Event details
Mandiant Academy Training Event
- Course: Incident Response in Google Cloud
- Date: Monday, March 10, 2025 – Thursday, March 13, 2025
- Time: 8:00 AM–2:30 PM, daily
- Time Zone: (UTC-08:00) Pacific Time (US & Canada)
- Cost: $4,000 USD or 4 EOD units
- Delivery Method: Instructor-led, virtual delivery
- Location: Google Meet
At a glance
This intensive course is designed to teach investigators techniques needed to respond to an investigation of a Google Cloud organization. The fast-paced course is built upon a series of hands-on labs that highlight how to investigate and respond to a targeted attack in a Google Cloud organization. Examples of skills taught include how to identify evidence of a threat actor using Google Cloud native tools, use open source utilities to enhance the investigators' capabilities, and provide effective containment and eradication of a threat actor.
The course includes detailed discussions about methods of evidence collection and their limitations as well as how threat actors move around in the Google Cloud organization. This information is then reinforced through a dynamic hands-on lab environment powered by Google Cloud Skills Boost. The labs will have recent evidence of compromise and provide each student with their own lab environment.
Three eLearning modules are recommended prerequisites for this course, but not required. They can be found on Google Cloud Skills Boost and are part of the Security Engineer Learning Path.
- Security Best Practices in Google Cloud (11 hours)
- Logging and Monitoring in Google Cloud (8 hours)
- Managing Security in Google Cloud (8.5 hours)
Course goals
In this lab, you learn how to perform the following tasks:
- Define the NIST incident response process
- Use the MITRE ATT&CK during an investigation
- Identify the core components of a Google Cloud organization
- Use Log Explorer and Log Analytics to perform cloud investigations
- Deploy and update a compute instance for local analysis
- Identify logs for:
- Service account abuse
- Service account key creation
- Storage bucket access
- GKE container logs
- Use open source tools like Plaso, Timesketch, dfTimewolf, and many others
Course outline
Introduction to the Incident Response Process
- NIST 800-61r2
- MITRE ATT&CK
The TL;DR; on Google Cloud
- What is Google Cloud
- Google Cloud Architecture
- Shared Responsibility Model
- Key Components
- Identity and Access Management
- Google Cloud Compute
- Google Cloud Networking
- Google Cloud Storage
Preparation for Incident Response in Google Cloud
- Security Command Center
- Logging
- Chronicle
- Incident Response Prep
- Lab: Deploying a Forensics VM
Detection and Analysis
- Cloud Logs
- Analysis
Containment, Eradication, and Recovery
- Key Containment Steps
- Evidence Preservation
- Eradication and Remediation
Post Incident Analysis
- Root Cause & Impact
- Lessons Learned and Communication
- Post Incident Lab Activity
Who this course helps
This class is designed for intermediate-level students who have a responsibility to respond to or alert on security incidents in Google Cloud. Students should have a basic understanding of Windows and Linux operating systems along with a basic understanding of Google Cloud or cloud concepts.
What to bring
Participants will need a laptop and stable internet connection.
Course materials
Students will receive a lab book and access to all required class materials and tools.
