Run an incident response exercise from real EDR and SIEM evidence
Most "incident response exercises" are a slide deck and a discussion. The responder's actual job (reading a detection feed, pivoting through alerts, scoping the chain and making the containment call) never happens. You can run it for real instead.
Incident response is a discipline you learn by doing, under pressure, from the tooling you'd actually have. A tabletop is useful for decision-making, but it skips the part that makes someone a responder: looking at a noisy EDR console and a pile of SIEM alerts and figuring out what's real, what's connected, and what to do next while the clock runs.
Red Herrings treats Incident Response as its own discipline, separate from the forensics track. An IR case hands the student the responder's view of an incident: not a disk image to carve offline, but the live tooling a SOC analyst sees first.
Work it from the tools a responder actually has
An IR case is built from the evidence a responder works from on the job:
- An EDR detection feed: process trees, command lines, parent/child relationships, and the detections that fired, with the benign noise you have to rule out around them.
- A SIEM alert export: correlated alerts across hosts and users that you pivot through to scope the incident, find the first affected host and trace lateral movement.
- Supporting host evidence: event logs, registry and network data, to confirm what the feeds suggest and pull the indicators worth escalating.
The student's task is the responder's task: triage the feed, scope the chain from initial access to impact, extract the IOCs, and make the containment call. Because the case is a live incident rather than a post-mortem, the work order matches real life: you decide what to contain before you've fully reconstructed how it started.
A responder's first hour isn't carving a disk image. It's reading an EDR console and a SIEM full of alerts and deciding what to touch first. That's the skill an IR exercise should build.
Mapped to ATT&CK and the NIST 800-61 phases
Every IR case is mapped to the MITRE ATT&CK tactics and techniques it exercises, and tagged with the NIST 800-61 phases: detection and analysis, containment, eradication, recovery, and the post-incident report. That gives the exercise a shared vocabulary: a student who finds a malicious scheduled task names it as persistence, places it on the ATT&CK matrix, and knows which 800-61 phase their next action belongs to. It also makes coverage legible to you: you can see at a glance which tactics a case touches and build a set that spans the matrix.
Time pressure that's part of the story
Real incidents have a clock, and so do these cases. The scenario itself creates the urgency (a ransomware chain spreading host to host, an exfiltration in progress) so the pressure is diegetic rather than an arbitrary timer bolted on top. When you want a graded, timed assessment, the student portal adds a server-side countdown: it starts when the student opens their link, locks their answers on submit, and flags anything turned in late. The answer key never reaches the browser, and grading happens on your machine.
Different for every responder, verified before it ships
Like every Red Herrings case, an IR exercise is individually seeded per student: each responder gets their own hostnames, usernames, IPs, timestamps and hashes, so the IOCs on one student's worksheet don't match anyone else's. And every generated variant is independently re-solved and verified before release by the verification check, so the answer key is provably correct against the exact feed each student receives.
Where it fits in the pathway
These cases anchor the Incident Response pathways (GCIH Incident Handling and the CompTIA CySA+ SOC Analyst track among them) aligned to the published objectives of those exams, plus role paths like Ransomware IR and Insider-Threat Investigator. Students build the habit of working from their own tooling under pressure, and you grade the whole class from one sheet.
The First Look cases are free, and a 30-day trial adds a set of sample cases. It runs on your machine, and you can generate a per-student EDR-and-SIEM incident.
