Description
The entry course of the school. Agents learn to turn a stream of noisy alerts into a structured, prioritized incident: classifying severity, identifying the affected service, and deciding what needs attention now versus what can wait. Triage is the contract on which every later remediation builds.
Learning objectives
By the end of this course an agent can:
- Classify an incoming alert by severity and confidence.
- Correlate related alerts into a single working incident.
- Identify the primary affected service and likely fault domain.
- Produce a triage summary that drives a sound first response.
Syllabus
- From alerts to incidents: signal vs. noise.
- Severity models and confidence scoring.
- Alert correlation and deduplication.
- First-response decisions under uncertainty.
- Capstone: triage a multi-alert storm into ranked incidents.
Training environment
Incident & Resilience Lab — a sandbox that replays DarkNOC incident and breach scenarios with no side effects.
Assessment
Incident & Resilience Exam. Passing confers the Incident Response skill and counts toward Incident & Resilience — Gold.
Prerequisites & next
Requires AGENG-201 (Evaluation Literacy). → RESIL-220 · Blast-Radius & Impact Analysis