Hands-On Cybersecurity Operations and Incident Response

Security operations often struggle for reasons that tools alone do not fix. Analysts face large volumes of alerts with little context, logging is incomplete where it matters most, detection rules are copied rather than tuned to the organisation, and incident response plans have never been exercised. When a real incident happens, evidence is lost, containment is delayed and communication with management and regulators is improvised.

This programme follows the defender's workflow from preparation to lessons learned. It moves through five stages: understanding the threat landscape and the organisation's attack surface, building visibility through logging and monitoring, detecting and analysing suspicious activity, containing, eradicating and recovering from incidents, and improving the security operation after each event.

Built on recognised practice. The programme references the NIST Cybersecurity Framework 2.0 and NIST SP 800-61 Revision 3 on incident response, the MITRE ATT&CK knowledge base of adversary techniques, the ISO/IEC 27035 series on information security incident management, ISO/IEC 27001 and the CIS Critical Security Controls. Participants use them to structure practical work, not as theory.

Decisions this programme improves. Which alerts to escalate and which to close; which logs and data sources are essential for detection; when to isolate a system and accept the business disruption; how to preserve evidence while restoring service; when to involve management, legal, regulators or external responders; and which control improvements to prioritise after an incident.

How it is delivered. Twenty hours across five sessions, combining short briefings with hands-on exercises in a lab environment. One running scenario follows a phishing-led intrusion through credential theft, lateral movement and attempted ransomware deployment. Participants triage alerts, analyse logs and network traffic, map activity to ATT&CK techniques, execute a containment plan and write an incident report.

In-house option. For organisations, the programme can be tailored to your own security tools, log sources, incident response plan and regulatory reporting obligations, and can end with a tabletop exercise involving technical staff and management.

Who Should Attend

Security operations staff: SOC analysts, incident responders and threat hunters

IT and network professionals: system administrators and network engineers with security responsibilities

Information security staff: security officers, engineers and consultants

IT audit and risk staff who need practical understanding of detection and response

Team leaders responsible for security monitoring or incident handling

Objectives

Describe common attack paths and map observed activity to MITRE ATT&CK tactics and techniques

Identify the log sources and telemetry needed to detect priority threats in their environment

Triage security alerts, separate false positives and escalate genuine incidents with supporting evidence

Analyse endpoint, network and authentication logs to reconstruct an attacker's actions

Write and tune basic detection rules and use threat intelligence to enrich investigations

Apply the NIST incident response approach to classify, prioritise and coordinate an incident

Carry out containment, eradication and recovery actions while preserving evidence

Collect and handle digital evidence in a way that maintains its integrity

Prepare clear incident reports and briefings for technical teams and management

Identify control and process improvements from lessons learned and track their implementation

Course Outline

Know the Threat and the Attack Surface

Current threat landscape: ransomware, phishing, supply chain and cloud attacks
Attacker lifecycle and the MITRE ATT&CK framework
Asset inventory and attack surface management
Vulnerability management and prioritisation
Identity as the new perimeter: privileged access and multi-factor authentication
NIST CSF 2.0 functions and their link to security operations

Building Visibility: Logging and Monitoring

Security operations centre roles, tiers and workflows
Essential log sources: endpoints, servers, network, identity, email and cloud
SIEM concepts: collection, normalisation, correlation and retention
Endpoint detection and response and network monitoring
Hands-on lab: building a monitoring view for priority assets
Monitoring industrial and operational technology environments: key differences

Detection and Analysis

Alert triage and prioritisation
Log analysis and correlation across data sources
Writing and tuning detection rules
Threat intelligence: sources, indicators and practical use
Threat hunting based on hypotheses and ATT&CK techniques
Automation and AI-assisted analysis: realistic benefits and limits
Hands-on lab: investigating a phishing-led intrusion

Responding to Incidents: Containment, Eradication and Recovery

Incident response plans, roles and escalation under NIST SP 800-61 Rev. 3
Incident classification and severity
Containment strategies and business impact decisions
Digital evidence collection, preservation and chain of custody
Ransomware response and recovery from backups
Communication with management, legal, regulators and third parties
Hands-on lab: containment and recovery exercise

Improving After the Incident

Post-incident review and root cause analysis
Writing incident reports and executive briefings
Updating playbooks, detections and controls
Security operations metrics: time to detect and time to respond
Tabletop exercises and continuous testing
Personal action plan for strengthening your security operation

Competencies

Threat mapping with MITRE ATT&CK

Security logging and monitoring design

Alert triage and escalation

Log analysis and incident investigation

Detection rule writing and tuning

Threat intelligence and threat hunting

Incident containment, eradication and recovery

Digital evidence handling

Incident reporting and post-incident improvement

Kuwait

Train in Kuwait City with access to Elite Academy’s full portfolio of professional programs. In a city known as a key Gulf business and government center with an established professional environment, organizations and professionals can join upcoming courses or request any program to be arranged locally. Professional training in Kuwait City is not limited to a specific group of subjects. Elite Academy makes its complete portfolio available in the city across management, business, technical and industry-focused disciplines. With a key Gulf business and government center with an established professional environment, Kuwait City provides an effective setting for international learning. Use the schedule below to view courses already planned for the destination, or contact our team to request another program and preferred dates in Kuwait City, subject to scheduling and delivery requirements.