Table of Contents

Threat Landscape and Cybersecurity Incidents

Concepts of Digital Forensics and Incident Response

Basics of the Incident Response and Triage Procedures

Applying First Response Procedures

Identifying and Profiling Threat Actors

Understanding the Cyber Kill Chain and the MITRE ATT&CK Framework

Using Cyber Threat Intelligence in Incident Response

Building an Incident Response Capability

Creating Incident Response Plans and Playbooks

Implementing an Incident Management System

Integrating SOAR Capabilities into Incident Response

Working with Analytics and Detection Engineering in Incident Response

Creating and Deploying Detection Rules

Hunting and Investigating Security Incidents

About the Author

Roberto Martinez, works as a Senior Security Researcher at Kaspersky's Global Research and Analysis Team (GReAT) since April 2012, doing research to detect and identify new Security Threats, responding to Security Incidents, and presenting at security events worldwide.
He also collaborates as an Expert Associate Professor at Tec de Monterrey University and is currently an active member of the HTCIA (High Technology Crime Investigation Association).
Roberto has more than 15 years of experience in cybersecurity, working in different fields as Offensive Security, Incident Response, Digital Forensic Investigation, Threat Hunting, Threat Intelligence, and Malware Analysis.
Before this, he worked as a consultant and instructor specializing in security for governments, financial institutions, and private corporations in Latin America.