Explore Incident Response

Incident response has a paperwork problem: plenty of organizations have a documented playbook and no practiced one. Nugget doesn't hand you a checklist and call it done — it puts you in the middle of a live incident and makes you decide, under the same ambiguity a SOC analyst gets, whether that anomalous PowerShell call is an admin doing their job or an attacker living off the land.

The sessions here track how real incidents actually run: containment, legal notification prep, and eradication happening at once, not in tidy sequence. You'll work through why the GDPR clock starts at 'became aware,' not 'investigation complete,' and why an IOC tells you something already happened while a behavioral pattern might catch it happening again. Nugget sketches the process tree, the log timeline, or the notification-deadline math on the whiteboard, then asks you to find where the story breaks.

This isn't a substitute for tabletop exercises or your incident response coursework — it's where you rehearse the reasoning between them, so the gap between your documented plan and your practiced one gets smaller.