CPD · Telecommunications and IT
Responding to a security alert
Following the steps from alert to closure.
about this course
What you will be able to do
Following the steps from alert to closure.
- Classify an alert, given 8 samples, with at least 7 correct.
- Contain an incident, given a lab scenario, by following the written steps in order.
- Record actions, given a log template, with time, action and person.
- Review an incident, given a report, naming two lessons.
Task, condition and standard
Task
Classify and triage alerts by severity, follow the playbook steps in order, contain an incident without destroying evidence, and write a one-page report
Condition
Given five sample alerts, a written playbook, a lab scenario and a log template, in a 4-hour lab session on test systems only
Standard
Triage alerts correctly by data affected and spread, isolate the device before recovery, preserve evidence, tell the incident lead at the right step, and write a report with time, impact, actions and next step
These courses teach process, communication and recording. They give no clinical, legal, tax, financial or engineering sign-off. A named subject expert must review every line, and you must check your own professional body's current CPD rules, before you rely on a certificate.
sessions
8 modules
Module 1 What an alert is 20 min
- An alert is a warning that something may be wrong.
- An incident is an alert that has been confirmed.
- Read what evidence the alert gives.
Practise: Practise with a case card or template for "what an alert is": classify an alert, given 8 samples, with at least 7 correct.
Standard to meet. Describe what an alert is and what evidence it gives, given sample alerts, and say how an alert differs from a confirmed incident.
Module 2 Triage by severity 45 min
- Severity depends on the data affected and the spread.
- High, Medium or Low, with a reason.
- Handle High first.
Practise: Practise with a case card or template for "triage by severity": contain an incident, given a lab scenario, by following the written steps in order.
Standard to meet. Triage five sample alerts by severity, based on the data affected and its spread, such as High for a ransomware note, Medium for repeated failed logins and Low for a blocked spam.
Module 3 The playbook steps in order 45 min
- Six steps in order: identify, contain, preserve evidence, escalate, recover, report.
- Contain before recover.
- Tell the incident lead at the escalate step.
Practise: Practise with a case card or template for "the playbook steps in order": record actions, given a log template, with time, action and person.
Standard to meet. Apply the playbook steps in order, given a written playbook, identify, contain, preserve evidence, escalate, recover and report, telling the incident lead at the right step.
Module 4 Containment practice 40 min
- Isolate the device from the network.
- Leave it powered on and do not delete anything.
- Write down the time of each action.
Practise: Practise with a case card or template for "containment practice": review an incident, given a report, naming two lessons.
Standard to meet. Apply containment to an incident in a lab scenario, such as a laptop sending data at night, by isolating the device before recovery and without deleting evidence.
Module 5 One-page report 35 min
- One page: time, what happened, impact, actions, next step.
- Facts only, in plain words.
- Close the incident after recovery and review.
Practise: Practise with a case card or template for "one-page report": review an incident, given a report, naming two lessons. Use a new case this time (round 2).
Standard to meet. Write a one-page report, given a log template, with time, what happened, impact, actions taken and next step, and close the incident after recovery and review.
Module 6 Assessment 35 min
- Run the whole response on a new scenario.
- Check each step against the playbook.
- Finish with a clear report.
Practise: Practise with a case card or template for "assessment": review an incident, given a report, naming two lessons. Use a new case this time (round 2).
Standard to meet. Complete a full response to a new scenario, with alerts triaged, steps followed in order, containment done and a clear report written.
Module 7 Second worked case: a laptop sending data at 3 am 10 min
- Triage first: data leaving the building is High.
- Isolate the laptop and keep it powered on.
- Report the times and the amount of data.
Practise: Practise with a case card or template for "second worked case: a laptop sending data at 3 am": review an incident, given a report, naming two lessons. Use a new case this time (round 2).
Standard to meet. Triage and contain a laptop that sends data to an unknown address, isolate it before recovery, keep the evidence, and report the times and impact.
Module 8 Teach-back and peer check 10 min
- Put the six playbook steps in order from memory.
- Explain why contain comes before recover.
- Check a partner's order against the playbook.
Practise: Practise with a case card or template for "teach-back and peer check": review an incident, given a report, naming two lessons. Use a new case this time (round 2).
Standard to meet. Evaluate a partner's playbook order against the written steps, find any step out of place, and explain why containment comes before recovery.
practice
Worked example and case cards
Worked example triage
High: ransomware note on a server; Medium: failed logins from one address; Low: one blocked spam. Playbook order: identify, contain (isolate the device), preserve evidence, escalate, recover, report.
Case card
five alerts.
Case card 2
A staff laptop sends data to an unknown address at 3 am. Learners triage, contain, and report.
checks
10 check questions with model answers
Contain before what?
Model answer: Before recovery, to stop spread. (Covered in module 3: The playbook steps in order. To pass that module: Apply the playbook steps in order, given a written playbook, identify, contain, preserve evidence, escalate, recover and report, telling the incident lead at the right step.)
Who do you tell?
Model answer: Your incident lead per the playbook. (Covered in module 3: The playbook steps in order. To pass that module: Apply the playbook steps in order, given a written playbook, identify, contain, preserve evidence, escalate, recover and report, telling the incident lead at the right step.)
Should you wipe a device at once?
Model answer: No; preserve evidence first. (Covered in module 4: Containment practice. To pass that module: Apply containment to an incident in a lab scenario, such as a laptop sending data at night, by isolating the device before recovery and without deleting evidence.)
What goes in the report?
Model answer: Time, what happened, impact, actions, next step. (Covered in module 5: One-page report. To pass that module: Write a one-page report, given a log template, with time, what happened, impact, actions taken and next step, and close the incident after recovery and review.)
First step?
Model answer: Confirm and contain; do not delete evidence. (Covered in module 4: Containment practice. To pass that module: Apply containment to an incident in a lab scenario, such as a laptop sending data at night, by isolating the device before recovery and without deleting evidence.)
Who is told?
Model answer: The incident lead per playbook. (Covered in module 3: The playbook steps in order. To pass that module: Apply the playbook steps in order, given a written playbook, identify, contain, preserve evidence, escalate, recover and report, telling the incident lead at the right step.)
Severity based on what?
Model answer: Data affected and spread. (Covered in module 2: Triage by severity. To pass that module: Triage five sample alerts by severity, based on the data affected and its spread, such as High for a ransomware note, Medium for repeated failed logins and Low for a blocked spam.)
What goes in the report?
Model answer: Time, what happened, action, next step. (Covered in module 5: One-page report. To pass that module: Write a one-page report, given a log template, with time, what happened, impact, actions taken and next step, and close the incident after recovery and review.)
When close?
Model answer: After recovery and review. (Covered in module 5: One-page report. To pass that module: Write a one-page report, given a log template, with time, what happened, impact, actions taken and next step, and close the incident after recovery and review.)
Two alerts arrive: 25 failed logins from one address and a ransomware note on a server. Which is handled first and why?
Model answer: The ransomware note: High severity because data is affected and can spread; log the failed logins as Medium and handle them next. (Covered in module 2: Triage by severity. To pass that module: Triage five sample alerts by severity, based on the data affected and its spread, such as High for a ransomware note, Medium for repeated failed logins and Low for a blocked spam.)
glossary
Words used in this course
alert, triage, containment, playbook, evidence.
marking
How the practice and assessment are marked
| Level | Meaning | Marks of 4 |
|---|---|---|
| Secure | Meets the standard in the outcome every time, no prompts | 4 |
| Meeting | Meets the standard with one small slip, corrected when prompted | 3 |
| Developing | Meets part of the standard; needs a re-attempt | 2 |
| Not yet | Standard not met | 1 |
Pass = average 3 or more, and no outcome at 1. You may re-attempt after feedback. The subject expert sets any stricter pass mark.
where next
Ladder L1 to L7, slide by slide with notes
This course sits at L5 Specialist. Credits stack; aligned with, not accredited by, any framework.
jobs this leads to
Where this takes you
- Security operations trainee
- IT support analyst
- Helpdesk technician
- Junior security analyst
- Systems administrator
assessment and certificate
How you are checked
Each outcome is checked against its standard with a checklist or a short test. A digital CPD record shows the hours. Keep evidence in My page. Aligned with common CPD practice; not accredited. Learners check their own body's rules.
ten locations and global
Your place
Use your own body's forms, units and currency. Local professional bodies set the rules for CPD hours; check them first.
India (Bengaluru)
Language: English, Hindi, Kannada. Personal data: Digital Personal Data Protection Act 2023. Credit and levels: National Skills Qualifications Framework (NSQF) and the national credit framework.
Netherlands (Eindhoven area)
Language: Dutch, English. Personal data: EU GDPR (Dutch: AVG), supervised by the Autoriteit Persoonsgegevens. Credit and levels: the Dutch qualification framework (NLQF) linked to the European Qualifications Framework.
UAE (Dubai and Abu Dhabi)
Language: Arabic, English. Personal data: Federal Decree-Law No. 45 of 2021 (personal data protection). Credit and levels: the emirate education and training regulators (for example KHDA in Dubai) and the national qualifications framework.
Brazil (Sao Paulo)
Language: Portuguese (Spanish and English support). Personal data: LGPD (Lei Geral de Protecao de Dados). Credit and levels: the national technical-education catalogue and the national S-system training bodies.
Canada (Toronto)
Language: English, French. Personal data: PIPEDA, with provincial rules where they apply. Credit and levels: the provincial colleges framework and the national credential-recognition guidance.
United States
Language: English, Spanish. Personal data: state privacy laws (for example California), and COPPA for children under 13. Credit and levels: state and community-college credit systems.
Singapore
Language: English, Mandarin, Malay, Tamil. Personal data: Personal Data Protection Act (PDPA). Credit and levels: the Singapore national skills frameworks and the national credit system.
Australia
Language: English. Personal data: the Privacy Act 1988 and the Australian Privacy Principles. Credit and levels: the Australian Qualifications Framework (AQF) levels.
Hong Kong (Eastern Asia)
Language: Chinese (Cantonese, Mandarin), English. Personal data: the Personal Data (Privacy) Ordinance. Credit and levels: the Hong Kong Qualifications Framework.
Georgia and Israel (Western Asia)
Language: Georgian, Hebrew, Arabic, English. Personal data: the personal data law of the country where the learner lives. Credit and levels: the national qualifications framework of that country.
Cayman Islands (Caribbean)
Language: English. Personal data: the Data Protection Act. Credit and levels: the local education and training framework.
Mexico
Language: Spanish, English. Personal data: the federal law on personal data held by private parties. Credit and levels: the national competency certification system and the education ministry levels.
next
Draft
Draft CPD course. It opens only after final checks. No fee is shown.