⚓IR-200

The certification associated with this course is the OffSec Incident Responder (OSIR).

Hack Responsibly.

Always ensure you have explicit permission to access any computer system before using any of the techniques contained in these documents. You accept full responsibility for your actions by applying any knowledge gained here.

These will be the notes I felt were worth writing down as things I was not completely familiar with and/or were new to me at the time of working through this course.

Some sections may be empty due to nothing being worth noting IMO.

Table of Contents

IR-200 - Modules
Module 1: Incident Response Overview
Module 2: Fundamentals of Incident Response
Module 3: Phases of Incident Response
Module 4: Incident Response Communication Plans
Module 5: Common Attack Techniques
Module 6: Incident Detection and Identification
Module 7: Initial Impact Assessment
Module 8: Digital Forensics for Incident Responders
Module 9: Incident Response Case Management
Module 10: Active Incident Containment
Module 11: Incident Eradication and Recovery
Module 12: Post-Mortem Reporting
Module 13: Incident Response Challenge Labs

Documentation Templates

Templates provided via the OSIR Exam Guide

Submission Checklist:

• Your exam report is in PDF format

• You have used the following format for the PDF file name "OSIR-OS-XXXXX-Exam-Report.pdf", where "OS-XXXXX" is your OSID

• Your PDF has been archived into a .7z file (Please DO NOT archive it with a password)

• You have used the following format for the .7z file name "OSIR-OS-XXXXX-Exam-Report.7z", where "OS-XXXXX" is your OSID

• You have made sure that your archive is not more than 100MB

3MB

OSIR-Exam-Report.docx

Open

Microsoft Word format

1MB

OSIR-Exam-Report.odt

Open

OpenOffice/LibreOffice format