Running a cloud incident at Northlink across three AWS accounts, two Azure subscriptions and one GCP project: a leaked access key live on public GitHub for eleven hours, calls from a new country followed by IAM changes, and a three-hop role chain reaching finance data. The incident passes down the eight-layer cloud IR stack — readiness, detect, scope, preserve, contain, eradicate, recover and learn — and each old flaw is replaced by its fix: isolate and snapshot instead of terminating, revoke live sessions as well as the key, and hunt persistence and fix the leaking bucket before closing.

CY-MID-050Mid Level · Cloud Incident Response

Cloud Incident Response — The Cloud IR Stack

A hands-on mid-level course that responds to incidents in AWS, Azure, and GCP. Work the cloud IR stack - eight layers: Readiness, Detect, Scope, Preserve, Contain, Eradicate, Recover, and Learn - using cloud logs, snapshots, and APIs to investigate and contain without breaking the business. Strictly defensive. Four hands-on activities in every lesson.

15 hours8 chapters32 lessons225 activities8 labs

What you'll learn

Prepare cloud logging, access, and runbooks before an incident.
Detect and scope incidents from CloudTrail, Azure, and GCP logs.
Preserve evidence with snapshots and contain via cloud APIs.
Eradicate, recover, and improve cloud posture after the incident.

Price:৳8,000