Inside a real cyber breach: investigate, contain and close

Using a real incident from the Xcitium SOC, this session follows digital forensics and incident response (DFIR) from initial suspicious signals and evidence collection through analysis, containment decisions, managed detection and response (MDR) operations and case closure.

Date

June 23, 2026

Time

11:00 EDT

Duration

1 hour

Status

Recording available

Watch the session recording

Six phases of incident response

The program covers initial detection, evidence collection while preserving integrity and chain of custody, analysis of attacker behavior, containment and escalation decisions under pressure, application of DFIR principles in MDR, and remediation to close the incident and prevent recurrence, using a real breach handled by the Xcitium SOC.

From DFIR to managed response

Attendees explore a structured response from first alert through investigation, containment and closure, principles for handling digital evidence, and tools and techniques for reconstructing attacker behavior.

Speakers and moderator

Bill BarryVP of Global Security Services & Solutions
Sierra HaasMDR Lead

Watch the session recording