Incident Response

Plan it, automate it, contain it, prove the root cause — 14%

• Designing the Response — The plan you write before the pager goes off: the incident response lifecycle, runbooks versus playbooks, severity and escalation, OpsCenter and Incident Manager, pre-provisioned responder roles and a forensics account, and Shield Advanced protections configured ahead of the DDoS you expect. (3 lessons, 55 min)
• Automated Response and Forensics — Machinery that responds faster than a human can log in: finding to EventBridge to target, choosing between Lambda, Systems Manager Automation and Step Functions, Application Recovery Controller for recovery orchestration, the Automated Forensics Orchestrator for Amazon EC2, and Fault Injection Service game days that prove the whole thing works. (3 lessons, 55 min)
• Responding to Security Events — The live response, in the order that preserves your options: validate the finding and scope it, capture evidence before you change anything, climb the containment ladder (including revoking sessions that a detached policy would not touch), eradicate persistence, recover without reinfection, and prove root cause with Amazon Detective. (5 lessons, 70 min)