Containment Operations Playbook
RCCE students will learn incident containment strategies including network isolation, account suspension, system quarantine, and threat neutralization during active security incidents. RCCE students will learn to make rapid containment decisions that balance security with business continuity, implement network-level containment using firewall rules and VLAN isolation, execute host-level containment through endpoint isolation and process termination, contain compromised accounts through credential reset and session revocation, document containment actions for forensic and legal purposes, and coordinate containment activities across distributed teams and environments. This operations-focused course delivers production-ready playbooks, checklists, and standard operating procedures. Building on core knowledge, RCCE students will learn to build repeatable day-to-day operational workflows that ensure consistency and quality. Students receive templates and frameworks they can customize and deploy immediately in their security operations, reducing time to operational effectiveness.
- Security Engineers building defensive controls
- Security Analysts and Blue Team members
- Systems Administrators with security responsibilities
- GRC and Risk Professionals supporting controls
- Professionals implementing Containment Operations Playbook
- Execute hands-on tasks for containment operations
- Execute hands-on tasks for advanced cyber defense mastery
- Build detections and response workflows for privilege escalation
- Explain Executive Overview fundamentals
- Execute hands-on tasks for contain a breach — covering Rapid actions to limit threat spread and damage.
- Execute hands-on tasks for reduce dwell time
- Execute hands-on tasks for protect crown jewels
- Execute hands-on tasks for preserve evidence
- Execute hands-on tasks for containment lifecycle & decision flow
- Execute hands-on tasks for network-level containment — covering Block known C2 IP addresses at.
- Execute hands-on tasks for vlan isolation techniques — covering Block known C2 IP addresses at.
- Execute hands-on tasks for host-level containment
| Module 01 | Containment Operations |
| Module 02 | Advanced Cyber Defense Mastery |
| Module 03 | Incident Response |
| Module 04 | Executive Overview |
| Module 05 | Contain a Breach |
| Module 06 | Reduce Dwell Time |
| Module 07 | Protect Crown Jewels |
| Module 08 | Preserve Evidence |
| Module 09 | Containment Lifecycle & Decision Flow |
| Module 10 | Network-Level Containment |
| Module 11 | VLAN Isolation Techniques |
| Module 12 | Host-Level Containment |
| Module 13 | Endpoint Isolation & Process Termination |
| Module 14 | Process Kill |
All hands-on labs run on Rocheston Rose X OS. Students practice containment operations playbook by implementing the controls discussed in class, with a focus on real-world deployment, monitoring, and validation.
- Lab 1: Execute hands-on tasks for containment operations
- Lab 2: Execute hands-on tasks for advanced cyber defense mastery
- Lab 3: Build detections and response workflows for privilege escalation
- Lab 4: Explain Executive Overview fundamentals
- Lab 5: Execute hands-on tasks for contain a breach
Upon successful completion of this course, students will receive an official RCCE Course Completion Certificate for Containment Operations Playbook, verifiable through the Rocheston certification portal.
- Full access to all course materials and slide decks
- Hands-on lab access on Rocheston Rose X OS environment
- Access to Rocheston CyberNotes
- Access to Rocheston Zelfire — EDR/XDR SIEM platform
- Access to Rocheston Raven — online cyber range exercise platform
- Access to Rocheston Vulnerability Vines AI