For Security Engineers, First Responders, and On-Call Engineers Who Must Classify, Preserve, and Contain Within 60 Minutes
Incident Triage and First Response
Classify, preserve, and contain — the first 60 minutes that determine everything.
Triage security incidents across cloud, Windows, and Linux simultaneously — because real attacks cross environment boundaries. Classify severity accurately under time pressure, preserve volatile evidence before it disappears, execute initial containment that stops the damage without destroying the investigation, and hand off a complete scope assessment the IR team can act on immediately.
What you'll be able to do
Who this course is for
“An alert fires and I’m not sure if it’s real or how bad it is.” You stare at the Sentinel incident for five minutes trying to decide whether to escalate or close it. The 8-question severity scorecard gives you a defensible classification in 90 seconds — not instinct, not guesswork, a structured assessment you can explain to anyone who asks why you escalated.
“I’ve escalated incidents that turned out to be nothing — and missed ones that were real.” Both mistakes cost the same thing: your team’s trust in your judgment. This course builds the classification methodology that eliminates both failure modes — false escalations that waste senior analyst time and missed true positives that let attacks progress.
“By the time I start investigating, the volatile evidence is gone.” Process trees, network connections, memory state — they disappear within minutes of containment. This course teaches you to capture volatile evidence across cloud, Windows, and Linux before you do anything else. The evidence preservation order is the first thing you learn.
“The attack crossed from cloud into on-prem and I couldn’t follow it.” The attacker phished a credential in M365, used the token to access SharePoint, pivoted to a Windows endpoint via RDP, and moved to a Linux server. You need to triage all three environments in parallel and build the cross-environment timeline. This course teaches that correlation.
“I contained the account but I’m not sure I contained the right things.” You revoked the user’s sessions. But did you check for OAuth persistence? Did you isolate the endpoint they pivoted to? Did you block the C2 IP on the Linux firewall? This course teaches synchronized containment across all three environments — so you stop the attack, not just one piece of it.
“I hand incidents to the IR team and they ask me questions I can’t answer.” “What’s the scope?” “What evidence did you preserve?” “What containment actions did you take?” This course builds the triage report that answers every question before they ask it — scope assessment, evidence inventory, containment log, and outstanding questions. The IR team acts on your handoff, not re-triages from scratch.
Whatever your background — if the subject interests you and you’re willing to put in the work, this course is for you.
Before and after this course
A high-severity alert fires at 2 AM and you spend 20 minutes deciding whether to wake up the senior analyst. You escalate. It’s a false positive. The next one is real and you hesitate too long.
You revoke the user’s sessions and reset their password. Containment complete — except the attacker created an OAuth app with Mail.ReadWrite, and it’s still reading email 48 hours later because nobody checked for application persistence.
The IR team arrives and asks for the evidence. You point them at the Sentinel incident. They need process trees, memory state, and network connections that no longer exist because the endpoint was rebooted during containment.
Your triage notes say “investigated and contained.” The IR team has no scope assessment, no evidence inventory, no timeline. They start the investigation from scratch.
The alert fires at 2 AM and you run the 8-question scorecard. Score 6/8: high severity, confirmed compromise, lateral movement indicators. You escalate with the classification and the evidence. The senior analyst confirms your assessment in two minutes.
You contain across all three environments simultaneously: session revocation, endpoint isolation, OAuth app revocation, and Linux firewall rules. Every containment action verified. Every persistence mechanism checked before you declare containment complete.
Volatile evidence was captured before containment started. KAPE collection on Windows, cloud sign-in export, Linux process snapshot and memory capture. Chain of custody documented. The IR team has everything they need from the first 60 minutes.
Your triage report has scope assessment, cross-environment timeline, evidence inventory with hash verification, containment actions with timestamps, and outstanding questions. The IR team picks up where you left off — they don’t re-triage.
How the course works
Four phases build from triage methodology through environment-specific skills to cross-environment incident response:
The triage problem, severity classification scorecard, evidence volatility order, containment decision framework, and the structured handoff document. The methodology you apply to every incident regardless of type.
M365 and Entra ID triage: sign-in log analysis, KQL query packs, audit log investigation, session token assessment, OAuth app review, and cloud containment actions. The cloud environment produces the first evidence in most incidents.
Windows triage with KAPE and EZ Tools: process trees, security events, network connections, registry analysis. Linux triage: auth.log, process enumeration, LiME memory capture, Volatility3. Evidence preservation before containment.
Unified timeline construction, entity correlation across environments, synchronized containment, the complete triage report, and real incident scenarios: BEC, ransomware pre-encryption, credential theft with lateral movement.
What the content looks like
This is a real triage report excerpt from the cross-environment module. After 45 minutes of triage across cloud, Windows, and Linux, this is what you hand to the IR team — a structured document they can act on immediately:
The IR team reads this and knows exactly what happened, what was contained, what evidence is available, and what questions remain. They don’t re-triage. They investigate. Every module teaches at this level — the methodology, the tools, the documentation, and the handoff that makes the first 60 minutes count.
Lab Pack — Hands-On Triage Practice
Downloadable lab pack with realistic-volume evidence across all four environments. Attack indicators buried in hundreds of lines of legitimate noise — the same needle-in-haystack challenge you face in production.
Evidence generated: Cloud sign-in logs (~250 entries with AiTM buried in 7 days of legitimate logins), cloud audit logs (~200 entries), Windows process list (~120 entries with 5 suspicious among legitimate processes), Windows security events (~400 entries), Linux auth.log (~800 lines with brute force buried in CRON/SSH noise), firewall log (~300 entries), DNS queries (~300 entries), plus 8 JSON alerts, unified timeline, entity map, and triage templates.
26 structured labs: Alert prioritization, sign-in analysis, audit log triage, process tree analysis, security event timeline, SSH brute force scoping, cross-environment correlation, severity scoring, containment execution, and the 15-minute triage report.
Usage rights and disclaimer
Course materials: Licensed for individual professional development. You may deploy triage scripts, query packs, and playbooks from this course in your organization’s production environment. You may not redistribute course content, share account credentials, or republish course materials.
Triage tools and scripts: All PowerShell, Bash, and KQL artifacts are provided as-is. Test every script against your environment before using in production incidents. Containment actions have business impact — verify blast radius before execution.
Fictional environment: All scenarios use the fictional Northgate Engineering environment. Any resemblance to real organizations is coincidental.
Version and changelog
Current version: 2.0 | Last updated: May 2026
May 2026 — v2.0: Course page restructured. Lab pack with realistic-volume evidence across 4 environments, 26 structured labs.
2026 — v1.0: Course launch. 16 modules (TR0–TR15) across 4 phases. Cloud, Windows, Linux, and network triage with full tool coverage.
This course is actively maintained. Triage procedures are updated as the Microsoft security platform evolves and new attack techniques emerge.
End of Course Exam
Complete the course, then prove your skills under time pressure. Pass mark: 70. Earn your certificate with CPE credits.
Requires 80% course completion. One random scenario per attempt. Certificate issued on pass.