Effective IR training covers investigative techniques and processes required to effectively detect, contain and remediate a cyber security incident. It describes common forms of endpoint, network and file-based forensic evidence collection. It explains the phases of a targeted attack life cycle and principles of analysis, along with short- and long-term strategies to improve enterprise response and security resilience.