Home labs & practical projects

Run the first hour of a workstation incident

A project to do with your own tools, with guidance on what to create and capture.

Design project Suggested time: 90–120 minutesNo hardware required for the design

What you could create

A fictional workstation produces a suspicious process alert while its user is handling an urgent customer task. Response requires both containment and coordination.

Example evidence format

Project evidence map (example)

First-hour incident logScope and inputs

Containment decision and stakeholder updateDecisions and reasoning

Evidence record (example)

Evidence	What to capture
First-hour incident log	Show the inputs, scope and decisions behind this record. Actions have timestamps, owners and reasons.
Containment decision and stakeholder update	Include the evidence supporting your conclusion. The response changes when new evidence contradicts the initial hypothesis.

What you'll need

Document, spreadsheet or diagram tool

Prepare an alert, a short process timeline and a business-impact note. Add a second event halfway through the exercise to change the assessment.

Project record

Keep the working files for first-hour incident log and record assumptions as you go.

Current reference material

Use the linked provider resources to verify the features, access terms and version relevant to your project.

Access & cost

No paid platform is needed for the written version. Use a document, spreadsheet or diagram tool you already have.

The organisation and records are fictional. Write down assumptions; do not substitute confidential employer information.

Suggested milestones

1
Plan and investigate
Set incident priorities and assign response responsibilities.
2
Develop your approach
Choose containment actions with evidence-preservation and business-impact reasoning.
3
Verify and explain
Update the timeline and stakeholder message when the second event arrives.

Evidence worth keeping

Keep clear, organised evidence of your design and any testing you carry out.

1
First-hour incident log
Show the inputs, scope and decisions behind this record. Actions have timestamps, owners and reasons.
2
Containment decision and stakeholder update
Include the evidence supporting your conclusion. The response changes when new evidence contradicts the initial hypothesis.

Label design proposals and observed results clearly.

Explain your work

Use these prompts to reflect on your decisions and what you learned.

Which part of your first-hour incident log needed the most judgement?
What observation or assumption changed your approach?
What would you improve, and what have you not verified?

Describe this as a personal project in your portfolio.

Useful resources

Use these resources to deepen your understanding and check key details.

Official certification objectives

Review the current provider requirements and relevant subject areas.

GIAC official practice tests (2 included with exam)

Check relevance, platform versions and current access terms.

Explore external learning resources

Find relevant providers and check features, access requirements and costs.

A useful starting point

Prepare an alert, a short process timeline and a business-impact note. Add a second event halfway through the exercise to change the assessment.

What a good result looks like

Actions have timestamps, owners and reasons.
The response changes when new evidence contradicts the initial hypothesis.

Finish the project

Keep the decision record and note unanswered questions. A written design is not evidence that a technical control has been tested.

Independent home-project guidance, not an official vendor lab or a claim of complete exam coverage. Use your own tools and label the work accurately.