Evidence collection Incident Handling: Bootcamp Unit
RCCE students will learn audit evidence collection, management, and presentation including evidence types, collection methodologies, evidence repositories, and evidence lifecycle management. RCCE students will learn to identify the types of evidence required for various compliance frameworks, develop evidence collection procedures that produce consistent and reliable results, configure automated evidence collection from security tools and systems, manage evidence repositories with proper access controls and versioning, validate evidence quality and completeness, present evidence packages to internal and external auditors, and maintain evidence retention schedules that meet regulatory requirements. This incident response course prepares students to act decisively during security incidents with structured workflows and clear decision frameworks. Building on core knowledge, RCCE students will learn containment, evidence collection, eradication, and recovery procedures specific to this domain. Students practice incident scenarios that build the composure, coordination, and documentation skills essential for effective incident handling.
- Security Engineers building defensive controls
- Security Analysts and Blue Team members
- Systems Administrators with security responsibilities
- GRC and Risk Professionals supporting controls
- Professionals implementing Evidence collection Incident Handling: Bootcamp Unit
- Execute hands-on tasks for evidence collection &
- Execute hands-on tasks for incident handling
- Explain Module Overview fundamentals
- Execute hands-on tasks for evidence collection
- Execute hands-on tasks for learning objectives
- Execute hands-on tasks for evidence fundamentals
- Monitor and audit privilege usage; detect escalation attempts
- Execute hands-on tasks for why evidence matters — covering Records proving control effectiveness, Regulatory mandate for most frameworks.
- Execute hands-on tasks for evidence types classification
- Execute hands-on tasks for documentary evidence — covering Policies, procedures, standards.
- Execute hands-on tasks for technical evidence — covering System logs and audit trails.
- Execute hands-on tasks for observational evidence — covering Walkthrough observations.
| Module 01 | Evidence Collection & |
| Module 02 | Incident Handling |
| Module 03 | Module Overview |
| Module 04 | Evidence Collection |
| Module 05 | Learning Objectives |
| Module 06 | Evidence Fundamentals |
| Module 07 | What Is Audit Evidence? |
| Module 08 | Why Evidence Matters |
| Module 09 | Evidence Types Classification |
| Module 10 | Documentary Evidence |
| Module 11 | Technical Evidence |
| Module 12 | Observational Evidence |
| Module 13 | Testimonial Evidence |
| Module 14 | Evidence Strength Hierarchy |
All hands-on labs run on Rocheston Rose X OS. Students practice evidence collection incident handling: bootcamp unit by implementing the controls discussed in class, with a focus on real-world deployment, monitoring, and validation.
- Lab 1: Execute hands-on tasks for evidence collection &
- Lab 2: Execute hands-on tasks for incident handling
- Lab 3: Explain Module Overview fundamentals
- Lab 4: Execute hands-on tasks for evidence collection
- Lab 5: Execute hands-on tasks for learning objectives
Upon successful completion of this course, students will receive an official RCCE Course Completion Certificate for Evidence collection Incident Handling: Bootcamp Unit, verifiable through the Rocheston certification portal.
- Full access to all course materials and slide decks
- Hands-on lab access on Rocheston Rose X OS environment
- Access to Rocheston CyberNotes
- Access to Rocheston Zelfire — EDR/XDR SIEM platform
- Access to Rocheston Raven — online cyber range exercise platform
- Access to Rocheston Vulnerability Vines AI