IR-200 · OSIR · For security teams
IR-200: what the course covers - and what we add.
IR-200 (OSIR) covers the incident response lifecycle: preparation, detection, containment, evidence preservation, recovery and lessons learned.
Who it is for
Incident response owners and teams that need a defensible process.
Course content (official scope)
- →IR process and roles
- →Containment and evidence preservation
- →Host and network analysis
- →Communication and post-incident work
Course content, labs and the OSIR exam are provided by OffSec. The official course description always takes precedence. This page reviewed: 2026-08-07.
What Exploit Labs adds
- +A tabletop exercise built on a realistic attack path from our engagements
For security teams
Multiple people, role paths, reporting and procurement run through OffSec Learn Enterprise.
See Learn EnterpriseFor individual practitioners
Individual licence, access duration, exam attempts and preparation - start here.
See individual licences