E|CIH v3 Training – EC-Council Certified Incident Handler
E|CIH v3 teaches you to detect, contain and resolve security incidents through a structured process, from preparation through to lessons learned. Over three days you work through realistic scenarios: malware, phishing, network and web attacks, cloud compromise, insider threats and endpoint incidents, using EC-Council's official lab environment. We deliver it live online, in person in Casablanca or on-site at your organization, in French or English.
Build an incident handling capability aligned with good practice
Apply every phase of the lifecycle: preparation, detection, containment, eradication, recovery
Carry out first response while preserving evidence
Handle malware, email, network and web application incidents
Respond to cloud incidents, insider threats and endpoint attacks
Document the incident and lead the post-incident review
Program
Introduction to incident handling and response
Key concepts, frameworks and legal obligations
Incident handling and response process
Triage, notification, containment, eradication and recovery
First response
Securing the scene and collecting volatile evidence
Malware incidents
Detection, containment and clean-up
Email security incidents
Phishing, spoofing and header analysis
Network security incidents
Denial of service, unauthorised access, wireless
Web application security incidents
Injection, XSS and application exploitation
Cloud security incidents
Response in AWS, Azure and GCP environments
Insider threats
Indicators, investigation and corrective measures
Endpoint security incidents
Workstations, servers, mobiles and IoT
Prerequisites
At least one year of work experience in cybersecurity
Sound grounding in networking and Windows and Linux systems
Target audience
CSIRT and CERT members
Tier 1 and tier 2 SOC analysts
System and network administrators who act as first responders
Security managers and risk officers who oversee incident procedures
Penetration testers and forensic investigators who want to cover response
The exam
The E|CIH exam (212-89) has 100 multiple-choice questions to answer in 3 hours. EC-Council uses several exam forms and sets a cut score between 60% and 85% for each, according to its difficulty. You sit the exam through EC-Council's exam centres (ECC Exam Centers). Rules for keeping the certification active are set by EC-Council, and we go through them with you when you enrol.
Preparation tips
Memorise the order of the response phases and the output of each
Replay the lab scenarios and time your initial triage
Compare the expected response for on-premises and cloud incidents
Frequently asked questions (FAQ)
How does E|CIH differ from CHFI?
E|CIH focuses on managing the incident as it unfolds: detect, contain, recover. CHFI goes deeper into evidence analysis and producing a forensic report. Many teams take both, in that order.
Do I need experience to enrol?
EC-Council recommends at least one year of cybersecurity experience. A system administrator with some security background can follow the course without major difficulty.
Does the course include hands-on work?
Yes. The official labs reproduce real environments through 22 scenario-based exercises spread across the different incident types.
What is new in version 3?
Version 3 puts more weight on cloud, endpoints and insider threats, with a dedicated module for each, reflecting where most real-world incidents now start and spread.
Does it help me join a SOC?
Yes. It pairs well with Certified SOC Analyst: C|SA covers detection and triage, while E|CIH covers the structured response that follows once an alert turns out to be a real incident.