Analyst II: Advanced DFIR Track
This course is included in the Analyst 2 – DFIR Training Track and Hero Bundle Training. Enroll to access the course.
> View Course SyllabusÂ
Support & FAQs
Please use our Support & FAQ page to find more information and reach out to us and join our Discord community for general conversation topics and networking.
Important: Virtual Labs
- Your lab VM is a Windows virtual machine in the cloud. This means it may take a few minutes until they are started up and available.
- Whenever you have less than 15 minutes remaining, you will have the option to extend your lab by 1 hour.
- VMs are persistent. When a lab VM is stopped, it will be stored and you can resume the VM at a later point.
- Terminating a VM will destroy the VM and data will be lost.
- For the best experience, it’s recommended to use Google Chrome where you will have copy and paste functionality.
Tools Used
Splunk, Velociraptor, Plaso, Timesketch, Yara, Sigma, Wireshark, Zeek, Volatility3, CyberChef, EricZimmerman Tools, bulk_extractor, Hayabusa, PEStudio, BrowsingHistoryView
Certificate of Completion
Once you finish the course you will receive your Certificate of Completion!
Average Review Score:
★★★★★
You must log in and have started this course to submit a review.
Course Content
Course Logistics
301 Online Lab VM
You don't currently have access to this content
Ransomware Response
Threat Landscape: Ransomware Attacks
You don't currently have access to this content
Incident Analysis: Core Techniques and Approaches
You don't currently have access to this content
Incident Management: Documenting Findings and Creating Timelines
You don't currently have access to this content
Scenario Introduction
Case: Ransomware Scenario
You don't currently have access to this content
Investigation Timeline
You don't currently have access to this content
Timeline Template and Notes Taking
You don't currently have access to this content
1) Network Traffic Analysis
PCAP and Zeek Introduction
You don't currently have access to this content
Network Traffic Analysis Findings
You don't currently have access to this content
2) Log Analysis
Log Analysis Introduction
You don't currently have access to this content
Log Analysis Conclusion
You don't currently have access to this content
3) Remote Threat Analysis
4) Forensic Analysis
5) Malware Analysis
Malware Collection and Analysis Introduction
You don't currently have access to this content
6) Timeline Analysis
7) Self-Guided Timeline Investigations
Investigation Introduction and Objectives
You don't currently have access to this content
Preparation: Splunk Timeline Analysis
You don't currently have access to this content
Preparation: TimeSketch Timeline Analysis
You don't currently have access to this content
Execution: Timeline Analysis Guide
You don't currently have access to this content
8) Post-Incident Activities
Conclusion
Attack Scenario Reveal
You don't currently have access to this content
Course Conclusion and Next Steps
You don't currently have access to this content
I just finished the 301 Advanced Enterprise DFIR course and honestly loved it.
The content was clear, well-structured, and surprisingly engaging. The explanations were easy to follow without oversimplifying anything, and the hands-on parts really helped tie everything together. It’s definitely one of the most solid and interesting DFIR courses I’ve taken so far.
Highly recommend.