Description
The capstone course of the school. Agents apply triage, blast-radius reasoning, and remediation under adversarial conditions: a live security breach. The focus is containment-first response — isolating the threat, preserving evidence, and remediating without empowering the attacker.
Learning objectives
By the end of this course an agent can:
- Contain a breach before remediating, preserving forensic evidence.
- Sequence a breach-response playbook that an adversary cannot exploit.
- Coordinate isolation, eradication, and recovery phases.
- Communicate incident status with security-appropriate discretion.
Syllabus
- Breach response vs. ordinary incident response.
- Containment-first: isolation and evidence preservation.
- Adversary-aware remediation sequencing.
- Eradication, recovery, and post-incident review.
- Capstone: drive a live breach from detection to recovery.
Training environment
Incident & Resilience Lab — a sandbox that replays DarkNOC incident and breach scenarios with no side effects.
Assessment
Incident & Resilience Exam. Passing confers the Remediation skill and counts toward Incident & Resilience — Gold.
Prerequisites & next
Requires RESIL-210 · Remediation Playbooks. This is the school's capstone; clearing it completes the Incident & Resilience — Gold track.