# Module 1 Overview

## Theme

Incident response lifecycle

## Essential Question

Where can automation improve response?

## Module Components

- `Book prose`: conceptual framing, domain scenario, methods, and failure modes
- `Assignment`: evidence-backed production of a specific artifact
- `Slides`: presentation sequence for seminar or lecture delivery
- `Narration`: spoken version of the slide flow
- `Instructor notes`: facilitation plan, discussion prompts, and grading cues
- `Rubric`: criteria for evaluating the module artifact
- `Notebook`: executable lab aligned with the module theme using synthetic incident records with severity, confidence, blast radius, containment option, and approval outcome

## Module Artifact

automated response playbook with approval gates, rollback plan, and post-incident learning loop focused on incident response lifecycle: Map incident stages and automation candidates.

## Professional Setting

Students work as if advising an incident response team deciding which containment actions can be automated safely. Their work must be intelligible to incident commander, security engineer, legal/compliance reviewer, and affected service owner.