SANS GCFA 508 v2019 (only PDF)

FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
Detect how and when a breach occurred
Identify compromised and affected systems
Perform damage assessments and determine what was stolen or changed
Contain and remediate incidents
Develop key sources of threat intelligence
Hunt down additional breaches using knowledge of the adversary