GCIH practice labs, one incident at a time
The GCIH objectives expect a handler who can run an incident through its phases: triage a detection and decide what it means, trace the initial access, follow the move from a beachhead to the next host, catch an operator's setup before the payload, contain a live outbreak, and write up the lessons learned, with each behavior named by its ATT&CK technique.
This pathway follows the incident-handling kill chain from the responder's own tooling. It opens with an EDR detection and a SIEM queue, then works a phish, an internet-facing server, a remote session and a server caught before impact as full cases, and closes the hard tier with a live outbreak and a timed ransomware drill. The capstone runs a hospital-wide incident through every NIST phase.
10 cases · ~13 h 8 min of lab time · Easy to Expert · a different variant for everyone · verified answer keys
The pathway, in order
10 cases, about 13 h 8 min of lab time. Each step opens the case in the library, where you can read the brief, the evidence list and sample questions. Everyone gets a different variant of the same case, graded against a key that was verified in the evidence.
-
01
First Look: Reading an EDR Alert
Triage your first EDR detection: process tree, technique, severity.
EASY~33 minUp to 15 questions -
02
First Look: Reading a SIEM Alert
Read a SIEM alert queue and find the one that matters.
EASY~33 minUp to 15 questions -
03
First Look: Phishing Triage
Work a reported phish: header, link and payload.
EASY~33 minUp to 15 questions -
04
One Click (Phishing to Foothold)
Follow the phish through to the payload running on the host.
MEDIUM~1 hUp to 20 questions -
05
Trapdoor (Web Shell on a Small Business Server)
Initial access and foothold on an internet-facing server.
MEDIUM~1 h 45 minUp to 20 questions -
06
Hands on Keyboard (Lateral Move to the File Server)
Trace a remote session back to its source.
MEDIUM~1 h 16 minUp to 20 questions -
07
Dry Run (Ransomware Precursor: Caught Mid-Setup)
Read logs, registry and memory on a server caught before impact.
HARD~2 h 14 minUp to 20 questions -
08
First Call (Ransomware Before Coffee)
A live ransomware outbreak worked from the EDR feed.
HARD~1 h 15 minUp to 20 questions -
09
Fire Drill (Drill: Ransomware, 45 Minutes)
Timed drill: triage a live ransomware outbreak in 45 minutes.
HARD~45 minUp to 20 questions -
10
Nightfall (Operation Nightfall)
Capstone: run a hospital-wide incident through every NIST phase.
EXPERT~3 h 14 minUp to 35 questions
What this pathway covers
Who it's for
- Candidates preparing for the GCIH who want to work real EDR and SIEM exports, not multiple-choice scenarios.
- Instructors running an incident response course who need the 8-week IR course pack with labs that grade across sections.
- Security teams drilling their on-call rotation who want a 45-minute ransomware exercise with a verified key.
What you get with every case
- A different variant per student. Same case, same rubric, different names, hashes, timestamps and answers, so students can talk about method without sharing answers.
- Evidence in the real on-disk format. Registry hives, EVTX, PCAP, SQLite, JSON audit logs and memory images open in the tools the exam expects.
- A verified answer key. Every answer is re-derived from the planted evidence before the lab ships, so grading disputes end at the artifact.
- One-click grading and LMS export. Canvas, Blackboard, Moodle, D2L and LTI 1.3 grade passback, or a CSV. See the student portal.
- Runs on the instructor's machine. Windows installer plus macOS and Linux, fully offline after activation. Nothing to host and no student data leaves the room. Course packs on courses.
Run this pathway with your own roster
Download the app, generate a three-student version of the first case in under five minutes, and grade it. First Look cases run free with no key, and the 30-day trial needs no card. Or open the sample lab first and work a student package in your own tools.
Related pathways
SOC Analyst & Triage (CySA+)
The SOC analyst's daily queue: reading and triaging detections from EDR and SIEM, correlating entities, and escalating a real incident.
12 cases · ~13 h 12 min · CompTIA CySA+
Cloud & Enterprise IR (GCFR)
Investigating identity and cloud audit logs: sign-ins, token abuse, and data pulled from the cloud.
9 cases · ~13 h 17 min · GIAC GCFR
All learning pathways
Every certification-prep and role pathway across Digital Forensics and Incident Response, side by side.
Browse the overview →
ATT&CK® and MITRE ATT&CK® are registered trademarks of The MITRE Corporation. Red Herrings maps to published ATT&CK tactics and techniques for teaching; it isn't affiliated with or endorsed by MITRE. GIAC, GCFE, GASF, GNFA, GCIH, GCFR and GCFA are trademarks of GIAC. CompTIA and CySA+ are trademarks of CompTIA, Inc. SANS is a trademark of the SANS Institute. Red Herrings aligns its pathways to the published objectives of these programs for teaching; it's independent of, and not affiliated with or endorsed by, any certification body.