Practical Incident Response: Windows & Microsoft 365

19 Modules of Production-Grade IR

This course reconstructs the full lifecycle of a sophisticated intrusion. We deconstruct the lateral movement of an attacker from the moment a phishing payload bypasses Exchange Online to the final exfiltration of data through SharePoint. You will learn to synchronize evidence from Entra ID credential theft with Windows endpoint forensic artifacts to build a defensible timeline of the breach.

Integrated Evidence Recovery. Discover how to find, interpret, and document evidence at every stage — from initial access to domain-wide persistence.

The Practitioner's Toolset. Master the deployment and execution of production-ready IR tools, focusing on high-utility solutions that can be implemented immediately.

Reality-Based Scenarios. Bridge the gap between "Cloud Security" and "Endpoint Defense" by analyzing how attackers leverage hybrid vulnerabilities to achieve their objectives.

Who this course is for

SOC analysts moving into incident response. You triage alerts and escalate incidents. This course teaches you to investigate them — to go from "suspicious sign-in detected" to "here is exactly what the attacker accessed, how they got in, and what we need to do about it."

IR practitioners expanding into M365. You know Windows forensics. You can parse Prefetch files and build NTFS timelines. But when the attack starts in Exchange Online and the credential theft happens in Entra ID, you need the cloud investigation skills to complete the picture.

Cloud security analysts learning endpoint forensics. You investigate in KQL and Purview. But when the attacker drops a payload on the endpoint and the cloud logs stop telling the story, you need the Windows artifact analysis to follow the trail.

Security engineers building IR capability. Your organization needs a formal IR process. This course provides the methodology, the tool deployment, the investigation procedures, and the reporting templates — from readiness through response through post-incident improvement.

Unified investigation, not isolated skills

Other courses teach Windows forensics or M365 investigation. This course teaches the investigation — from the phishing email in Exchange through the credential theft in Entra ID through the malware execution on the endpoint through the lateral movement across the domain through the data exfiltration in SharePoint. One attack. One investigation. Every evidence source.

Free tools at professional depth

KAPE, Eric Zimmerman Tools, Velociraptor, Volatility 3, KQL, PowerShell. These are the same tools used by SANS instructors, Big 4 IR consultancies, and government CERT teams. The difference between a free tool and a $50,000 forensic suite is the interface, not the capability. This course teaches the capability.

Investigation reasoning, not tool operation

Every finding includes three statements: what it proves, what it does not prove, and what investigation step it leads to next. "Prefetch shows calc.exe executed at 14:32 — this proves execution occurred but does not prove who executed it. Next step: correlate with Event ID 4624 to identify the active session at that time." This is how experienced responders think. This course teaches that thinking.

Text-based, reference-grade

At 2 AM during a real incident, you need to search "AmCache parser output columns" and find the answer in 10 seconds. You don't need to scrub through a 45-minute video to find the 30-second segment where the instructor mentioned it. Every module is searchable, scannable, and designed as a reference you return to under pressure — not a video you watch once and forget.

Production artifacts in every module

Every module produces something you deploy: an IR report template, an evidence custody form, a containment checklist, a detection rule, a KQL query, a PowerShell collection script. The course doesn't just teach you how to investigate — it gives you the documents you'll use when you do.

Built from real investigations

The investigation scenarios in Phase 4 are based on real incident response engagements — sanitized, restructured for teaching, but grounded in attacker behavior observed in production environments. The tool commands work. The artifacts are realistic. The decision points reflect actual investigation pressure.

Recommended path

Complete Phase 1 (foundations) first — the toolkit setup and evidence acquisition methodology are prerequisites for everything that follows. Phase 2 (Windows) and Phase 3 (M365) can be studied in either order depending on your background, but completing both before Phase 4 is strongly recommended because the investigation scenarios draw from techniques across both environments.

Phase 4 is the capstone. Each scenario module reconstructs a complete attack using the skills from Phases 2 and 3. Phase 5 (reporting and readiness) can be studied alongside or after Phase 4.

How it connects to other courses

M365 Security Operations teaches you to operate the Defender stack — detect, triage, and respond. This course teaches you to investigate after detection — to reconstruct what happened, determine the full scope, and produce the evidence.

SOC Operations provides detection rules and playbooks. This course closes the loop — when a detection fires and the playbook runs, the IR course teaches the investigation that follows.

Mastering KQL builds the query language foundation. This course applies KQL to incident investigation — the queries you write when the alert is real and the clock is running.

Practical GRC modules G9 (breach notification), G13 (board reporting), and G14 (regulatory notification) connect directly to IR17 — the reporting module that turns investigation findings into the governance deliverables.