Library

If you are new, read these before anything with a vendor logo on it.

• Computer Security Incident Handling Guide (SP 800-61)public domain

  NIST · The reference every IR process is eventually a variation of. Dry, and worth it.

• Guide to Integrating Forensic Techniques into Incident Response (SP 800-86)public domain

  NIST · Where forensics meets IR, including the order of volatility. Still the clearest treatment.

• The ATT&CK framework itselffree to read

  MITRE · Read technique pages, not the matrix. See the primer here first if the grid put you off.

Primary sources. Everything else is commentary on these.

• Known Exploited Vulnerabilities cataloguepublic domain

  CISA · What is being exploited right now, per the US government. Feeds the wire on this site.

• Cybersecurity advisoriespublic domain

  CISA · Joint advisories often carry the fullest public technical detail on a campaign.

• National Vulnerability Databasepublic domain

  NIST · The canonical CVE record. Slower than vendor disclosure and more complete.

All open source. The labs here assume some of these.

• Sysmonfree to read

  Microsoft Sysinternals · Turns Windows from opaque to observable. The single highest-value thing to deploy.

• Atomic Red Teamopen source

  Red Canary · Small tests mapped to ATT&CK, each with a cleanup command. The labs here use it.

• Sigmaopen source

  SigmaHQ · Detection rules in a format that converts to your SIEM, plus a large public ruleset.

• Velociraptoropen source

  Rapid7 · Endpoint visibility and hunting at scale, free, and genuinely used in real engagements.

Real telemetry to investigate, published for training.

• Malware traffic analysisfree to read

  Brad Duncan · Years of PCAPs with exercises and answers. The standard corpus for network forensics.

• Security Datasetsopen source

  Open Threat Research · Pre-recorded attack telemetry as JSON, mapped to techniques. No lab build required.

• EVTX attack samplesopen source

  sbousseaden · Windows event logs, one set per technique. Excellent for practising log analysis.

Published incident analysis of the standard worth aiming at.

• The DFIR Reportfree to read

  The DFIR Report · Full intrusion write-ups with timelines and detections. The benchmark for this format.

• Krebs on Securityfree to read

  Brian Krebs · Investigative journalism rather than technical analysis, and better than most of both.