Incident Response Foundations

An analyst decides what an alert means. An incident responder decides what to do once something bad has actually happened — and has to do it without destroying the evidence that explains how it started or breaking the systems that still have to work. This course is the "Incident response" stage of the Defensive Security pathway, and it follows SOC Analyst Foundations (ULC-006). You work on **soc01**, an Ubuntu 24.04 lab machine that carries a **synthetic, inert compromised-host scenario**: a brute force succeeded, and the intruder left planted persistence (a systemd service and timer, a cron entry and an SSH implant key), a tampered administrative script and an inert web-shell file. Everything is generated inside your own lab from documentation-range addresses; the payload never connects anywhere, the SSH key bodies are not usable, and the "web shell" is an inert marker. No production system, SOC, or real host is ever involved. Across ten lessons you practise the lifecycle as it is actually worked, following the current revision of NIST SP 800-61 (Rev. 3, the CSF 2.0 model): triage and declaration with severity and confidence recorded separately; scoping by pivoting across authentication, web, process, socket and telemetry evidence; super-timeline reconstruction in UTC; evidence handling in order of volatility with hashes and a chain of custody; containment, eradication and recovery driven through a written change record with rollback — and graded on real host state: the planted persistence removed and the legitimate services untouched; an incident report whose confidence language matches the evidence; and a blameless post-incident review that turns the case into detection and preparation improvements. The final project hands you a fresh, unlabelled incident and asks you to work it end to end and deliver a declaration, scope, timeline, hashed evidence package, containment and recovery through change control, a report and a review — graded against a rubric and automated lab checks. It leads into Detection Engineering (ULC-111), where the lessons learned here become detections.