Cyber Threat Intelligence, Incident Response and Digital Forensics Course
The Cyber Threat Intelligence, Incident Response and Digital Forensics Course is a 5-day professional training programme delivered in-person or online in ICT-Information & Communication Technology, ending with a TrustGate Corporate Skills certificate of completion.
The Cyber Threat Intelligence, Incident Response and Digital Forensics Course is designed to equip cybersecurity professionals, ICT specialists, incident handlers, investigators and risk practitioners with the knowledge and practical skills required to identify cyber threats,...
Course Overview
Learning Objectives
- Explain the principles and sources of cyber threat intelligence.
- Identify common attack patterns, indicators of compromise and suspicious activity.
- Apply structured procedures for incident detection, classification and triage.
- Develop incident response playbooks for common cybersecurity scenarios.
- Coordinate containment, eradication and recovery activities.
- Apply digital evidence preservation and chain-of-custody principles.
- Explain basic forensic examination of files, system logs and relevant digital artefacts.
- Document findings accurately and prepare evidence-based incident reports.
- Coordinate technical, management, legal and external stakeholder responses.
- Develop incident response improvement plans based on lessons learned.
Course Content
- Meaning, purpose and lifecycle of cyber threat intelligence.
- Strategic, operational, tactical and technical intelligence.
- Threat actors, motivations, capabilities and target selection.
- Intelligence requirements and prioritisation of organisational threats.
- Open-source intelligence and reputable threat information sources.
- Indicators of compromise and indicators of attack.
- Threat intelligence feeds, sharing platforms and information quality.
- Analysing relevance, confidence, timeliness and potential business impact.
- Phishing, credential theft, ransomware and malicious software.
- Network, endpoint, identity and cloud security indicators.
- Introduction to attack frameworks such as MITRE ATT&CK.
- Recognizing suspicious events and distinguishing alerts from confirmed incidents.
- Incident response policies, procedures and escalation arrangements.
- Defining incident roles, responsibilities and communication channels.
- Incident classification, severity levels and response priorities.
- Developing playbooks for data breaches, malware and account compromise.
- Collecting and reviewing relevant logs and security alerts.
- Establishing incident timelines and identifying affected assets.
- Assessing scope, impact, persistence and potential data exposure.
- Documenting initial findings and preserving relevant evidence.
- Selecting proportionate containment measures.
- Isolating affected systems and protecting unaffected environments.
- Removing malicious artefacts and addressing the underlying cause.
- Validating system recovery and monitoring for recurrence
- Principles, scope and limitations of digital forensic examination.
- Evidence identification, collection and preservation.
- Chain of custody, evidence integrity and documentation.
- Legal, ethical and organisational requirements for digital investigations.
- Introduction to file systems, metadata and digital artefacts.
- Examination of system logs, event records and relevant timestamps.
- Building timelines and correlating evidence from different sources.
- Preparing forensic notes, findings and structured investigation reports.
- Communicating technical findings to management and other stakeholders.
- Coordination with legal advisers, regulators and law enforcement where appropriate.
- Conducting root-cause analysis and assessing control failures.
- Lessons learned, corrective actions and incident response improvement.
- Analysing a simulated security incident using supplied evidence.
- Developing a threat assessment and incident timeline.
- Preparing a response plan with containment and recovery priorities.
- Presenting an investigation report and recommendations for prevention.
Who Should Attend?
- Cybersecurity analysts and security operations centre personnel.
- ICT security officers and systems administrators.
- Incident response and digital investigation teams.
- Digital forensic practitioners and authorised investigators.
- Internal auditors, risk managers and compliance officers.
- Law enforcement personnel working in digital investigations.
- ICT managers responsible for security monitoring and incident coordination.
Training Methodology
- Facilitator-led presentations and discussions.
- Cyber threat intelligence case studies.
- Cyber incident detection and triage simulations.
- Incident response playbook development exercises.
- Cyberattack containment and recovery simulations.
- Digital evidence preservation and forensic exercises.
- Incident reporting and documentation workshops.
- Post-incident reviews and improvement planning.
Is this course for you?
Level: Advanced
Problems this course solves
- Inability to identify cyber threats and suspicious system activity promptly.
- Delayed or poorly coordinated responses to cybersecurity incidents.
- Improper handling of digital evidence and inadequate incident documentation.
- Recurring cyber incidents caused by weak recovery procedures and limited post-incident learning.
What's Included
Certification
Certificate in Cyber Threat Intelligence, Incident Response and Digital Forensics
Issued by: TRUSTGATE CORPORATE SKILLS
Frequently Asked Questions
How long is the Cyber Threat Intelligence, Incident Response and Digital Forensics Course training?
The Cyber Threat Intelligence, Incident Response and Digital Forensics Course runs for 5 Days. Each day combines expert-led teaching with practical, hands-on exercises so participants can apply what they learn immediately.
Is the Cyber Threat Intelligence, Incident Response and Digital Forensics Course delivered online or in-person?
This course is delivered in person (scheduled venues include Nairobi, Kigali, Arusha, Mombasa), live online, or in-house at your organisation.
How much does the Cyber Threat Intelligence, Incident Response and Digital Forensics Course cost?
The fee is US$600 per person online and US$1,400 per person in person. In-person fees depend on the participant's country; the pricing card on this page shows the fee for yours.
When is the next Cyber Threat Intelligence, Incident Response and Digital Forensics Course training?
A session is running now, from 2 November 2026 to 6 November 2026 in Nairobi, Kenya / Kigali, Rwanda. The next one runs from 9 November 2026 to 13 November 2026 in Arusha, Tanzania. You can also request a custom date or an in-house session for your team.
Do I get a certificate after completing the Cyber Threat Intelligence, Incident Response and Digital Forensics Course?
Yes. Participants who complete the Cyber Threat Intelligence, Incident Response and Digital Forensics Course receive a certificate of completion from TRUSTGATE CORPORATE SKILLS.
What will I learn in the Cyber Threat Intelligence, Incident Response and Digital Forensics Course?
Key learning outcomes include: Explain the principles and sources of cyber threat intelligence; Identify common attack patterns, indicators of compromise and suspicious activity; Apply structured procedures for incident detection, classification and triage; Develop incident response playbooks for common cybersecurity scenarios; Coordinate containment, eradication and recovery activities.
