Full Incident Response Simulation Capstone Lab

Objective. Students will execute a complete, timed incident response from detection through post-incident report for a multi-stage simulated breach, demonstrating competency across all lifecycle phases.

This capstone lab brings together every skill you have built across the Incident Response course. You will work through a realistic, multi-stage simulated breach from the first alert all the way to presenting a formal report to senior leadership. Think of it as a dress rehearsal for a real-world incident.

Why a Timed, End-to-End Simulation Matters

Real incidents do not pause while you look something up. Decision-making under time pressure, with incomplete information and competing priorities, is the actual job. Employers hiring for SOC analyst, incident responder, and security operations roles expect candidates to demonstrate that they can move through the full incident response lifecycle without losing evidence, making hasty containment errors, or delivering a vague post-incident report. This lab is scored against the same standards those employers care about.

Phase 1 — Detection and Declaration (0–30 Minutes)

Your lab session begins the moment the instructor injects a simulated incident. Your first task is to triage the alert that surfaces in the SIEM. Open the alert, pivot to the raw logs, and ask three questions immediately: What system generated this alert? What behavior triggered it? Is this a true positive or a false positive?

Use correlation rules, log timestamps, and source/destination IP data to identify affected hosts. Check for lateral movement indicators such as unusual authentication events, unexpected remote desktop sessions, or abnormal outbound connections. Document every action in your running case log from the first minute—timestamps matter legally and operationally.

Declare the incident by filling out the incident declaration section of your case log template: severity level, affected assets, initial indicators of compromise (IOCs), and the time of declaration. Undeclaring later is easier than never declaring at all.

Phase 2 — Containment, Evidence Collection, Eradication, and Recovery (30–90 Minutes)

Containment comes before eradication—always. Isolate affected systems at the network level (remove from the network segment or apply a host-based firewall block) before you touch the malware. Premature eradication destroys volatile evidence and earns a low score in the evidence integrity domain.

Forensic evidence collection must follow a strict order: volatile data first, then persistent data.

1. Capture a memory dump of the affected VM using the forensic tool provided. Record the SHA-256 hash immediately after capture.

2. Create a disk image. Verify the image with a matching hash before you proceed. Never work on original evidence; use the image.

3. Log every tool invoked, every file touched, and every hash value in your case log. Chain of custody starts here.

Once evidence is secured, move to eradication: remove malicious files, scheduled tasks, registry persistence keys, or any other artifacts identified during analysis. Scan the system with the sandbox and endpoint tool to confirm no artifacts remain.

Restore from the clean backup provided in the lab environment. Validate that the restored system is functioning and that the original vulnerability or entry point has been remediated before reconnecting it to the network.

Phase 3 — Post-Incident Report and CISO Briefing

A technically sound response means nothing if you cannot communicate it clearly. Your written report must include:

Timeline: Chronological list of events from first attacker action to full recovery, with timestamps.
Executive Summary: Two to three paragraphs written for a non-technical audience. Focus on business impact, not tool names.
Root Cause Analysis: What vulnerability, misconfiguration, or gap allowed the breach? Be specific.
Lessons Learned: At least three actionable recommendations to prevent recurrence.
IOC List: All file hashes, IP addresses, domain names, and registry keys identified during the investigation.

You will present this report to the instructor acting as CISO and answer at least three probing questions about your decisions. Prepare to justify why you contained before eradicating, why you chose specific isolation methods, and how you validated evidence integrity.

Safety and Professionalism Considerations

Although this is a lab environment, treat all data as if it were real. Never attempt to access systems, networks, or data outside the designated lab scope—unauthorized access, even in a training context, is a serious professional and legal boundary. Handle forensic images and case logs with the same discipline you would apply to genuine evidence; sloppy documentation habits built in training become dangerous habits in the field. Maintain your case log continuously—gaps in the log are gaps in the chain of custody.

Scoring Reminder

You need a minimum 75% overall score with no single domain falling below 60%. The five scored domains are: detection accuracy, evidence integrity, containment without evidence loss, eradication completeness, and report quality. Losing points in evidence integrity because you eradicated before collecting a memory dump is the most common failure—do not rush past the collection step.

Key terms8

Incident DeclarationThe formal act of acknowledging that a confirmed security incident has occurred, including recording severity, affected assets, and the time of declaration in the case log.

Chain of CustodyA documented record proving that evidence was collected, handled, and stored in a controlled manner that preserves its integrity and admissibility.

Volatile DataData that exists only while a system is powered on—such as running processes, network connections, and RAM contents—and is lost when the system is shut down or rebooted.

Memory DumpA forensic capture of the full contents of a system's RAM at a specific point in time, used to recover encryption keys, running malware, and other volatile artifacts.

Indicator of Compromise (IOC)A piece of forensic evidence—such as a file hash, IP address, domain name, or registry key—that indicates a system has likely been breached or is communicating with a threat actor.

Root Cause Analysis (RCA)A structured investigation into the underlying vulnerability, misconfiguration, or process failure that allowed an incident to occur, forming the basis for remediation recommendations.

ContainmentActions taken to limit the spread or impact of an incident—such as network isolation of an affected host—without destroying forensic evidence.

EradicationThe phase of incident response in which malicious code, persistence mechanisms, and attacker-created artifacts are removed from affected systems after evidence has been collected.

In class: Respond to an instructor-injected simulated incident in the lab environment: receive an alert, triage logs in the SIEM, identify affected systems, and declare the incident within the first 30 minutes. · Perform containment (network isolation), collect forensic evidence (memory dump, disk image with hashes), eradicate malware artifacts, and restore from backup—all within a 90-minute lab window while maintaining a running case log. · Complete and present a full incident report (timeline, executive summary, root cause analysis, lessons learned, and IOC list) to the instructor acting as the CISO; respond to at least three probing questions about decisions made during the response.
Materials: Full lab environment (SIEM, VMs, forensic tools, sandbox), incident scenario packet, case log template, incident report template, timing clock
Check: Holistic rubric scored by instructor across five domains: detection accuracy, evidence integrity, containment without evidence loss, eradication completeness, and report quality; minimum 75% overall with no domain scored below 60%.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.