The incident response lifecycle is part of Incident Response & SOAR, which unlocks once you complete every lesson in L2 · Investigation & Correlation.

This keeps the curriculum sequenced: each phase builds on skills exercised in the one before it.