Endpoint alerts and safe incident escalation

Skills you'll practise

• Group related alerts on one device into a single story.
• Choose safe first containment steps (isolate, don't wipe).
• Preserve evidence and record a timeline.
• Escalate with the facts the security team needs.

Course outline

1. 1.Endpoint alerts and safe incident escalationVideo · 4 min
2. 2.Read the story, then containLesson · 8 min
3. 3.Triage: true positive, false positive or benignLesson · 8 min
4. 4.Containment options and their trade-offsLesson · 8 min
5. 5.Endpoint alerts and safe incident escalation: knowledge checkKnowledge check · 18 questions
6. 6.High-severity alerts on a finance laptopScenario
7. 7.Final exam7 questions · passing it completes the course, so people who already know the material can test out

Sources it draws on

The lessons and questions are written from these references, so learners can go back to the original.

• NIST SP 800-61 Rev. 2 Computer Security Incident Handling Guide
• CISA: Ransomware Guide (joint)