Incident Response & Digital Forensics

This programme equips IT professionals and security teams with the structured skills to detect, contain, investigate, and recover from cybersecurity incidents. Covering the full incident response lifecycle and an introduction to digital forensics, participants will leave with practical procedures they can implement immediately in their organisation.

The programme covers the full response lifecycle and then goes further than most awareness training into the evidence side. Participants work through preparation, detection and analysis, containment, eradication and recovery, and post-incident review, using a worked scenario rather than a description. The forensic half covers evidence acquisition, chain of custody, volatile data, disk and memory basics, and log analysis, with attention to the actions that destroy evidence before anyone has decided whether it will be needed. Malaysian notification obligations under the amended PDPA and the Cyber Security Act 2024 are covered as part of the response timeline rather than as an afterthought.

HRD Corp Training Provider Malaysia HRD Corp SBL-Khas Claimable

Modules

01

Incident Response Fundamentals

The incident response lifecycle: preparation, detection, containment, eradication, recovery, and post-incident review. Building an incident response plan from scratch.

02

Threat Detection and Analysis

Identifying indicators of compromise (IoC), analysing logs and alerts, using SIEM tools, and distinguishing true positives from false positives.

03

Containment and Eradication

Short-term and long-term containment strategies. Removing malware, closing attack vectors, and restoring systems safely without destroying forensic evidence.

04

Introduction to Digital Forensics

Forensic principles, chain of custody, evidence preservation, disk imaging, memory forensics basics, and working with forensic tools including Autopsy and Volatility.

05

Ransomware and Malware Incident Handling

Step-by-step response to ransomware attacks including isolation, communication, recovery options, and post-incident hardening. Real Malaysian and regional case studies.

06

Reporting and Post-Incident Review

Writing an incident report, communicating with management and regulators, lessons learned documentation, and updating defences based on findings.

Key Outcomes

  • Build and execute a structured incident response plan
  • Detect and analyse security incidents using log data and SIEM tools
  • Apply containment and eradication procedures without compromising evidence
  • Conduct a basic digital forensics investigation following chain of custody principles
  • Respond to ransomware and malware incidents using a structured playbook
  • Produce a professional incident report for management and regulatory audiences

Final Activity

Incident Response Tabletop Exercise. Participants work through a simulated ransomware attack scenario in teams. Each team must detect, contain, investigate, and report the incident following proper procedures, with a full debrief at the end.

Training Mode   Physical / Online / Hybrid / e-learning

HRD Corp   SBL-Khas Claimable

Minimum enrolment   3 participants

Duration   2 Days

Level   Intermediate (basic IT security knowledge required)

Certificate included   Yes

Frequently Asked Questions

Incident Response & Digital Forensics runs for 2 days. It is delivered as an in-house closed group session, so the schedule can be adjusted to fit your team's working hours.

Yes. Delivery options are physical, online, hybrid, e-learning. In-house sessions run at your premises anywhere in Malaysia, online sessions run live over video conference, and hybrid combines both for teams split across sites.

Yes. Participants receive an Orbix Tech Certificate of Completion after full attendance. Each certificate carries a certificate number that can be checked at orbixtech.my/certificate-verify.

Level: Intermediate (basic IT security knowledge required). The session is built around worked examples and group exercises rather than theory, so participants apply the material to their own organisation during the session.

Yes. This course is also available through the Orbix LMS and e-learning platform, where participants work through the material on their own schedule and device rather than attending one fixed session. A knowledge assessment and certificate on completion work the same way as the instructor-led session.

Minimum 2 participants for an in-house or live online session. With only 1 participant, we deliver it as a one-to-one online session instead.

Yes. Many clients pair this course with our one-day team building and high-performing teams programme on the same engagement, so the budget and the day cover both.

Yes. Participants can follow up by email with questions that come up while applying what they learned, and we will point you to the right template, checklist or framework reference even after the session is over.