The ECIH v2 Certified Incident Handler teaches you how to systematically handle and respond to computer security incidents. The training covers the complete incident handling & response (IH&R) cycle: preparation, detection, containment, forensic investigation, recovery and post-incident analysis. ECIH v2 includes more than 95 hands-on labs and prepares for the EC-Council Certified Incident Handler certification (exam code 212-89). The certification is recognised by the U.S. Department of Defense (DoD 8140/8570).

E-learning via the official EC-Council iClass platform

The ECIH v2 at OEM is an official EC-Council iLearn e-learning: completely self-paced, at your own speed, 365 days access. You learn through professionally recorded video lectures by EC-Council Certified Instructors, combined with more than 95 hands-on labs. Start immediately after activation.

OEM offers the lowest price for official EC-Council e-learning in the Netherlands. Found the same training cheaper elsewhere? We'll match that price.

Who is this e-learning for?

Suitable for incident responders, SOC analysts, threat hunters, system administrators, risk managers and anyone responsible for detecting and responding to security incidents. Basic knowledge of networking and information security is recommended.

What will you learn in the ECIH v2 e-learning?

• Establish incident handling & response policies and procedures for the organisation
• Detect, validate and prioritise security incidents
• Collect and analyse forensic evidence in accordance with legal requirements
• Contain incidents, recover systems and eliminate threats
• Respond to malware incidents, network breaches and web application attacks
• Respond to cloud incidents and insider threats
• Produce post-incident reports and document lessons learned
• Set up and train incident response teams

ECIH v2 course content

• Introduction to IH&R: concepts, objectives, legislation and standards
• Setting up incident response teams and developing incident response plans
• Integrating threat intelligence in incident handling
• Detecting security incidents via SIEM, IDS/IPS and log analysis
• Collecting forensic evidence: disk imaging, memory analysis and network forensics
• Analysing malware incidents: static and dynamic malware analysis
• Containing incidents and stopping lateral movement
• Responding to email attacks, web application attacks and cloud incidents
• Recovering systems and eliminating threats
• Post-incident activities: reporting and process improvement

Exam and certification

The ECIH v2 exam (212-89) consists of 100 multiple choice questions and lasts 3 hours. The exam is taken via the EC-Council ECC Exam Centre (online). The certification is valid for 3 years and recognised by the U.S. Department of Defense.

What is included?

• Official EC-Council ECIH v2 e-course materials
• More than 95 hands-on labs via the iLabs environment
• Exam voucher for the ECIH v2 exam (212-89)
• 365 days access to the iClass learning platform
• Online mentor for technical questions for 90 or 365 days after activation
• Certificate of participation

SLIM subsidy

As a Dutch SME, you may be eligible for the SLIM subsidy for ICT training. The Dutch government reimburses 60% of your training costs, up to a maximum of €24,999. Period 2 opens 10 August 2026.

Related training courses

• CEH v13: Certified Ethical Hacker - attack knowledge as a complement to ECIH
• CSA: Certified SOC Analyst
• CHFI: Computer Hacking Forensic Investigator
• CTIA: Certified Threat Intelligence Analyst

Request a quote via our quote form or contact us via our contact page. Or ask Sanne, our AI assistant - available 24/7 via the blue icon at the bottom right of the page.