GIAC - Enterprise Incident Response (GEIR)

Curriculum

• Module 1: Cloud Response and Analysis
• Demonstrate a familiarity with popular cloud attack scenarios and display an understanding of common manual and automated techniques for identifying, extracting, and analyzing artifacts when responding to a cloud-based incident.
• Module 2: Container DFIR Fundamentals
• Demonstrate a basic understanding of container technology, a familiarity with common attack techniques performed against containers, and a foundational digital forensic and incident response strategy when responding to a container-based incident.
• Module 3: Detecting Modern Attacks
• Demonstrate an understanding of how to apply threat intelligence and information gathered through proactive threat hunting to support the detection and response to modern attacks.
• Module 4: Enterprise Incident Response Management
• Demonstrate an understanding of how to manage and conduct effective incident response within an enterprise environment and will display a familiarity with techniques used to address common operational challenges while performing large scale investigations.
• Module 5: Enterprise Visibility and Incident Scoping
• Demonstrate a familiarity with common data source types in an enterprise environment and will display an understanding of strategies to aggregate telemetry from a large volume of disparate resources in order to scope an incident.
• Module 6: Foundational Cloud Concepts
• Demonstrate an understanding of fundamental cloud concepts and a familiarity with the most common cloud services that enterprises use to support business operations.
• Module 7: Linux DFIR Fundamentals
• Demonstrate an understanding of digital forensics and incident response fundamentals for a Linux system, including foundational knowledge of the file system, locations and format of important logs, and key configuration files.
• Module 8: Linux Essentials
• Demonstrate a basic understanding of a Linux operating system, common challenges when securing and monitoring Linux systems, and popular platform-specific attack techniques across an attack lifecycle.
• Module 9: macOS DFIR Fundamentals
• Demonstrate an understanding of digital forensics and incident response fundamentals for a macOS system, including foundational knowledge of the file system, locations and format of important logs, and key configuration files.
• Module 10: macOS Essentials
• Demonstrate a basic understanding of a macOS operating system, common challenges when securing and monitoring macOS systems, and popular platform-specific attack techniques across an attack lifecycle.
• Module 11: Rapid Response Triage at Scale
• Demonstrate an understanding of how to efficiently collect, process, and analyze incident response triage data across a large volume of endpoints.