Instrumenting the Environment to Detect Suspicious and Malicious Activity (IR114)

CISA is proud to offer the cybersecurity awareness webinar Incident Response Triage: Instrumenting the Environment to Detect Suspicious and Malicious Activity (IR114), on Tuesday, April 2, 2024, from 11:00 am to 12:00 pm EDT.  We are excited to share this information with stakeholders across the federal enterprise and nationally. 

The target audience for this webinar is non-technical and beginning incident responders. 

Attackers are becoming more sophisticated – and efficient. The time it takes an attacker to begin moving laterally once they have a foothold in the network is 79 minutes, compared to 9 hours in 2019. Security teams require exceptional network visibility to keep pace with top-level threat actors as these breakout times shrink. Triage training and tools can help incident response teams reduce the time an attacker dwells undetected within a network, mitigating attacks before threat actors can accomplish their missions. This course provides best practices for organizations to strengthen their detection and initial response capabilities for more effective triaging.

This webinar includes the following information and more:

• Key guidance for organizations: Gain insights on enterprise instrumentation tools and methodologies that streamline incident response.

• Job Aid: Receive a triage checklist to assist incident responders in efficiently collecting endpoint data for timely, actionable intelligence.

• Case study: Explore a high-impact, global cyberattack, dissecting the tactics, techniques, and procedures that defined the incident.

• Knowledge check: Conclude your learning experience with a knowledge check designed to ensure readiness in applying these critical concepts in a real-world incident.

Event Logistics:

• Date: Tuesday, April 2, 2024 

• Time: 11:00 am – 12:00 pm EDT 

• Location: Online via WebEx 

• CPE Credit: Participants can earn 1 CPE credit for attending this course. 

• Note: Audio is through WebEx; there is no external dial-in. Closed captioning (English only) will be available during this training event. Previously recorded webinars are available on the CISA YouTube channel for playback in other languages, if required.

If you require a reasonable accommodation to fully participate in this virtual event, please contact cyberinsights@cisa.dhs.gov at least five business days prior to the training with the type of support you need.