Inside the CSIRT: A Collaborative Live Incident Response Workshop
Each team gets its own isolated instance running TheHive, Cortex, MISP, and Mattermost. Learn the tools, find your team, then unlock your personal logins with the code your instructor gives you.
In every instance
Pre-Workshop Survey
Anonymous participant information survey and consent
Tool guide
How to log in and get productive with each of the four platforms.
Read the guide →Find your team
Your instance address and one-click links into all four tools.
Open teams →Unlock credentials
Enter your access code to reveal your username and password.
Unlock →Incident brief
The ransomware scenario
Incident brief
The phishing scenario
How this works
1. Learn the tools. The tool guide is a quick cheat sheet for each platform
2. Reach your instance. On the teams page, open your team and access links into each tool.
3. Get your logins. Paste the private access code from your instructor on the unlock page.