This is the README documentation for the Incident Response Lab, produced and maintained by CodePath.org.
Want to jump into the lab? Navigate to the Part 0 Instructions to get started!
The Incident Response Lab is designed to teach you the full lifecycle of handling a security incident — triage, document, investigate, close, debrief — inside Catalyst, a real open-source IR platform running in your browser. You'll work two fully guided cases (a phishing-delivered malware incident and a brute-force incident), researching indicators of compromise with external tools and recording a defensible verdict for each. Then you'll run an independent malware investigation on your own, and audit a first responder's report for the gaps a careful analyst catches. Reporting is a core cybersecurity skill, and this lab treats it like one.
- Triage and document a security incident in a real IR platform — capturing the timeline, evidence, and analyst notes so the case tells a coherent story
- Research indicators of compromise (IOCs) with external tools and record a defensible verdict for each one instead of a gut call
- Close a case cleanly and write a Lessons Learned / post-incident review a teammate could act on
- Audit a first responder's report for gaps — spotting missing evidence, unverified claims, and loose ends before signing off
- Setup: Run the lab environment with Docker
- Learn: The Phishing Incident
- Apply: The Brute-Force Incident
- Challenge: CSIRT — PathCode Malware Investigation
In Parts 1–3 you'll work primarily in your web browser:
- Catalyst - an open-source incident-response platform, served from the container at
http://localhost:8088(login details are in Part 0) - Three incident reports, bundled into the lab so it's fully self-contained
- External IOC lookup tools - VirusTotal and AbuseIPDB - for researching indicators
Incident data persists across container restarts in a named Docker volume, so you can pick a case back up where you left off.