Create lab7-incident-response-scenario.md

Author: ngvuthdanhh

labs/lab7-incident-response-scenario.md

@@ -0,0 +1,15 @@
+# Lab 7 – Incident Response Scenario
+
+## Objective
+Apply DFIR workflow to a simulated incident.
+
+## Tasks
+1. Review incident alerts.
+2. Contain affected hosts.
+3. Collect and analyze evidence.
+4. Produce a final incident report.
+
+## Expected Output
+- Containment checklist  
+- Evidence package  
+- Final IR report (PDF or MD)