Conducted a User Training Session
My first Incident Response training is over. It was a cool ride with a lot of cool people around. What did we do?


  • Read a nice story about a company that does EVERYTHING wrong
  • Go through SANS Incident Response Steps
  • Tell them about the KillChain
  • Let them create their own Playbooks

Thanks @Hamza for your help ;-)
The best thing that can happen is, when they start to talk to themselves and discuss internally.