Skip to main content

Home Google Cloud

Course

Detect, Respond, and Recover from Cloud Cybersecurity Attacks

IntermediateSkill Level

Updated 07/2026

In this course, you’ll focus on developing capabilities in logging, security, and alert monitoring, along with techniques for mitigating attacks.

Start Course for Free

Google CloudCloud

26 hr 15 min

50 videos

197 Exercises

10,050 XP

Statement of Accomplishment

Loved by learners at thousands of companies

Training a Team?

Try for Business

Course Description

This is the fourth of five courses in the Google Cloud Cybersecurity Certificate. In this course, you’ll focus on developing capabilities in logging, security, and alert monitoring, along with techniques for mitigating attacks. You'll gain valuable knowledge in customizing threat feeds, managing incidents, handling crisis communications, conducting root cause analysis, and mastering incident response and post-event communications. Using Google Cloud tools, you'll learn to identify indicators of compromise and prepare for business continuity and disaster recovery. Alongside these technical skills, you'll continue updating your resume and practicing interview techniques.

Prerequisites

There are no prerequisites for this course

1

Detection foundations

In this module, you’ll delve into crucial topics for detecting security activities, focusing on log retention policies, intrusion detection and prevention systems, and the intricacies of monitoring and alerts. You'll learn about incident management and attack mitigation strategies. Additionally, the section will guide you through logging fundamentals and monitoring best practices, equipping you with the knowledge to effectively manage and respond to security incidents.

Introduction to course 4

Course 4 overview

Seline: Make an impact in cloud security

Helpful resources and tips

Lab technical tips

Explore your course 4 scenario: Cymbal Bank

Welcome to module 1

SecOps and its components

Essential SecOps skills

Vulnerability management techniques

Vulnerability scanning, penetration testing, and tabletop exercises

AI in SecOps: Red teams

Test your knowledge: Security operations foundations — Question 1

Test your knowledge: Security operations foundations — Question 2

Test your knowledge: Security operations foundations — Question 3

Test your knowledge: Security operations foundations — Question 4

Incident detection basics

Phases of incident response and management

Incident response plans

More about incident response phases

Intrusion detection systems

Signature and anomaly-based detection

Test your knowledge: Incident management foundations — Question 1

Test your knowledge: Incident management foundations — Question 2

Test your knowledge: Incident management foundations — Question 3

Test your knowledge: Incident management foundations — Question 4

Logs for analysis and monitoring

Log types: A breakdown

Log management: The skills needed for success

Test your knowledge: Logging and log retention fundamentals — Question 1

Test your knowledge: Logging and log retention fundamentals — Question 2

Test your knowledge: Logging and log retention fundamentals — Question 3

Test your knowledge: Logging and log retention fundamentals — Question 4

Alerts and notifications

Alert search techniques

Alert and log optimization

Guide to event threat detection

Determine the difference between normal activity and an incident

Test your knowledge: Alerts, notifications, and log optimization — Question 1

Test your knowledge: Alerts, notifications, and log optimization — Question 2

Test your knowledge: Alerts, notifications, and log optimization — Question 3

Test your knowledge: Alerts, notifications, and log optimization — Question 4

Glossary terms from module 1

Module 1 challenge — Question 1

Module 1 challenge — Question 2

Module 1 challenge — Question 3

Module 1 challenge — Question 4

Module 1 challenge — Question 5

Module 1 challenge — Question 6

Module 1 challenge — Question 7

Module 1 challenge — Question 8

Module 1 challenge — Question 9

Module 1 challenge — Question 10

2

Detection in practice

In this module, you’ll delve into the intrusion kill chain, false positive analysis, and threat hunting techniques through the lens of incident management and attack mitigation. You’ll also learn how to create detection rules, use query tools to analyze logs and identify indicators of compromise (IoC).

Welcome to module 2

Introduction to Lockheed Martin’s Cyber Kill Chain®

False positive analysis

Lockheed Martin’s Cyber Kill Chain® in practice

Guide to false positive analysis

Explore false positives through incident detection

Test your knowledge: False positives and Lockheed Martin’s Cyber Kill Chain® — Question 1

Test your knowledge: False positives and Lockheed Martin’s Cyber Kill Chain® — Question 2

Test your knowledge: False positives and Lockheed Martin’s Cyber Kill Chain® — Question 3

Test your knowledge: False positives and Lockheed Martin’s Cyber Kill Chain® — Question 4

Introduction to security monitoring

Tim: Analytical skills for detection and response

Security monitoring key concepts

Tools for proactive security monitoring

Test your knowledge: Proactive security monitoring and alerting — Question 1

Test your knowledge: Proactive security monitoring and alerting — Question 2

Test your knowledge: Proactive security monitoring and alerting — Question 3

Test your knowledge: Proactive security monitoring and alerting — Question 4

Indicators of compromise (IOCS)

Essentials of threat hunting

IOCs for threat detection

Aggregations and correlations

Introduction to query tools

Query tools: RegEx and YARA-L

Test your knowledge: Threat hunting and indicators of compromise — Question 1

Test your knowledge: Threat hunting and indicators of compromise — Question 2

Test your knowledge: Threat hunting and indicators of compromise — Question 3

Test your knowledge: Threat hunting and indicators of compromise — Question 4

Glossary terms from module 2

Module 2 challenge — Question 1

Module 2 challenge — Question 2

Module 2 challenge — Question 3

Module 2 challenge — Question 4

Module 2 challenge — Question 5

Module 2 challenge — Question 6

Module 2 challenge — Question 7

Module 2 challenge — Question 8

Module 2 challenge — Question 9

Module 2 challenge — Question 10

3

Incident response management and attack mitigation

In this module, you'll explore the entire incident response process. Additionally, you’ll gain essential skills in documenting information for various stakeholders, defining and conducting post-mortem analyses, and developing and executing automated playbooks. By the end of this course, you'll have a comprehensive understanding of the importance of automation in SecOps and be equipped with the necessary tools and knowledge to thrive in your chosen cloud security role.

Welcome to module 3

The importance of evidence preservation

Digital evidence preservation: Techniques and best practices

How security teams preserve evidence

Test your knowledge: Evidence preservation — Question 1

Test your knowledge: Evidence preservation — Question 2

Test your knowledge: Evidence preservation — Question 3

Test your knowledge: Evidence preservation — Question 4

Incident response in Google Cloud

Incident response best practices with Chronicle SOAR

Incident identification

Coordination for incident response

Guide to log queries, exports, and analysis

Analyze audit logs using BigQuery

Test your knowledge: Incident management — Question 1

Test your knowledge: Incident management — Question 2

Test your knowledge: Incident management — Question 3

Test your knowledge: Incident management — Question 4

Documentation fundamentals

Elements of successful documentation

Documentation in practice

Activity: Document a timeline of events

Activity Quiz: Document a timeline of events — Question 1

Activity Quiz: Document a timeline of events — Question 2

Activity Quiz: Document a timeline of events — Question 3

Activity Quiz: Document a timeline of events — Question 4

Activity Exemplar: Document a timeline of events

Test your knowledge: Documentation — Question 1

Test your knowledge: Documentation — Question 2

Test your knowledge: Documentation — Question 3

Test your knowledge: Documentation — Question 4

Actionable alert identification

Incident response partners

Security orchestration with playbooks

Incident response orchestration versus automation

Playbooks' role in incident response

Fatima: A day in the life of a detection and response team manager

Test your knowledge: Response in action using automation — Question 1

Test your knowledge: Response in action using automation — Question 2

Test your knowledge: Response in action using automation — Question 3

Test your knowledge: Response in action using automation — Question 4

Test your knowledge: Response in action using automation — Question 5

Glossary terms from module 3

Module 3 challenge — Question 1

Module 3 challenge — Question 2

Module 3 challenge — Question 3

Module 3 challenge — Question 4

Module 3 challenge — Question 5

Module 3 challenge — Question 6

Module 3 challenge — Question 7

Module 3 challenge — Question 8

Module 3 challenge — Question 9

Module 3 challenge — Question 10

4

Incident recovery

In this module, you'll acquire a thorough understanding of disaster recovery planning and business continuity in the Google Cloud environment, ensuring data integrity and maintaining operations during a disaster, focusing on swift response strategies. This module will also guide you through the role of automation in detecting and responding to cyberattacks, the use of the business continuity and disaster recovery (BCDR) tool, and the criticality of recovery as a last resort.

Welcome to module 4

Recovery plans in action

Information recovery and system restoration

System recovery steps and scenarios

Test your knowledge: Recovery plans and system restoration — Question 1

Test your knowledge: Recovery plans and system restoration — Question 2

Test your knowledge: Recovery plans and system restoration — Question 3

Test your knowledge: Recovery plans and system restoration — Question 4

Business continuity and disaster recovery (BCDR) basics

The role of BCDR tools

BCDR in Google Cloud

Guide to backups and VM recovery

Recover VMs with Google Backup and DR Service

Test your knowledge: Business continuity and disaster recovery — Question 1

Test your knowledge: Business continuity and disaster recovery — Question 2

Test your knowledge: Business continuity and disaster recovery — Question 3

Test your knowledge: Business continuity and disaster recovery — Question 4

Recovery options and measures of success

Components of a disaster recovery plan (DRP)

Disaster recovery planning in Google Cloud: Build a DRP

Disaster recovery planning in Google Cloud: Implement a DRP

Test your knowledge: Disaster recovery plan fundamentals — Question 1

Test your knowledge: Disaster recovery plan fundamentals — Question 2

Test your knowledge: Disaster recovery plan fundamentals — Question 3

Test your knowledge: Disaster recovery plan fundamentals — Question 4

Business continuity and disaster recovery plans

Create and manage effective BCDR plans

Disaster recovery plan stakeholders

Test your knowledge: BCDR roles and responsibilities — Question 1

Test your knowledge: BCDR roles and responsibilities — Question 2

Test your knowledge: BCDR roles and responsibilities — Question 3

Test your knowledge: BCDR roles and responsibilities — Question 4

Patrick and Pedro: Interview role play

Interview tip: End responses with positive takeaways

Glossary terms from module 4

Module 4 challenge — Question 1

Module 4 challenge — Question 2

Module 4 challenge — Question 3

Module 4 challenge — Question 4

Module 4 challenge — Question 5

Module 4 challenge — Question 6

Module 4 challenge — Question 7

Module 4 challenge — Question 8

Module 4 challenge — Question 9

Module 4 challenge — Question 10

Course wrap-up

Course 4 resources and citations

Glossary terms from course 4

Detect, Respond, and Recover from Cloud Cybersecurity Attacks

Course
Complete

Earn Statement of Accomplishment

Add this credential to your LinkedIn profile, resume, or CV
Share it on social media and in your performance reviewEnroll Now

Join over 19 million learners and start Detect, Respond, and Recover from Cloud Cybersecurity Attacks today!

Grow your data skills with DataCamp for Mobile

Make progress on the go with our mobile courses and daily 5-minute coding challenges.