Visão Geral

Este curso apresenta os fundamentos de resposta a incidentes de segurança, abordando preparação, detecção, triagem, contenção, erradicação, recuperação e documentação.

Objetivo

Após realizar este curso, você será capaz de:

• Estruturar processos de incident response
• Realizar triagem de incidentes
• Apoiar contenção e erradicação
• Documentar investigações

Publico Alvo

• Incident Responders
• SOC Analysts
• Blue Team
• Profissionais de Cybersecurity

Pre-Requisitos

• Conhecimentos básicos de redes
• Familiaridade com Windows e Linux
• Conhecimentos de logs
• Noções de SIEM
• Conhecimentos básicos de segurança

Conteúdo Programatico

Module 1: Incident Response Fundamentals

1. Incident response concepts
2. Incident lifecycle
3. Incident response teams
4. Incident classification
5. Severity assessment
6. Incident response plans
7. Roles and responsibilities
8. Communication
9. Escalation
10. Incident response governance

Module 2: Detection and Triage

1. Security alerts
2. Alert validation
3. Incident identification
4. Initial triage
5. Evidence collection
6. IOC identification
7. Threat classification
8. Incident prioritization
9. Investigation scope
10. Triage documentation

Module 3: Investigation

1. Timeline analysis
2. Log investigation
3. Endpoint investigation
4. Network investigation
5. Identity investigation
6. Malware indicators
7. Credential attacks
8. Lateral Movement
9. Persistence
10. Attack reconstruction

Module 4: Containment

1. Containment strategies
2. Host isolation
3. Account containment
4. Network containment
5. Credential reset
6. Malicious process containment
7. Persistence containment
8. Short-term containment
9. Long-term containment
10. Containment validation

Module 5: Eradication and Recovery

1. Malware removal
2. Persistence removal
3. Credential remediation
4. Vulnerability remediation
5. System recovery
6. Identity recovery
7. Security control restoration
8. Recovery validation
9. Monitoring after recovery
10. Business continuity

Module 6: Evidence and Documentation

1. Evidence handling
2. Evidence preservation
3. Chain of custody
4. Investigation notes
5. Timeline documentation
6. IOC documentation
7. Technical reporting
8. Executive reporting
9. Incident records
10. Lessons learned

Module 7: Incident Response Tools

1. SIEM
2. EDR
3. Network monitoring
4. Threat intelligence
5. Forensics tools
6. Log analysis
7. Case management
8. Evidence collection tools
9. Investigation workflows
10. Tool integration

Module 8: Practical Incident Response

1. Incident identification
2. Initial triage
3. Evidence collection
4. Investigation
5. Containment
6. Eradication
7. Recovery
8. Reporting
9. Lessons learned
10. Incident response case study