Hands-On Cybersecurity Operations and Incident Response

Security operations often struggle for reasons that tools alone do not fix. Analysts face large volumes of alerts with little context, logging is incomplete where it matters most, detection rules are copied rather than tuned to the organisation, and incident response plans have never been exercised. When a real incident happens, evidence is lost, containment is delayed and communication with management and regulators is improvised.

This programme follows the defender's workflow from preparation to lessons learned. It moves through five stages: understanding the threat landscape and the organisation's attack surface, building visibility through logging and monitoring, detecting and analysing suspicious activity, containing, eradicating and recovering from incidents, and improving the security operation after each event.

Built on recognised practice. The programme references the NIST Cybersecurity Framework 2.0 and NIST SP 800-61 Revision 3 on incident response, the MITRE ATT&CK knowledge base of adversary techniques, the ISO/IEC 27035 series on information security incident management, ISO/IEC 27001 and the CIS Critical Security Controls. Participants use them to structure practical work, not as theory.

Decisions this programme improves. Which alerts to escalate and which to close; which logs and data sources are essential for detection; when to isolate a system and accept the business disruption; how to preserve evidence while restoring service; when to involve management, legal, regulators or external responders; and which control improvements to prioritise after an incident.

How it is delivered. Twenty hours across five sessions, combining short briefings with hands-on exercises in a lab environment. One running scenario follows a phishing-led intrusion through credential theft, lateral movement and attempted ransomware deployment. Participants triage alerts, analyse logs and network traffic, map activity to ATT&CK techniques, execute a containment plan and write an incident report.

In-house option. For organisations, the programme can be tailored to your own security tools, log sources, incident response plan and regulatory reporting obligations, and can end with a tabletop exercise involving technical staff and management.

Who Should Attend

Security operations staff: SOC analysts, incident responders and threat hunters

IT and network professionals: system administrators and network engineers with security responsibilities

Information security staff: security officers, engineers and consultants

IT audit and risk staff who need practical understanding of detection and response

Team leaders responsible for security monitoring or incident handling

Objectives

Describe common attack paths and map observed activity to MITRE ATT&CK tactics and techniques

Identify the log sources and telemetry needed to detect priority threats in their environment

Triage security alerts, separate false positives and escalate genuine incidents with supporting evidence

Analyse endpoint, network and authentication logs to reconstruct an attacker's actions

Write and tune basic detection rules and use threat intelligence to enrich investigations

Apply the NIST incident response approach to classify, prioritise and coordinate an incident

Carry out containment, eradication and recovery actions while preserving evidence

Collect and handle digital evidence in a way that maintains its integrity

Prepare clear incident reports and briefings for technical teams and management

Identify control and process improvements from lessons learned and track their implementation

Course Outline

Know the Threat and the Attack Surface

Current threat landscape: ransomware, phishing, supply chain and cloud attacks
Attacker lifecycle and the MITRE ATT&CK framework
Asset inventory and attack surface management
Vulnerability management and prioritisation
Identity as the new perimeter: privileged access and multi-factor authentication
NIST CSF 2.0 functions and their link to security operations

Building Visibility: Logging and Monitoring

Security operations centre roles, tiers and workflows
Essential log sources: endpoints, servers, network, identity, email and cloud
SIEM concepts: collection, normalisation, correlation and retention
Endpoint detection and response and network monitoring
Hands-on lab: building a monitoring view for priority assets
Monitoring industrial and operational technology environments: key differences

Detection and Analysis

Alert triage and prioritisation
Log analysis and correlation across data sources
Writing and tuning detection rules
Threat intelligence: sources, indicators and practical use
Threat hunting based on hypotheses and ATT&CK techniques
Automation and AI-assisted analysis: realistic benefits and limits
Hands-on lab: investigating a phishing-led intrusion

Responding to Incidents: Containment, Eradication and Recovery

Incident response plans, roles and escalation under NIST SP 800-61 Rev. 3
Incident classification and severity
Containment strategies and business impact decisions
Digital evidence collection, preservation and chain of custody
Ransomware response and recovery from backups
Communication with management, legal, regulators and third parties
Hands-on lab: containment and recovery exercise

Improving After the Incident

Post-incident review and root cause analysis
Writing incident reports and executive briefings
Updating playbooks, detections and controls
Security operations metrics: time to detect and time to respond
Tabletop exercises and continuous testing
Personal action plan for strengthening your security operation

Competencies

Threat mapping with MITRE ATT&CK

Security logging and monitoring design

Alert triage and escalation

Log analysis and incident investigation

Detection rule writing and tuning

Threat intelligence and threat hunting

Incident containment, eradication and recovery

Digital evidence handling

Incident reporting and post-incident improvement

Dubai

Elite Academy can deliver its complete portfolio of professional training programs in Dubai. With a global business, aviation and services hub with excellent international accessibility, the destination suits both scheduled learning and tailored arrangements for organizations or individual professionals. As an Elite Academy training destination, Dubai provides access to our full portfolio rather than a city-specific set of specializations. The city is a global business, aviation and services hub with excellent international accessibility, creating a suitable environment for organizations developing their teams and for professionals attending independently. Upcoming scheduled courses are listed on this page, while any other Elite Academy program can also be requested for delivery in Dubai, subject to scheduling and delivery requirements. Explore the schedule or browse our training areas to find the right option.