Lesson 3: Detection, Investigation, Containment, and Response

Review a realistic scenario involving alerts, detections, incidents, and entity context.
Create or validate a configuration plan covering endpoint telemetry, timelines, and threat investigation and search, indicators, files, processes, domains, and devices.
Use logs, reports, or test results to confirm response verification and post-incident documentation.

Explain the purpose and operational impact of alerts, detections, incidents, and entity context.
Apply practical controls for endpoint telemetry, timelines, and threat investigation and search, indicators, files, processes, domains, and devices.
Validate and troubleshoot response verification and post-incident documentation using an evidence-based workflow.

Lesson Overview