This five-day course is designed for computer security incident response team (CSIRT) technical personnel with several months of incident-handling experience. Building on the methods and tools discussed in the fundamentals course, this course focuses on practical exercises constructed around various incidents involving privileged compromises.