias and organisational pressure, then compare proportionate actions and their consequences.

5.1

Pressure-test your own judgement

27

Bias in the evidence: anchoring, closure and false confirmation

10 slides · 2 practical activities · Knowledge checks

Recognise how early stories and familiar patterns distort evidence evaluation. Apply it to the evolving Meridian case.

Topics you will explore

  • The first plausible story can become the default
  • Supporting one explanation does not eliminate the others
  • Noisy history does not invalidate a new report

Includes practical AI use, verification and information risks.

Link to this lesson
28

Bias between teams: secrecy, loyalty and imagined coordination

10 slides · 2 practical activities · Knowledge checks

Prevent organisational incentives and information boundaries from distorting the case. Apply it to the evolving Meridian case.

Topics you will explore

  • An organisation is not a single coordinated mind
  • Specialisation can become a blind spot
  • Protect sensitive evidence without blocking necessary review

Includes practical AI use, verification and information risks.

Link to this lesson
29

Bias about the adversary: motives, rationality and effort

10 slides · 2 practical activities · Knowledge checks

Avoid projecting your preferences onto another actor’s decisions. Apply it to the evolving Meridian case.

Topics you will explore

  • The attacker does not share your priorities
  • Unexpected behaviour is not proof of irrationality
  • Do not infer importance directly from visible effort

Includes practical AI use, verification and information risks.

Link to this lesson
30

Bias in estimates: optimism, pessimism and refusing to update

10 slides · 2 practical activities · Knowledge checks

Review confidence and scenarios without wishful thinking or automatic worst cases. Apply it to the evolving Meridian case.

Topics you will explore

  • Threatening evidence is easy to explain away
  • Confidence must match the evidence, not the speaker
  • Prepare for severe outcomes without calling them established

Includes practical AI use, verification and information risks.

Link to this lesson
5.2

Recommend an action with limits and review conditions

31

Opportunity analysis: find the defensive move that changes the case

10 slides · 2 practical activities · Knowledge checks

Identify leverage, dependencies and adverse consequences before recommending action. Apply it to the evolving Meridian case.

Topics you will explore

  • Act on the supported risk while cause remains open
  • Make the control’s limits visible
  • Show the consequence of each choice

Includes practical AI use, verification and information risks.

Link to this lesson
Chapter 06

Brief, hand over and learn

0.4 h

Turn the accumulated case into timely warnings, a decision brief and a handover another investigator can use.

6.1

Match the message to the decision

32

Choose the right intelligence product

10 slides · 2 practical activities · Knowledge checks

Distinguish background research, current warning, operational support and conditional forecasts. Apply it to the evolving Meridian case.

Topics you will explore

  • One subject can produce different answers
  • Match detail to the job
  • Source disciplines are different ways of learning

Includes practical AI use, verification and information risks.

Link to this lesson
33

Warn early without pretending to know exactly what happens next

10 slides · 2 practical activities · Knowledge checks

Write an actionable warning that separates evidence, uncertainty, decision urgency and review triggers. Apply it to the evolving Meridian case.

Topics you will explore

  • A warning buys decision time
  • Define a trigger and an owner
  • Check whether your warning still applies

Includes practical AI use, verification and information risks.

Link to this lesson
34

Write the decision first and show its support

10 slides · 2 practical activities · Knowledge checks

Produce an intelligence brief that preserves evidence and uncertainty. Apply it to the evolving Meridian case.

Topics you will explore

  • Lead with what the recipient needs to decide
  • Build a short, checkable argument
  • Preserve the route back to evidence

Includes practical AI use, verification and information risks.

Link to this lesson
6.2

Verify use, transfer ownership and improve the next response

35

Time, scope, distribution and feedback

11 slides · 3 practical activities · Knowledge checks

Deliver intelligence safely, confirm use and improve the next cycle. Apply it to the evolving Meridian case.

Topics you will explore

  • Give each recipient the answer they can use
  • Check understanding, not only delivery
  • Measure usefulness without rewriting the past

Includes practical AI use, verification and information risks.

Link to this lesson

AI

Practical AI use, with human judgement.

This course includes role-specific ways to use approved AI assistance, relevant AI threats and failure cases, and checks for evidence, data handling and human approval. Optional prompts use fictional information; an AI account is not required.

AI examples are practical learning activities. They do not add statutory training requirements or replace your organisation’s policies, qualified advice or accountable decisions.