Hacky Certified Incident Responder
HCIR · Level 2Introduction
Handle an incident from first alert to final report. Three levels, each self-paced, each with its own exam and certificate.
Buy now- Author: Gaurav Sharma
- Level: Level 2 · Practitioner
- Study time: 32 hours
- Certification: Hacky Certified Incident Responder
Curriculum
6 modules · 16 hours of guided learning · self-paced, with hands-on labs
Job-oriented, scenario-led progression in hacky certified incident responder. Exercises are conducted only in authorized training environments. The level builds on previous levels while adding distinct techniques, deeper evidence requirements and more complex capstones.
Prerequisites: Basic IT literacy and willingness to use Linux/Windows command lines.
Tool stack: Velociraptor, KAPE, Volatility 3, Autopsy, Wireshark, Timesketch, Wazuh, Splunk
4h guided instruction + 9h guided/independent practical labs + 3h reading, review and assessment. These are total learning hours, not 16 hours of live lectures.
Module 01Incident response lifecycle and roles3 h
Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.
Practical. Complete a guided lab with baseline and expected evidence.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 02Preparation, playbooks and severity classification3 h
Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.
Practical. Complete a guided lab with baseline and expected evidence.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 03Evidence integrity and chain of custody3 h
Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.
Practical. Complete a guided lab with baseline and expected evidence.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 04Initial triage and containment decisions3 h
Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.
Practical. Complete a guided lab with baseline and expected evidence.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 05Windows artifact collection2 h
Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.
Practical. Complete a guided lab with baseline and expected evidence.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 06Linux artifact collection2 h
Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.
Practical. Complete a guided lab with baseline and expected evidence.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Guided scenario: demonstrate correct methodology, collect evidence and submit a short structured report.
20% knowledge checks, 60% hands-on practical, 20% evidence-based reporting Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints.
Final exam
A 2-hour online exam with a 70% pass mark. Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints. Attempts are free until you pass. The exam opens 7 days after purchase.
Curriculum
9 modules · 32 hours of guided learning · self-paced, with hands-on labs
Job-oriented, scenario-led progression in hacky certified incident responder. Exercises are conducted only in authorized training environments. The level builds on previous levels while adding distinct techniques, deeper evidence requirements and more complex capstones.
Prerequisites: Completion of Level 1 or demonstrably equivalent practical skills.
Tool stack: Velociraptor, KAPE, Volatility 3, Autopsy, Wireshark, Timesketch, Wazuh, Splunk
8h guided instruction + 18h guided/independent practical labs + 6h reading, review and assessment. These are total learning hours, not 32 hours of live lectures.
Module 01Initial triage and containment decisions4 h
Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.
Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 02Windows artifact collection4 h
Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.
Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 03Linux artifact collection4 h
Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.
Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 04Network forensics and PCAP analysis4 h
Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.
Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 05Memory analysis and volatile evidence4 h
Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.
Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 06Malware triage and behavior analysis3 h
Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.
Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 07Identity compromise and credential reset3 h
Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.
Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 08Ransomware investigation and recovery coordination3 h
Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.
Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 09Cloud incident response fundamentals3 h
Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.
Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Multi-system case: independently correlate artifacts, prioritize findings and propose tested remediation.
20% knowledge checks, 60% hands-on practical, 20% evidence-based reporting Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints.
Final exam
A 24-hour practical exam in a hosted lab, then 24 hours to submit your report. Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints. Attempts are free until you pass. The exam opens 7 days after purchase.
Curriculum
9 modules · 48 hours of guided learning · self-paced, with hands-on labs
Job-oriented, scenario-led progression in hacky certified incident responder. Exercises are conducted only in authorized training environments. The level builds on previous levels while adding distinct techniques, deeper evidence requirements and more complex capstones.
Prerequisites: Completion of Level 2 or equivalent professional experience; comfortable with independent investigations.
Tool stack: Velociraptor, KAPE, Volatility 3, Autopsy, Wireshark, Timesketch, Wazuh, Splunk
12h guided instruction + 26h guided/independent practical labs + 10h reading, review and assessment. These are total learning hours, not 48 hours of live lectures.
Module 01Memory analysis and volatile evidence6 h
Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.
Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 02Malware triage and behavior analysis6 h
Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.
Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 03Identity compromise and credential reset6 h
Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.
Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 04Ransomware investigation and recovery coordination5 h
Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.
Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 05Cloud incident response fundamentals5 h
Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.
Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 06Timeline reconstruction and scoping5 h
Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.
Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 07Containment, eradication and validation5 h
Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.
Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 08Legal, communications and lessons learned5 h
Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.
Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Module 09End-to-end incident response capstone5 h
Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.
Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.
Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.
Professional engagement: plan, execute and defend a complex scenario with peer review and executive/technical reporting. HACKY SECURITY | CERTIFICATION CURRICULUM | 2026 3
20% knowledge checks, 60% hands-on practical, 20% evidence-based reporting Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints.
Final exam
A 48-hour scenario exam, assessed on your written report. Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints. Attempts are free until you pass. The exam opens 7 days after purchase.
What you receive
Course author
Gaurav Sharma
Founder & CISO, Hacky SecurityOffensive and Defensive Security Expert
Gaurav founded Hacky Security and leads its SOC, curriculum and AI security work. He has trained more than 40,000 professionals and has taught AI security at IIT Madras.
Frequently asked questions
Do I need to buy any software?
When does my course open?
Can I start at Level 2?
More from the blue team track
Hacky Certified Blue Team Analyst
Watch, triage and respond to alerts from a SOC seat.
Hacky Certified Forensic Investigator
Collect and analyse digital evidence properly.
Hacky Certified OSINT Investigator
Find and report information from open sources, ethically.