Cyber Incident Management and Digital Forensics

Learn to detect and respond to cybersecurity incidents

Cyber incidents can happen to any organisation. Knowing how to detect and respond to them quickly can help limit their impact.

On this three-week cyber course, you’ll explore the full incident lifecycle, from identifying suspicious activity to investigating, containing, and recovering from security incidents.

You’ll develop your threat detection skills by working with SIEM correlation rules, endpoint alerts, and network traffic. Using Wireshark, you’ll learn how to identify patterns associated with attacks such as DoS and DDoS in controlled scenarios.

Build practical cyber incident response skills

Effective security incident management requires a structured approach. You’ll explore how security teams classify and prioritise incidents, define roles and responsibilities, communicate during an incident, and develop response playbooks.

You’ll follow the incident response lifecycle from initial detection through to containment and recovery, building an understanding of how security operations teams coordinate their response to cyber threats.

Investigate cyber incidents with digital forensics

Develop practical knowledge of digital forensics and the techniques used to investigate security incidents. You’ll explore forensic documentation, evidence integrity, log analysis, file forensics, memory capture, and timeline reconstruction.

You’ll also examine how compromised systems can be isolated and remediated. Using Linux security tools and iptables, you’ll explore host isolation, threat eradication, system rebuild validation, and post-incident resilience measures.

By the end of the course, you’ll be able to take a structured approach to detecting, investigating, and managing cybersecurity incidents - preparing you for a range of cybersecurity roles.

This course is designed for security analysts, SOC professionals, and technically minded learners building structured capabilities in threat detection, incident investigation, and response as part of their professional development in cybersecurity.

The primary audience includes aspiring incident responders, digital forensics analysts, and security operations professionals seeking a practical, hands-on entry point into one of the most operationally critical disciplines in the industry.

It directly supports career pathways such as SOC Analyst, Incident Responder, Digital Forensics Analyst, and Threat Hunter across sectors including financial services, healthcare, government, telecommunications, and technology, where the ability to detect, contain, and recover from security incidents is a standard organisational requirement.

The course is also well suited for IT administrators, network engineers, and security generalists seeking to formalise their knowledge of detection engineering, forensic investigation, and incident lifecycle management, with prior familiarity with cybersecurity concepts, networking fundamentals, and operating system administration strongly recommended.

Learners should have prior knowledge of cybersecurity fundamentals, networking, Linux, and common security threats. A computer with a stable internet connection and support for virtual machines is required. SIEM, network analysis, incident response, and digital forensics tools are introduced during the course.

This course is designed for security analysts, SOC professionals, and technically minded learners building structured capabilities in threat detection, incident investigation, and response as part of their professional development in cybersecurity.

The primary audience includes aspiring incident responders, digital forensics analysts, and security operations professionals seeking a practical, hands-on entry point into one of the most operationally critical disciplines in the industry.

It directly supports career pathways such as SOC Analyst, Incident Responder, Digital Forensics Analyst, and Threat Hunter across sectors including financial services, healthcare, government, telecommunications, and technology, where the ability to detect, contain, and recover from security incidents is a standard organisational requirement.

The course is also well suited for IT administrators, network engineers, and security generalists seeking to formalise their knowledge of detection engineering, forensic investigation, and incident lifecycle management, with prior familiarity with cybersecurity concepts, networking fundamentals, and operating system administration strongly recommended.

• Apply SIEM, endpoint telemetry, and network monitoring techniques to detect and investigate security incidents.
• Investigate security events, traffic patterns, endpoint alerts, and forensic evidence to determine incident scope and impact.
• Develop incident response procedures, communication plans, playbooks, and forensic documentation practices.
• Discuss containment, eradication, recovery, and return-to-service procedures during simulated security incidents.
• Evaluate incident outcomes, recovery effectiveness, response metrics, and lessons learned to strengthen organizational resilience.