Containment Playbook for Teams
RCCE students will learn incident containment strategies including network isolation, account suspension, system quarantine, and threat neutralization during active security incidents. RCCE students will learn to make rapid containment decisions that balance security with business continuity, implement network-level containment using firewall rules and VLAN isolation, execute host-level containment through endpoint isolation and process termination, contain compromised accounts through credential reset and session revocation, document containment actions for forensic and legal purposes, and coordinate containment activities across distributed teams and environments. This team-oriented course builds collaborative workflows and organizational playbooks for security operations. Starting from foundational concepts, RCCE students will learn to create and implement standardized procedures that enable consistent performance across team members and shifts. Students develop the documentation, communication, and coordination skills needed for effective team-based security operations.
- Security Engineers building defensive controls
- Security Analysts and Blue Team members
- Systems Administrators with security responsibilities
- GRC and Risk Professionals supporting controls
- Professionals implementing Containment Playbook for Teams
- Execute hands-on tasks for containment playbook
- Explain Course Overview fundamentals
- Execute hands-on tasks for course focus — covering Team containment workflows, Standardized playbooks for.
- Execute hands-on tasks for key outcomes — covering Network & host isolation, Account containment.
- Execute hands-on tasks for no prior ir experience needed — covering Basic networking concepts.
- Execute hands-on tasks for what is incident containment
- Execute hands-on tasks for core principles — covering Stop the bleeding first.
- Execute hands-on tasks for why containment matters
- Execute hands-on tasks for cost of delayed containment — covering Lateral movement expands blast radius, Data exfiltration volume increases.
- Execute hands-on tasks for value of fast containment — covering Limits damage to affected systems only, Preserves forensic integrity.
- Execute hands-on tasks for containment phase activities
- Execute hands-on tasks for containment decision framework
| Module 01 | Containment Playbook |
| Module 02 | Course Overview |
| Module 03 | Course Focus |
| Module 04 | Key Outcomes |
| Module 05 | No prior IR experience needed |
| Module 06 | What Is Incident Containment |
| Module 07 | Core Principles |
| Module 08 | Why Containment Matters |
| Module 09 | Cost of Delayed Containment |
| Module 10 | Value of Fast Containment |
| Module 11 | Containment Phase Activities |
| Module 12 | Containment Decision Framework |
| Module 13 | Decision Criteria |
| Module 14 | Urgency Indicators |
All hands-on labs run on Rocheston Rose X OS. Students practice containment playbook for teams by implementing the controls discussed in class, with a focus on real-world deployment, monitoring, and validation.
- Lab 1: Execute hands-on tasks for containment playbook
- Lab 2: Explain Course Overview fundamentals
- Lab 3: Execute hands-on tasks for course focus
- Lab 4: Execute hands-on tasks for key outcomes
- Lab 5: Execute hands-on tasks for no prior ir experience needed
Upon successful completion of this course, students will receive an official RCCE Course Completion Certificate for Containment Playbook for Teams, verifiable through the Rocheston certification portal.
- Full access to all course materials and slide decks
- Hands-on lab access on Rocheston Rose X OS environment
- Access to Rocheston CyberNotes
- Access to Rocheston Zelfire — EDR/XDR SIEM platform
- Access to Rocheston Raven — online cyber range exercise platform
- Access to Rocheston Vulnerability Vines AI