Core · Incident Response

OSIR

OffSec Incident Responder

Develop a structured response practice for triage, evidence acquisition, investigation, containment and recovery across common enterprise incidents.

Course overview

Skills with real-world context

Designed around the workflows and decisions practitioners use—not a collection of disconnected tool demonstrations.

Develop a structured response practice for triage, evidence acquisition, investigation, containment and recovery across common enterprise incidents. The learning path combines guided concepts, repeatable lab methodology, evidence collection and professional communication.

Incident Response Analyst Cyber Defense Consultant Digital Forensics Associate

2026 market direction

Ransomware, identity attacks and cloud-connected incidents are keeping response capability high on security agendas. Teams value responders who can preserve evidence and make defensible decisions under pressure.

Course content

What you will study

A focused six-module roadmap. Exact official syllabus and assessment policies remain subject to OffSec updates.

IR Process

Preparation and response roles

Severity and escalation

Legal and evidence considerations

Communication planning

Triage & Scoping

Initial alert validation

Host and account scoping

Indicator collection

Rapid decision frameworks

Evidence Acquisition

Volatile and persistent evidence

Disk and log collection

Chain of custody

Collection pitfalls

Endpoint Investigation

Process and persistence analysis

Authentication and user activity

Malware triage concepts

Timeline construction

Containment & Recovery

Short- and long-term containment

Eradication planning

Recovery validation

Monitoring for recurrence

Response Reporting

Technical findings

Executive communication

Root cause and impact

Lessons learned and improvements

Plan your preparation

Audience, prerequisites and exam

Who should attend

SOC analysts moving into incident response
System administrators joining response teams
Security professionals formalizing IR methodology

Recommended prerequisites

Windows, Linux and networking fundamentals plus basic security investigation experience.

Certification assessment

A scenario-driven incident response assessment. Confirm current evidence, tooling and report expectations with OffSec.

Learning outcomes

Capabilities you will build

Triage and scope security incidents

Collect endpoint and network evidence safely

Build timelines and test hypotheses

Recommend containment, recovery and lessons learned

Primary curriculum reference: Official OSIR course information . Pricing, exam format and availability should always be confirmed with OffSec.