{ "id": "e999ee53-2459-4411-a3f3-a560fbcf4c86", "tags": [ "detection rules", "elk stack", "Incident Response", "ioc analysis", "linux logging", "log sources", "SIEM", "splunk", "threat detection", "windows logging" ], "images": { "main_image_url": "https://courses.assets.ine.com/courses/images/e999ee53-2459-4411-a3f3-a560fbcf4c86/original.jpg", "small_image_url": "https://courses.assets.ine.com/fit-in/800x800/courses/images/e999ee53-2459-4411-a3f3-a560fbcf4c86/original.jpg", "medium_image_url": "https://courses.assets.ine.com/fit-in/1200x1200/courses/images/e999ee53-2459-4411-a3f3-a560fbcf4c86/original.jpg", "main_image_resize_url_template": "https://courses.assets.ine.com/fit-in/{w}x{h}/courses/images/e999ee53-2459-4411-a3f3-a560fbcf4c86/original.jpg" }, "direct_passes": [ "1f92d62a-53a9-4b4d-b650-46a019b7fdfd", "07bf99fe-f021-41a7-a951-0f4f577d7451", "55cec27a-6fce-4d9c-a33d-d7cc31a2ac41", "ec55679f-b724-4b92-a689-6880993bef89", "8d4ab297-9c35-443c-8ef3-efdd98cd43bc", "65637ca1-1b2b-487c-b876-3b484901bcd8" ], "has_trackable_content": true, "files": [], "files_uuids": [ "99af5753-b71d-467a-b50a-d2e70db0c342" ], "related_learning_paths": [ "ba1ab597-6d57-4038-9d4e-a7af271aa18b" ], "summary": { "total_groups": 6, "total_videos": 22, "total_labs": 2, "total_iframes": 0, "total_quizzes": 19, "total_exercises": 0 }, "learning_paths": [ { "id": "ba1ab597-6d57-4038-9d4e-a7af271aa18b", "name": "Incident Handling & Response Professional (New!)", "slug": "incident-handling-response-professional-new" } ], "created": "2025-03-11T14:12:25.036288Z", "modified": "2025-06-30T21:12:34.340671Z", "status": "published", "status_changed": "2025-06-30T21:12:02.988163Z", "name": "Incident Response: Detection", "slug": "incident-response-detection", "difficulty": "professional", "content": [ { "name": "Welcome", "content": [ { "name": "Overview", "content": [ { "uuid": "0c0d77c3-bd10-4741-892c-8870d00c1cbe", "content_type": "video" } ], "content_type": "topic" } ], "content_type": "group" }, { "name": "Introduction", "content": [ { "name": "Introduction to Detection & Analysis", "content": [ { "uuid": "5b8f9749-4ad2-4931-b851-337b49e492e5", "content_type": "video" }, { "uuid": "f973710b-9005-4333-a754-9311195828ef", "content_type": "quiz" }, { "uuid": "ee2cb9de-ac87-4633-bbc8-54b213a65a22", "content_type": "video" }, { "uuid": "07f2413e-1fa0-4dc9-a17b-94d9c0745613", "content_type": "quiz" } ], "content_type": "topic" } ], "content_type": "group" }, { "name": "Detection Foundations", "content": [ { "name": "Log Sources & Telemetry", "content": [ { "uuid": "bcb4702a-ee05-4924-9881-3a41ff88ba56", "content_type": "video" }, { "uuid": "27389381-35b8-4d7f-98b4-51358a407660", "content_type": "quiz" }, { "uuid": "a6acd5ab-9976-4c7e-83b7-4b7f492249c1", "content_type": "video" }, { "uuid": "7d3d6808-a36a-48d9-959d-e9a406d1871c", "content_type": "quiz" }, { "uuid": "3b8733bd-31b8-435f-a09d-c33431d81e36", "content_type": "video" }, { "uuid": "3fc697b6-9251-4071-9dd3-bae04241e8f6", "content_type": "quiz" }, { "uuid": "0d3b5b1d-ec92-4ad5-8962-2f6fd2f17736", "content_type": "video" }, { "uuid": "66bccd6f-f1da-4b8e-9dd9-7a64d92ba4b1", "content_type": "quiz" } ], "content_type": "topic" }, { "name": "Log Collection & Aggregation", "content": [ { "uuid": "82eb940a-202f-4d81-b581-99ac353c0717", "content_type": "video" }, { "uuid": "2bae3ade-73fa-4dda-999e-fd6b99ebe9f1", "content_type": "quiz" }, { "uuid": "6969bd9c-e70c-4235-bec2-cbfecd3c72d0", "content_type": "video" }, { "uuid": "4297f83e-b128-4e09-96ab-93dc63ceacbe", "content_type": "quiz" }, { "uuid": "cbdf4834-b8cb-4735-b5be-c050ad768435", "content_type": "video" }, { "uuid": "75b4c701-26e9-4025-8dea-8f5016f67c59", "content_type": "quiz" }, { "uuid": "a6774e10-45ed-48a1-a419-25c434fe10b7", "content_type": "lab" } ], "content_type": "topic" } ], "content_type": "group" }, { "name": "SIEM Operations", "content": [ { "name": "SIEM Fundamentals", "content": [ { "uuid": "77040994-e46a-4e30-85ca-a66f2b8a52be", "content_type": "video" }, { "uuid": "d8b611b7-a23b-4e5b-be9c-118bae59091b", "content_type": "quiz" }, { "uuid": "931ef5a4-7c65-463c-9d2d-10d433e83320", "content_type": "video" }, { "uuid": "29e7e3f3-ce24-4c25-98b6-e800143621c7", "content_type": "quiz" }, { "uuid": "318c3552-f16a-482a-bc26-417bbf91954f", "content_type": "video" }, { "uuid": "1e52466b-6344-4ef2-a959-e13bb7a21f64", "content_type": "video" }, { "uuid": "94b36a94-1b82-4088-886a-08c71f017921", "content_type": "quiz" }, { "uuid": "38913201-1474-4ca5-a2f5-0d7e0f548a9e", "content_type": "lab" }, { "uuid": "dc473595-25bc-4fea-9be9-d71395296bed", "content_type": "video" }, { "uuid": "bf00019f-6190-44f4-9406-2888915bd11a", "content_type": "quiz" } ], "content_type": "topic" }, { "name": "Detection Engineering", "content": [ { "uuid": "58594224-4cca-4eaf-9171-cc5aabb05d25", "content_type": "video" }, { "uuid": "ecb41893-5178-4ac2-ab8e-34ea3ac09366", "content_type": "quiz" }, { "uuid": "5f3d6c9a-d960-4c29-9bf1-fd9e5bf7d38d", "content_type": "video" }, { "uuid": "f596e000-b3b5-4a26-80f5-45282da5a93e", "content_type": "quiz" } ], "content_type": "topic" } ], "content_type": "group" }, { "name": "Triage & Escalation", "content": [ { "name": "The Incident Triage Process", "content": [ { "uuid": "98fe45dc-4f82-4b44-b4ac-a63bef9ae86c", "content_type": "video" }, { "uuid": "17f1c4f1-a0d2-44ab-96a8-5a6c41bcd5bc", "content_type": "quiz" }, { "uuid": "020612d8-b818-48e9-905b-be5f019bb3b7", "content_type": "video" }, { "uuid": "0814e996-8ac5-4f3f-9cb2-b360de5884f9", "content_type": "quiz" }, { "uuid": "8d631259-ab53-4606-a7c3-258bca14a56a", "content_type": "video" }, { "uuid": "fcea77e2-d51b-4b04-9e09-96ed3e799fcd", "content_type": "quiz" }, { "uuid": "7d58dca3-b172-4024-a71a-9ebfe8dd7574", "content_type": "video" }, { "uuid": "5e748c2b-5be1-40e6-82a4-d54d44fa6361", "content_type": "quiz" } ], "content_type": "topic" } ], "content_type": "group" }, { "name": "Goodbye", "content": [ { "name": "Summary", "content": [ { "uuid": "782295e0-5497-4526-8dad-4206dfbb48f9", "content_type": "video" } ], "content_type": "topic" } ], "content_type": "group" } ], "url": "https://my.ine.com/course/network-host-analysis/e999ee53-2459-4411-a3f3-a560fbcf4c86", "trailer_jwplayer_id": "924mt26V", "description": "This course explores the role of detection in identifying and managing security threats through events, alerts, and incidents. You'll dive into endpoint, network, and application log sources, learn how to work with Windows and Linux logging, and understand centralized log collection using tools like Splunk and the ELK Stack. By developing detection rules, analyzing indicators of compromise, and managing alert noise, you\u2019ll build the skills needed to identify real threats effectively. This course lays the technical foundation for the next step: Incident Response Analysis.", "short_description": "", "published_date": "2025-06-30T21:12:02.976298Z", "auto_publish_at": null, "duration_in_seconds": 46610, "is_featured": false, "has_sample_content": false, "has_cc": false, "under_construction": false, "cpe_credits": 17, "has_skill_check_labs": false, "company": { "id": "a491bc32-c056-4946-9169-cc053387bada", "name": "INE" }, "vendor": { "id": "178dafe4-8894-4f35-a203-4dfbf47db6eb", "name": "INE" }, "main_learning_area": "3e1aa06f-2e9f-4789-b50d-aa027ad8dcfa", "bootcamp_origin": null, "categories": [ { "id": "044b1d14-dd3b-46e2-8d37-c66626f2ee32", "name": "Incident Handling & Response" } ], "learning_areas": [ { "id": "3e1aa06f-2e9f-4789-b50d-aa027ad8dcfa", "name": "Cyber Security" } ], "instructors": [ { "id": "3b828fe9-356d-47fd-a7bf-02045b20c1d4", "name": "Alexis Ahmed", "bio": "Alexis Ahmed is an experienced penetration tester and security researcher with over 7 years of experience in the cybersecurity industry. He started off his career as a Linux system administrator and soon discovered a passion and aptitude for security and transitioned into a junior penetration tester role. In 2017, he founded HackerSploit, a cybersecurity consultancy company that specializes in penetration testing and security training, where he currently works as a senior penetration tester and trainer. Alexis has multiple cybersecurity certifications, ranging from the CEH, eJPT, and Sec+ to OSCP, and is a certified ISO 27001 associate. He is also an experienced DevSecOps engineer and helps companies secure their container and cloud infrastructure.\r\n\r\nIn the Infosec & cybersecurity community, Alexis is better known as HackerSploit. That is his platform as a content creator on YouTube. His channel has a massive audience of over 600,000 subscribers where he delivers training content related to penetration testing, red teaming, Linux security, and malware analysis.", "certifications": [], "profile_img_url": "https://assets.ine.com/instructors/ine-alexis-ahmed-final.jpg", "twitter_username": "" } ], "skills": [], "technologies": [], "user_status": { "progress": 0.0, "has_trackable_content": true, "total_videos": 22, "finished_videos": 0, "total_quizzes": 19, "finished_quizzes": 0, "total_labs": 0, "finished_labs": 0, "total_links": 0, "finished_links": 0, "total_exercises": 0, "finished_exercises": 0, "total_iframes": 0, "finished_iframes": 0, "is_active": false, "prompt_review_50_perc_completion": false, "prompt_review_90_perc_completion": false, "last_activity_date": null, "started_date": null, "finished_date": null }, "access": { "related_passes": [ { "id": "1f92d62a-53a9-4b4d-b650-46a019b7fdfd", "name": "B2B Enterprise" }, { "id": "55cec27a-6fce-4d9c-a33d-d7cc31a2ac41", "name": "B2B Enterprise + Lab experience" }, { "id": "07bf99fe-f021-41a7-a951-0f4f577d7451", "name": "B2B Professional" }, { "id": "ec55679f-b724-4b92-a689-6880993bef89", "name": "B2C Individual" }, { "id": "8d4ab297-9c35-443c-8ef3-efdd98cd43bc", "name": "B2C Premium" }, { "id": "65637ca1-1b2b-487c-b876-3b484901bcd8", "name": "Cyber Security" } ], "user_passes": [ { "id": "07bf99fe-f021-41a7-a951-0f4f577d7451", "name": "B2B Professional" } ], "has_access": true, "available_content_types": [ "exercise", "iframe", "lab:azure", "lab:els", "lab:github", "lab:pta", "quiz", "video" ] }, "user_rating": null }