Certified Incident Handler – ECIH

Module 1: Introduction to Incident Handling and Response

• Incident handling and response fundamentals
• Cybersecurity incident types
• Threat actors and attack vectors
• Security incidents and breaches
• Incident response objectives
• Incident response challenges
• Incident response frameworks
• Cyber Kill Chain
• MITRE ATT&CK
• Incident response roles and responsibilities
• Incident handling policies

Module 2: Incident Handling and Response Process

• Incident response lifecycle
• Preparation and planning
• Incident detection
• Incident validation
• Incident triage
• Incident prioritization
• Incident escalation
• Incident notification
• Containment
• Eradication
• Recovery
• Post-incident activities
• Incident documentation
• Incident response metrics

Module 3: Forensic Readiness and First Response

• Forensic readiness
• First responder responsibilities
• Evidence identification
• Evidence collection
• Evidence preservation
• Chain of custody
• Volatile data
• Digital evidence handling
• Initial incident investigation
• Forensic analysis fundamentals
• Legal and policy considerations
• First response procedures

Module 4: Handling and Responding to Malware Incidents

• Malware incident fundamentals
• Malware detection
• Malware incident preparation
• Malware containment
• Malware eradication
• Malware analysis
• Malware evidence collection
• Malware recovery
• Malware incident case studies
• Malware response best practices

Module 5: Handling and Responding to Email Security Incidents

• Email security incidents
• Phishing attacks
• Malicious attachments
• Malicious links
• Business email compromise
• Email evidence collection
• Email analysis
• Email incident containment
• Email incident eradication
• Recovery procedures
• Email security incident case studies

Module 6: Handling and Responding to Network Security Incidents

• Network security incidents
• Network-based attacks
• Network traffic analysis
• Network evidence collection
• Intrusion detection
• Network incident validation
• Network containment
• Network eradication
• Network recovery
• Network incident case studies

Module 7: Handling and Responding to Web Application Security Incidents

• Web application incidents
• Web-based attack vectors
• Application security incidents
• Web server investigation
• Log analysis
• Evidence collection
• Incident containment
• Eradication
• Recovery
• Web application incident case studies

Module 8: Handling and Responding to Cloud Security Incidents

• Cloud security incidents
• Cloud attack vectors
• Cloud incident preparation
• Cloud monitoring
• Cloud evidence collection
• Cloud incident investigation
• Cloud containment
• Cloud eradication
• Cloud recovery
• Cloud incident case studies

Module 9: Handling and Responding to Insider Threats

• Insider threat fundamentals
• Malicious insiders
• Negligent insiders
• Compromised accounts
• Insider threat indicators
• User activity analysis
• Insider threat investigation
• Containment strategies
• Evidence preservation
• Insider threat case studies

Module 10: Handling and Responding to Endpoint Security Incidents

• Endpoint security incidents
• Endpoint investigation
• Windows incidents
• Linux incidents
• Mobile-based security incidents
• IoT-based security incidents
• OT-based security incidents
• Endpoint evidence collection
• Endpoint containment
• Endpoint eradication
• Endpoint recovery
• Endpoint incident case studies

Module 11: Incident Response Playbooks and Runbooks

• Incident response playbooks
• Incident response runbooks
• Incident handling checklists
• Response templates
• Escalation procedures
• Notification procedures
• Containment procedures
• Eradication procedures
• Recovery procedures
• Incident documentation
• Standardizing incident response

Module 12: Practical Incident Response Workshop

• Analyze a simulated security incident
• Validate and classify an incident
• Perform incident triage
• Prioritize the incident
• Collect and preserve evidence
• Develop containment strategies
• Perform eradication activities
• Coordinate system recovery
• Document incident activities
• Conduct post-incident analysis
• Prepare an incident report
• Develop preventive recommendations

• Incident Response Professionals
• Cyber Defense Incident Responders
• SOC Analysts
• Security Operations Professionals
• Cybersecurity Analysts
• Security Engineers
• Network Security Professionals
• Digital Forensics Professionals
• Threat Hunters
• Malware Analysts
• Security Administrators
• IT Security Professionals
• System Administrators
• Cybersecurity Consultants
• Professionals responsible for detecting, investigating, containing, and recovering from security incidents

• Understand the complete incident handling and response lifecycle.
• Develop incident response preparation and planning strategies.
• Identify, validate, classify, and prioritize security incidents.
• Perform effective incident triage and escalation.
• Develop incident notification and communication procedures.
• Apply containment, eradication, and recovery techniques.
• Establish forensic readiness and handle digital evidence appropriately.
• Understand evidence collection and preservation.
• Respond to malware security incidents.
• Investigate and respond to email and phishing incidents.
• Handle network security incidents.
• Respond to web application security incidents.
• Handle cloud security incidents.
• Identify and respond to insider threats.
• Investigate endpoint, mobile, IoT, and OT security incidents.
• Use incident response playbooks, runbooks, checklists, and templates.
• Apply incident response frameworks such as MITRE ATT&CK and Cyber Kill Chain.
• Conduct post-incident activities and identify preventive measures.
• Develop practical incident response capabilities through scenario-based labs.

• Basic understanding of cybersecurity concepts.
• Familiarity with computer networks and operating systems.
• Basic knowledge of information security.
• Understanding of common cyber threats and attack vectors.
• Familiarity with security operations is beneficial.
• Experience with incident response, SOC operations, or security administration can be advantageous.
• Basic knowledge of digital forensics is helpful but not mandatory.

Certification: EC-Council Certified Incident Handler (ECIH)
Exam Title: EC-Council Certified Incident Handler
Exam Format: Multiple Choice
Number of Questions: 100
Exam Duration: 3 Hours