Incident Triage and First Response

Incident Triage and First Response: the first hour of an incident as five decisions, taught against a month of records from an attacked company. What the course covers, how it is built, where to practice, and a six-scenario check of whether it fits you.

What an alert claims, how to test the claim against the evidence underneath it, and how to classify the result as a true positive, a false positive, benign activity, or unresolved, across identity, endpoint, email, cloud and network alerts.

What evidence an incident leaves, how long each kind lasts, and the capture order that keeps what the investigation will need before time, the attacker or your own containment destroys it.

What an incident includes and what it can reach: scope built from links rather than the alert queue, pivots taken to completion, the blast radius of accounts, machines and data, alerts grouped on shared entities, a sourced triage timeline, and every claim graded by the evidence that carries it.

How bad an incident is and how fast it must be acted on, scored from evidence on an eight-question card, turned into a priority tier and a response clock, with overrides for the features a total cannot capture and a record for the cases where the card runs out.

Triaging a compromised account from its evidence: suspicious sign-ins, stolen sessions, MFA fatigue, password spray and brute force, service accounts, the changes attackers make to keep access, and hybrid pivots, each ending in a call, a severity and a next move.

Triaging reported phishing and business email compromise from the message, its delivery evidence and what recipients did with it: clicks and relayed sessions, attachments that run, consent grants, inbox rules and forwarding, the campaign scope and purge, each ending in a call, a severity and a next move.

Triaging malware and ransomware from the endpoint evidence: process trees and command lines, borrowed Windows binaries, credential dumping, persistence, lateral movement, Linux hosts, and the precursors that come before encryption, each ending in a call, a severity and a next move.

Triaging intrusions that cross the network edge, hosts, the identity layer and cloud applications: data leaving, cloud downloads, persistence in applications, perimeter alerts, VPN compromise and command-and-control, scoped across domains and scored as one incident.

Stopping attackers while the investigation continues: account, host, application and mailbox levers, each pulled in the system that holds it, in an order and at a time that leave no way back and give no warning, with the business cost measured and planned.

Moving a triaged incident to the people who act on it: escalation by threshold and clock, communication on channels the attacker cannot read, the notification trigger, the fifteen-minute Triage Report at the right confidence, and handoffs to the response team and the next shift.

Consuming what automation and AI hand the analyst: outputs read as inputs, enrichment whose silence is not clean, verdicts read for what they are about and overridden with a reason, automated containment reviewed for result, reach and aim, AI summaries checked claim by claim, and the narrow first actions that must be automatic because the attack is faster than the clock.

One incident triaged end to end, one decision per section: an intrusion from a public web server to a tenant-wide mail grant in eight minutes, left unopened for a day, then validated, preserved, scoped, scored, contained, escalated and reported in one afternoon.

The instruments to know from memory, the artifact-type vocabulary that makes a question transfer between stacks, and ten cheatsheets, one per call and incident type, with a lookup page.

The six calls of the first hour as runbooks, then the whole hour applied to account compromise, phishing and BEC, malware and ransomware, and exfiltration and intrusion. Every step names what it must produce, where it branches, and the query that starts it.

Build a triage lab from a Microsoft 365 E5 trial, an Azure free account and a Sentinel trial workspace, or from Splunk Free and Elastic, with every cost and clock stated and a check for how far back the evidence reaches.

Seven real alerts from the course's records triaged start to finish with the clock running, including the wrong turns. Each turns on one judgment: when to stop, when not to, what a reset leaves, where access lives, what silence means, what a score is for, and when to stop asking an empty source.

Nine playbooks, one per alert type the course triages: opened when the alert fires, each with pre-flight, a clearing check, what escalates it, an execution sequence, containment, a tiered disposition and what the handoff must say.

Practicing triage on the course's own records: what they hold, a practice loop that runs the hour on a real alert, where the records are thin, and the wider platform resources: guided investigations, the query console, the detection library and a DFIR toolkit.

The primary sources this course relies on: Microsoft Learn pages for the portals, logs and containment actions it uses, NIST SP 800-61r3, the MITRE ATT&CK techniques its incidents map to, and the ICO's breach-notification guidance.

The FOR301 project: a brief for three artifacts you build for your own estate from what the course taught, a five-query first-look pack, a scorecard calibrated to your priority tiers, and a Triage Report template your escalation path accepts. No submission, no grading.

Incident Triage and First Response end-of-course exam: a three-phase simulation testing whether you can apply the method to a situation the course did not walk through.