Event details
Mandiant Academy Training Event
- Course: Incident Response for Management
- Date: Monday, March 24, 2025 – Wednesday, March 26, 2025
- Time: 8:00 AM–2:30 PM, daily
- Time Zone: (UTC-08:00) Pacific Time (US & Canada)
- Cost: $3,000 USD or 3 EOD units
- Delivery Method: Instructor-led, virtual delivery
- Location: Google Meet
At a glance
This course is designed to teach non-technical management staff how to respond to an incident and how to work with investigators during an incident response event. This course includes a series of hands-on exercises that highlight all phases of the investigation lifecycle.
Participants will learn how to respond to a detected incident, describe the incident to stakeholders, differentiate among different evidence acquisition methods, understand how investigators conduct an investigation, evaluate different remediation methods, and review an investigative report.
By the end of this course, participants will be able to actively provide non-technical support to an investigation by understanding the full scope of incident response processes and procedures.
Course goals
After completing this course, learners should be able to:
- Determine how to respond to an incident immediately after initial notification
- Summarize an incident for relaying to a trusted partner
- Choose an investigation plan most suited to investigate your organization’s incident
- Choose a remediation plan best suited to investigate your organization’s incident
- Evaluate an investigative report for quality
- Summarize the events described in an incident report
Course agenda
Incident Discovery
- Incident Discovery
- Notifying Stakeholders
- Initial Documentation
- Triggered Processes and Procedures
Incident Description
- Describing the Incident
- Evidence Collection for Trusted Partners
Evidence Acquisition
- Evidence Collection Capabilities
- Trusted Partner Evidence Collection
- Evidence Preservation
Analysis
- Planning for Analysis
- Analysis Gaps
- Analysis Methodologies
Remediation
- Remediation Plan Concepts
- Remediation Plan Customizations
- Remediation Timing
Reporting Results
Who this course helps
The audience for this course includes organization management that are commonly asked to work with or as part of an investigative team, such as management involved in information security and technology.
What to bring
Students should bring their own laptop computer with the latest browser of choice (Firefox or Google Chrome prefered) and a stable internet connection of at least 10 Mbps.
Course materials
Students will receive electronic copies of all relevant course materials.
