Skip to Content

Certified Incident Responder (eCIR)   


Request for price


Length: 5 day (40 hours)

 

This course is a deeply hands-on training program that simulates a real-world corporate breach. Unlike theoretical courses, eCIR focuses on the technical "how-to" of finding an active adversary. You will move through the entire Incident Response (IR) lifecycle—from initial detection in a SIEM to endpoint forensics and network traffic reconstruction.

The curriculum is designed to reflect the modern SOC 3.0 landscape, where attackers use fileless malware, Living-off-the-Land (LotL) techniques, and advanced persistence mechanisms. The course is built around five core domains that culminate in a fully practical, lab-based exam

The eCIR is an intermediate-to-advanced certification. To get the most out of it, you should have:

  • Networking Mastery: Deep understanding of the OSI model, packet headers, and common protocols (SMB, Kerberos, DNS, HTTP/S).
  • OS Internals: Proficiency in Windows and Linux administration, particularly in how they log events and manage processes.
  • Security Fundamentals: Familiarity with the MITRE ATT&CK and Cyber Kill Chain frameworks.
  • Tooling Foundations: Previous experience with a SIEM (Splunk or ELK) and network analysis tools (Wireshark) is highly recommended.
  • Recommended Career Path: Many students complete the eEDA (Defense Administrator) or eJPT before attempting the eCIR

SOC Analysts (Tier 1 & 2): Looking to advance into Tier 3 or specialized IR roles.

Incident Responders: Professionals who want to validate their ability to handle live "heat of the moment" breaches.

System/Network Administrators: Who are responsible for defending their infrastructure and performing first-response duties.

Blue Teamers: Seeking a certification that values practical "find-the-threat" skills over multiple-choice theory.

Red Teamers: Wanting to understand the "other side" to build more stealthy and effective emulation engagements

Course objectivesCourse outlines

Course objectives

After completing this course, students will be able to:

        • Detect & Correlate: Construct advanced queries in Splunk/ELK to identify Indicators of Compromise (IoCs) across disparate log sources.
        • Analyze Endpoints: Identify privilege escalation, credential dumping (LSASS/SAM), and persistence (Scheduled Tasks, Registry) in real-time.
        • Trace Network Chains: Use Wireshark and Zeek to reconstruct attack paths, lateral movement, and C2 (Command & Control) communications.
        • Perform Light Forensics: Deconstruct malicious documents (Macros/VBA) and perform static analysis on suspicious executables.
        • Apply Intelligence: Use MITRE ATT&CK to attribute behaviors to specific threat actor groups and TTPs.
        • Report & Remediate: Draft a professional investigation report that includes a timeline of events and actionable recovery recommendations.


Course outlines

    • Domain 1: Threat Detection & SIEM Operations
      • Constructing custom SIEM queries to identify malicious patterns.
      • Correlating multi-source log data to detect initial access.
      • Recognizing signs of attacker footholds in enterprise environments.
    • Domain 2: Endpoint & Network Analysis 
      • Analyzing telemetry for local user and system enumeration.
      • Differentiating privilege escalation and credential access (SAM/LSASS dumping).
      • Tracing lateral movement and authentication-based anomalies in PCAP data.
    • Domain 3: Digital Forensics & Evidence Analysis
      • Deconstructing malicious documents and extracting VBA payloads.
      • Static analysis of PE files for suspicious imports and metadata.
      • Examining Windows Registry for execution history and system changes.
    • Domain 4: Threat Intelligence & Attribution 
      • Mapping detected behaviors to MITRE ATT&CK TTPs.
      • Assessing behavioral patterns to attribute activity to specific APT groups.
    • Domain 5: Reporting & Communication 
      • Composing clear investigation reports including impact assessments.
      • Conveying technical findings (IOCs, tools, payloads) to stakeholders.

Download Outlines