Cloud IR

Equip yourself with essential skills to improve response capabilities and forensics within the cloud.

Course Overview

Over the last decade, the rise of cloud services has significantly changed the role and requirements of Incident Response (IR) teams. The shift from on-prem to cloud environments– oftentimes using multiple cloud providers simultaneously–adds complexity to managing data volume and accessibility in tandem with mitigating evolving cyber threats. Today’s incident responders require specialized security skills that apply foundational IR concepts and techniques within respective cloud domains.

CyberVista’s Cloud IR course is a four-hour, 100% online program designed to introduce and familiarize security professionals with the requisite cloud incident response functions and capabilities. This course will review Incident Response as a function within the cloud environment. Practitioners will work their way through both Amazon Web Services (AWS) and Microsoft Azure environments while learning about further cloud concepts and technologies. Lastly, this course will cover the ELK stack and the importance it plays within IR functions in the cloud.

  • 4 hrs of On-Demand Video Lessons
  • 15 Question Diagnostic Exam
  • 15 Question Final Exam
  • 20 Knowledge Check Questions
  • Hands-On Lab Exercises
  • Live Online Session (Optional)
  • Tool and Shortcut Handouts
  • Performance Tracker


It is recommended that participants have at minimum a Security+ certification or have completed CyberVista’s Cloud SOC course.

Relevant Training

Following the Cloud IR course, practitioners can take Critical Knowledge: Incident Response for further training.

Course Outline

Domain 1: Incident Response in the Cloud

This domain covers an overview of the incident response process and the roles and responsibilities of the IR team in a cloud environment.

  • Incident response overview
  • Roles and responsibilities

Domain 2: Forensics in AWS

This domain covers the processes and techniques used when conducting forensics on the AWS platform. Additionally, we cover how evidence is collected and the impact on security presented by containers and databases.

  • AWS forensics VMs
  • Evidence collection
  • Containers
  • Databases

Domain 3: Forensics in Azure

This domain covers the processes and techniques used when conducting forensics in the Azure platform. We cover imaging techniques and Azure tools that help facilitate IR investigations.

  • Cloud imaging
  • Azure IR investigations
  • Azure tools

Domain 4: ELK Stack in IR

This domain covers an overview of the ELK Stack, the projects that comprise it, and example demos of the ELK Stack in use.

  • ELK Stack overview
  • ELK Stack demos