Topics:

• NIST IR framework

• Preparation (IR plan, playbooks)

• Identification techniques

Topics:

• RAM, network connections, processes, handles

• Fast triage scripts

Activity:
Document triage checklist for a compromised host.

Topics:

• Working with HR, Legal, Management

• When to call law enforcement

• Communication sequencing during IR

Topics:

• Evidence chain

• Packaging standards

• IR summary reports