Are You Ready for Hands-On Incident Response? A Practical Checklist

You don’t need to know every Windows forensic tool or recognise every attack technique before learning incident response. 

But you should be comfortable navigating Windows, examining basic security evidence, and understanding what happens when an incident is detected. 

This checklist helps you assess those foundations and identify what to practise next.

Whether you’re learning cyber security or already investigating alerts, use it to prepare for TryHackMe’s Windows Incident Response & Forensics path.

How to Use This Readiness Checklist

Set aside around 15-20 minutes to review the questions below.

Tick each item you can demonstrate in a lab or explain using a real example. You can use documentation to help, as long as you understand what you’re doing and why.

After each section, rate your confidence:

• Green: You can complete the checks and explain your reasoning.
• Amber: You understand the concepts but need more practice.
• Red: You're unfamiliar with the topic or need help with the basics.

Part 1: Check Your Windows and Incident Response Foundations

TryHackMe’s Introduction to Windows IR assumes basic Windows and incident response knowledge, with SOC Level 2 recommended as preparation.

Start by checking these three areas. 

1. Windows and Active Directory Basics

Windows investigations often involve examining processes, user accounts, services, and system configuration.

You should understand how these components normally work so you can recognise activity that deserves further investigation.

Your checklist:

1. I can navigate Windows files, the registry, and basic PowerShell commands.
2. I can explain the difference between local and domain accounts and what a domain controller does.
3. I understand how Windows services, scheduled tasks, and Run keys can execute programs.
4. I can identify a running process, its parent process, executable path, and user account.

If these tasks are unfamiliar, start with the Windows, Active Directory, and Command Line sections of Cyber Security 101.

2. Windows Event Logs and Security Evidence

Event logs help you understand what happened on a system, from user authentication to suspicious process activity.

Knowing an Event ID is useful, but you also need to understand the information inside the event and how it relates to other activity. 

Your checklist:

1. I understand how logging settings, missing records, and time zones affect an investigation.
2. I can connect related process, PowerShell, or authentication events.
3. I can identify account details, source information, and logon types in authentication events.
4. I can open and filter Windows event logs by time, host, or event type.

If you need more practice, TryHackMe’s Windows Event Logs room is a useful starting point. The SOC Level 2 path offers deeper investigation practice.

3. The Incident Response Process

Investigating suspicious activity is one part of incident response. You also need to understand how teams contain threats, remove attacker access, and restore affected systems.

Your checklist:

I can explain when a response action needs approval or escalation.

I understand why restarting a system or deleting files may affect evidence.

I know what questions help establish an incident's initial scope and urgency.

I can explain the main stages of incident response, including investigation, containment, eradication, and recovery.

Use the Incident Response Process room if you need help connecting the stages to a practical investigation. 

Part 2: Assess Your Practical Investigation Skills

Once you’re comfortable with the foundations, the next step is applying them to unfamiliar incidents.

These are skills you’ll continue developing through hands-on training, so an amber result is a useful place to begin. 

4. Collect and Preserve Evidence

Before investigating an incident, you need to identify which evidence matters and collect it without unnecessarily changing the system.

Your checklist:

1. I understand why memory, event logs, and disk artefacts provide different information.
2. I can preserve original files, record hashes, and organise copies for analysis.
3. I can document where evidence came from, how it was collected, and when.

.3 I can choose relevant evidence sources based on the suspected activity.

The Key Artifacts for DFIR and KAPE Data Triage rooms can help you practise evidence collection and processing. 

5. Investigate Beyond the Initial Alert

An alert tells you where to start looking. A good investigation establishes what happened, which systems were affected, and whether the activity continued elsewhere.

Your checklist:

1. I can create a basic timeline of suspicious activity.
2. I can distinguish confirmed findings from assumptions.
3. I can connect related activity using accounts, hosts, timestamps, and process information.
4. I can form an initial explanation and identify evidence that supports or challenges it.

Try it: Start with an unfamiliar process alert. Choose two additional evidence sources to investigate and explain how each could change your assessment.

The DFIR Essentials module introduces useful investigation techniques, including timelines and identifying unusual activity.

6. Explain Your Findings and Recommend Next Steps

Your investigation should leave enough information for another analyst to understand what you've found and continue the work.

Your checklist:

1. I can document unresolved questions and what should happen next.
2. I can explain a recommended containment or remediation action.
3. I can support important findings with logs or other evidence.
4. I can summarise the affected systems, accounts, and suspicious activity.

7. Prioritise Your Investigation

During an incident, you may have more evidence to examine than time available. Knowing which questions to answer first helps you make progress while keeping important risks in view.

Your checklist:

1. I know when to request additional evidence or escalate for help.
2. I can record my queries and actions to avoid repeating work.
3. I can recognise when a line of investigation is producing little useful evidence.

I can prioritise investigation steps based on the potential impact and ongoing threat.

Part 3: What Do Your Checklist Results Mean?

Look at your ratings from Parts 1 and 2. Focus first on the foundations, then use the remaining gaps to guide your practice. 

If your results are mixed, focus on the skill that affects your investigations most.

For example, if you understand Windows but struggle to interpret event logs, practise log analysis before moving into more demanding forensic scenarios.

You can return to this checklist after completing a few rooms to see whether those weaker areas have improved. 

Part 4: Put Your Skills to the Test With a Mini-Investigation

Want to check how prepared you are before starting the full path?

Choose an authorised Windows incident response lab or forensic dataset involving a suspicious process or possible remote access.

Give yourself 30-45 minutes to complete an initial investigation.

Then write a short case note answering four questions:

1. What happened? Identify the suspicious activity and the evidence supporting it.
2. What's affected? Record the accounts, processes, and systems involved.
3. What would you do next? Recommend an investigation or response action and explain why.
4. What's still unknown? Identify the most important gap and the evidence needed to resolve it.

Review your answers against the lab explanation or available evidence. Look for areas where you missed relevant events, treated assumptions as facts, or struggled to explain your conclusion.

Use those findings to choose your next exercise. Keep all testing within authorised lab environments and follow the training platform's rules for handling and sharing evidence.

Ready to Practice Windows Incident Response?

Your checklist gives you a starting point. The next step is working through investigations that help you turn those foundations into practical skills.

TryHackMe’s Windows Incident Response & Forensics path takes you through preparing for incidents, collecting Windows evidence, investigating attacker techniques, and analysing forensic artefacts.

Start with your weakest area, practise with real scenarios in a safe environment, and track what you can investigate independently as you progress.