What You Will Learn

Find the Storm in the Cloud

FOR509: Enterprise Cloud Forensics and Incident Response will help you

Understand forensic data only available in the cloud
Implement best practices in cloud logging for DFIR
Learn how to leverage Microsoft Azure, AWS and Google Cloud Platform resources to gather evidence
Understand what logs Microsoft 365 and Google Workspace have available for analysts to review
Learn how to move your forensic processes to the cloud for faster data processing

With FOR509: Enterprise Cloud Forensics and Incident Response, examiners will learn how each of the major cloud service providers (Microsoft Azure, Amazon AWS and Google Cloud Platform) are extending analyst's capabilities with new evidence sources not available in traditional on-premise investigations. From cloud equivalents of network traffic monitoring to direct hypervisor interaction for evidence preservation, forensics is not dead. It is reborn with new technologies and capabilities.

Incident response and forensics are primarily about following breadcrumbs left behind by attackers. These breadcrumbs are primarily found in logs. Your knowledge of the investigation process is far more important than the mechanics of acquiring the logs.

This class focuses on log analysis to help examiners come up to speed quickly with cloud-based investigation techniques. It's critical to know which logs are available in the cloud, their retention, whether they are turned on by default, and how to interpret the meaning of the events they contain.

Numerous hands-on labs throughout the course will allow examiners to access evidence generated based on the most common incidents and investigations. Examiners will learn where to pull data from and how to analyze it to find evil. The data will be available in your VM rather than accessed directly via the cloud to ensure a consistent lab experience.

FOR509 Enterprise Cloud Forensics Will Prepare Your Team To

Learn and master the tools, techniques, and procedures necessary to effectively locate, identify, and collect data no matter where it is located
Identify and utilize new data only available from cloud environments
Utilize cloud-native tools to capture and extract traditional host evidence
Quickly parse and filter large data sets using scalable technologies such as the Elastic Stack
Understand what data is available in various cloud environments

FOR509 Enterprise Cloud Forensics Course Topics

Cloud Infrastructure and IR data sources
Microsoft 365 and Graph API Investigations
Azure Incident Response
AWS Incident Response
High-level Kubernetes Clouds logs
Google Workspace Investigations
Google Cloud Incident Response

Business Takeaways

Understand digital forensics and incident response as it applies to the cloud
Identify malicious activities within the cloud
Cost-effectively use cloud-native tools and services for DFIR
Ensure the business is adequately prepared to respond to cloud incidents
Decrease adversary dwell time in compromised cloud deployments

What You Will Receive

SOF-ELK(R) Virtual Machine - a publicly available appliance running the Elastic Stack and the course author's custom set of configurations and lab data. The VM is preconfigured to ingest cloud logs from Microsoft 365, Azure, AWS, Google Cloud and Google Workspace. It will be used during the class to help students wade through the large number of records they are likely to encounter during a typical investigation.
Case data to examine during class.
Electronic workbook with detailed step-by-step instructions and examples to help you master cloud forensics

What To Take Next

Syllabus (36 CPEs)

Download PDF

Microsoft 365 and Graph API
Overview
There is a universe of data out there to be discovered.
Before you can begin exploring the universe of cloud data you must learn where and how it exists. In this section, you will learn about common cloud concepts such as snapshots and cloud flows. You will understand what kind of logging and data access is provided by each cloud architecture and how to extract and process this data.
We will introduce SOF-ELK, an open-source log analysis platform that easily extends into cloud forensics. We will discuss the Microsoft 365 unified audit log (UAL) and explore two common scenarios: suspicious emails and ransomware/extortion.
We finish the day by exploring the Microsoft Graph API and review the logs that it generates.
Exercises
LAB 1.1: Visualize data in SOF-ELK
In this lab students will learn how to search and visualize data in Kibana. They will also learn how to create their own dashboard. Kibana dashboards allow analysts to display summarized statistics and predefined filters for specific scenarios.
LAB 1.2: Suspicious Email
Students will review the Unified Audit Log in SOF-ELK to find the source of a business email compromise.
LAB 1.3: Extortion
In this lab, we will examine the various SharePoint and OneDrive file operations that are typically encountered during ransomware/extortion situations.
LAB 1.4: Privilege Escalation with Graph API
The Graph API is a powerful way to interact with the Microsoft cloud (both Microsoft 365 and Azure). Understanding the permissions granted to a Graph API application is critical to eliminating blind spots and solving incidents. We will explore the logs generated by the Graph API and touch on the lack of logs under certain circumstances.
Topics
MODULE 1.1: Introducing SOF-ELK
- SOF-ELK architecture
- Logstash
- Search process
- Filtering in Kibana
  Discover
  Visualize Library
  Dashboards
MODULE 1.2: Key Elements of Cloud for DFIR
- Cloud Models
- DFIR in the cloud
- Common cloud concepts
  Shared responsibility model
  Key logs for investigations
  Cloud access options
  VM disk snapshots
  Cloud flows
  Pricing
  Terminology across clouds
MODULE 1.3: Microsoft 365 Unified Audit Log
- Unified Audit Log
- UAL Records
- Searching the UAL
  Purview Portal
  PowerShell Cmdlet
  Microsoft 365 Management API
- Exchange Workload
- SharePoint Workload
- Azure Active Directory
MODULE 1.4: Microsoft Graph API
- Case study: SolarWinds
- Microsoft Graph API Process
- Graph API Process
- Five steps to Graph API
- Examples logs
  Read emails
  Create a user
- Microsoft Graph PowerShell
- Investigate your Environment
Microsoft Azure
Overview
One of the most popular cloud providers for large enterprises is the Microsoft Azure cloud. Azure offers an impressive array of services and with that comes numerous data sources for us to explore. In this section we will learn about the various Azure activity and diagnostics logs. Finally, we will find out how to deploy our own analysis tools in the cloud.
Exercises
LAB 2.1: Using SOF-ELK with Azure Logs
In this lab students will explore the azure index and discover the users and machines of pymtechlabs.com.
LAB 2.2: AAD Password Spray
In this lab students will gain experience with the Azure Active Directory logs and identify a password spray attack.
LAB 2.3: Tracking Resource Creations
In this lab students will see an example of virtual machines being created for the purpose of crypto mining.
LAB 2.4: Detecting Data Exfiltration
In this lab students will track data exfiltration through NSG flow logs and storage logs.
Topics
MODULE 2.1: Understanding Azure
- Tenant & Subscriptions
- Azure Resource Manager
- Resource groups
- Key Resources for DFIR
- Azure Resource ID Strings
- Role Based Access Control
- Accessing Microsoft Azure
  Portal
  CLI
  PowerShell
- DFIR evidence in Cloud Shell
MODULE 2.2: VMs, Networking, and Storage
- Azure compute
- Virtual machine types
- Managed disk
- Azure virtual network
- Network security group
- Storage account
MODULE 2.3: Log sources for IR
- Sources of logs
- Log Analytics workspace
- Tenant logs
  Sign-in logs
  Successful and failed login examples
  Audit log
  Log analytics queries
  Case study: Impossible logins
  Azure Storage Explorer
  Export to JSON
  Import into SOF-ELK
  Event Hubs
  Graph API
- Subscription logs
  Log schema
  Viewing the activity log in the portal
  Log analytics examples
  Storage account and event hubs
  Import into SOF-ELK
- Resource logs
  NSG Flow Log
  Import into SOF-ELK
  Storage account logs
  Data exfiltration
MODULE 2.4: Virtual Machine Logs
- Windows Agents
- Windows Azure Diagnostics (WAD)
- WAD Event Log Table
- Importing into SOF-ELK
- Azure VM Run Command
  Forensic Artifacts on Target System
  Forensic Artifacts on Source System
- Linux Logs
- VM Insights
MODULE 2.5: In-cloud IR
- Imaging a drive in the cloud
- In-Cloud investigations
  Snapshot Creation
  Downloading Snapshots
  Create a forensic VM
  Run forensic tools
- Forensic VM Image Creation
- Other Azure resources
  Azure Sentinel
  Microsoft incident response playbooks
  Azure Threat Research Matrix
Amazon (AWS)
Overview
Now that we understand what's possible in the Cloud and the new DFIR evidence sources that exist for us, it's time to turn to the market leader in Cloud services. In this section we will explore how AWS can be used for the responder, how to deploy your own analysis system into your region, the new and relevant log sources for your investigation and how to bring it all together in lab scenarios designed to help you quickly solve the most common AWS cases.
Exercises
LAB 3.1: Reviewing CloudTrail Logs
In this lab students will make use of exported logs from CloudTrail to identify possible account takeovers. Reviewing multiple scenarios of console access and API key access, students will learn how to find and track these attacks.
LAB 3.2: Finding Rogue VMs
In this lab students will make use of exported CloudTrail logs to locate newly created EC2 instances of different types created by attackers.
LAB 3.3: VPC Flow Logs and Route 53 Logs
In this lab students will use VPC Flow logs to find evidence of large data exfiltration. As a bonus, students can also attempt to find beacon traffic to define the indicators of compromise.
LAB 3.4: S3 Analysis
In this lab students will make use of S3 Access logs to find evidence of data exfiltration from S3 buckets.
LAB 3.5: Tracking Lateral Movement
In this lab students will use multiple log sources in order to follow an incident from initial IAM exposure to data access.
Topics
MODULE 3.1: Understanding IR in AWS
- Organizations
- IAM
- IAM Methods of Access
- CloudTrail
- CloudTrail Insights
- CloudTrail pricing
- Threat Hunting in CloudTrail
- GuardDuty
MODULE 3.2: Networking, VMs, and Storage
- Virtual Compute
  EC2 types
  EC2 CloudTrail logs
  EBS types
  EBS CloudTrail Logs
  Snapshots
  Snapshot CloudTrail Logs
  EFS
  EFS CloudTrial Logs
- Virtual Networks
  VPCs
  Subnets
  VPC Flow Logs
  Route 53
- S3 Buckets
  S3 Buckets
  S3 Buckets for Log Storage
  S3 Buckets Access Policies
  S3 Access Logs
  S3 Transfer Acceleration
MODULE 3.3: Log sources for IR
- AWS Log Sources
- AWS Glue
- AWS Athena
- AWS Detective
MODULE 3.4: Event Drive Response
- Lambda
- Lambda Examples
- Step Functions
- Event Triggers
- Event Driven DFIR Automation
MODULE 3.5: In-cloud IR
- Creating IR VMs
- In-Cloud vs. On-Prem
- AWS systems manager
- Capturing Linux Memory
- Capturing Windows Memory
Google Workspace
Overview
This section will start with a high-level overview of Kubernetes and the logs available in each of the cloud providers.
As one of the first SaaS solutions for organizations dating back to 2006, Google Workspace has a wide array of evidence artifacts for investigators to use when conducting incident response or internal investigations. Knowing the various locations to extract evidence, and how that evidence differs depending on where it's extracted, form one of the key concepts for Google Workspace investigations. Students will see four of the most common attacks in Google Workspace and how to investigate those attacks in depth.
As with all the cloud platforms, students will see the limitations of preserved evidence and how to extend the lifetime of evidence in Google Workspace. Students will get hands-on access to evidence and be taught skills for how to best analyze Google Workspace evidence.
Exercises
LAB 4.1: Kubernetes Log Analysis
In this lab, students will explore Kubernetes logs to identify pods within a Kubernetes cluster. Students will also search these logs for potential threat actor activity.
LAB 4.2: Google Workspace Admin BEC
In this lab, students will analyze exported Google Workspace audit and email logs to investigate an admin account compromise and determine post-compromise activities.
LAB 4.3: OAuth Abuse with Third-Party Apps
In this lab, students will investigate a suspicious OAuth application and the actions performed using its granted permissions.
LAB 4.4: Google Workspace Data Exposure
In this lab, students will review exported Google Drive audit logs to identify permissions issues and suspicious activity related to corporate files and folders.
LAB 4.5: Collecting Workspace Logs in GCP via CLI
This lab is a live walkthrough for accessing the Google Cloud Platform to extract logs from Google Workspace. It involves directly collecting evidence across the internet ready for an investigator to analyze.
Topics
MODULE 4.1: Kubernetes Forensics and IR
- Kubernetes Architecture Overview
- Logs from Kubernetes
- Attacks on Kubernetes
- Sidecar Containers and Pods
MODULE 4.2: Understanding Google Workspace
- Google's Footprint and Shared Responsibility
- The History of Google Workspace
- Google Workspace Services
- Workspace Editions, Permissions, and Structure
- Google Workspace Groups and Permissions
MODULE 4.3: Google Workspace Evidence
- Workspace Admin Logs and SDK
- Collecting Logs from Workspace
- Workspace Admin Audit Logs
- Sending Workspace Logs to GCP
- Setting up Access for API Log Collection
- Collecting Logs via API
MODULE 4.4: ATT&CKing Workspace
- Attacks against Google Workspace
- Workspace Detections & Automated Alerts
- Email Compromise Investigation
  Email Log Analysis
  Google Vault Analysis
  Advanced Phishing & Malware
- Super Admin Takeover Investigations
  Workspace Audit Log Rules and Retention
  Login and User Audit Log Analysis
- Third-Party App Abuse Investigations
  What is OAuth
  OAuth Abuse with Third-Party App
  Workspace Token Logging and Containment
- Data Exposure / Leakage / Exfil Investigations
  Google Drive Investigation Tools
  Drive File Recovery
  Drive Audit and API Logging
  Takeout Data Exfil
  Takeout Audit and API Logging
  Customer Takeout Exfil
Google Cloud
Overview
Google Cloud offers many services and fundamentally changes how identity access management is treated compared to AWS and Azure, along with building in a lot of security and evidence items that are extremely useful to an incident response team. Using a combination of the GCP platform, its built-in auditing, agent-based logging, and external log analysis tools like ELK. This section will teach DFIR professionals with limited knowledge of GCP how to conduct investigations into common attacks on GCP.
Exercises
LAB 5.1: Google Cloud IAM and Access Tracking
Using the GCP Audit Logs, students will learn to profile, analyze, and summarize login sources with Kibana and GCP logs.
LAB 5.2: Collecting Logs in Google Cloud via CLI
Experience using command-line tools to directly access logs in the cloud.
LAB 5.3: Google VM Logs and Ops Agent Log Analysis
Students will learn about the logs produced by GCP's Agent Logs and how to use them for analyzing a compromised system VM within GCP.
LAB 5.4: Storage Abuse and Exfil
Students will learn about the type of logs available to track GCP Storage Bucket exfiltration, along with additional techniques to track exfiltration when additional auditing logs are not enabled.
LAB 5.5: Google Cloud: Network Forensics
Students will learn about the networking logs and data available with GCP and how to use this evidence to conduct Network Forensics for a GCP environment.
Topics
MODULE 5.1: Understanding Google Cloud
- Organizations
- GCP Resources
- GCP identity and access management (IAM)
- Challenges with IAM
- Policy Analyzer
- Org Policies
MODULE 5.2: Log Sources, Collection & Log Routing
- Google Cloud Logging
- Default Logging
- Google Cloud Log Explorer
- Log Analytics
- Log Routing and Storage
- Logging Pipelines
MODULE 5.3: VM & Storage Investigations
- Compute Overview
- VM Snapshots
- Explore Snapshots
- Google Logging Agent
- Ops Agent in Google Cloud
- Google Cloud Storage Buckets
- Bucket Permissions
- Bucket Privilege Escalation
- Bucket Object Logging
MODULE 5.4: Google Cloud Network Forensics
- GCP Network DFIR Services Overview
- GCP VPC Overview
- VPC Networking
- VPC Flow Logs
- Firewall Rules & Logging
- GCP Packet Mirroring
Multi-Cloud Intrusion Challenge

Overview
In the final section, students will split into teams to solve an intrusion that spans all three major cloud providers. Students will need to refer to all their new knowledge for the week and divide and conquer the evidence to find out how the intrusion occurred. Multiple interconnected cloud systems will be examined as students work to determine what happened.
Students will then present their findings to the class to determine which team will be deemed FOR509 Lethal Forensicators!

GIAC Cloud Forensics Responder

The GIAC Cloud Forensics Responder (GCFR) certification validates a practitioner's ability to track and respond to incidents across the three major cloud providers. GCFR-certified professionals are well-versed in the log collection and interpretation skills needed to manage rapidly changing enterprise cloud environments.

Log generation, collection, storage and retention in cloud environments
Identification of malicious and anomalous activity that affect cloud resources
Extraction of data from cloud environments for forensic investigations

More Certification Details

Prerequisites

FOR509 is an Intermediate to Advanced course that focuses on Cloud infrastructure and log analysis. This class teaches students how to make use of cloud provider created data that augments, replaces or extends the artifacts they already learned about in prior SANS classes.

Students may benefit from having taken

or having relevant previous experience.

Laptop Requirements

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

MANDATORY FOR509 SYSTEM HARDWARE REQUIREMENTS

CPU: 64-bit Intel i5/i7 (8th generation or newer), or AMD equivalent. A x64 bit, 2.0+ GHz or newer processor is mandatory for this class.
CRITICAL: Apple Silicon devices cannot perform the necessary virtualization and therefore cannot in any way be used for this course.
BIOS settings must be set to enable virtualization technology, such as "Intel-VTx" or "AMD-V" extensions. Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary.
16GB of RAM or more is required.
350GB of free storage space or more is required.
At least one available USB 3.0 Type-A port. A Type-C to Type-A adapter may be necessary for newer laptops. Some endpoint protection software prevents the use of USB devices, so test your system with a USB drive before class.
Wireless networking (802.11 standard) is required. There is no wired Internet access in the classroom.

MANDATORY FOR509 HOST CONFIGURATION AND SOFTWARE REQUIREMENTS

Your host operating system must be the latest version of Windows 10, Windows 11, or macOS 10.15.x or newer.
Fully update your host operating system prior to the class to ensure you have the right drivers and patches installed.
Linux hosts are not supported in the classroom due to their numerous variations. If you choose to use Linux as your host, you are solely responsible for configuring it to work with the course materials and/or VMs.
Local Administrator Access is required. (Yes, this is absolutely required. Don't let your IT team tell you otherwise.) If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
You should ensure that antivirus or endpoint protection software is disabled, fully removed, or that you have the administrative privileges to do so. Many of our courses require full administrative access to the operating system and these products can prevent you from accomplishing the labs.
Any filtering of egress traffic may prevent accomplishing the labs in your course. Firewalls should be disabled or you must have the administrative privileges to disable it.
Download and install VMware Workstation Pro 16.2.X+ or VMware Player 16.2.X+ (for Windows 10 hosts), VMware Workstation Pro 17.0.0+ or VMware Player 17.0.0+ (for Windows 11 hosts), or VMWare Fusion Pro 12.2+ or VMware Fusion Player 11.5+ (for macOS hosts) prior to class beginning. If you do not own a licensed copy of VMware Workstation Pro or VMware Fusion Pro, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their website. Also note that VMware Workstation Player offers fewer features than VMware Workstation Pro. For those with Windows host systems, Workstation Pro is recommended for a more seamless student experience.
On Windows hosts, VMware products might not coexist with the Hyper-V hypervisor. For the best experience, ensure VMware can boot a virtual machine. This may require disabling Hyper-V. Instructions for disabling Hyper-V, Device Guard, and Credential Guard are contained in the setup documentation that accompanies your course materials.
Download and install 7-Zip (for Windows Hosts) or Keka (for macOS hosts). These tools are also included in your downloaded course materials.

Your course media is delivered via download. The media files for class can be large. Many are in the 40-50GB range, with some over 100GB. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as soon as you get the link. You will need your course media immediately on the first day of class. Do not wait until the night before class to start downloading these files.

Your course materials include a "Setup Instructions" document that details important steps you must take before you travel to a live class event or start an online class. It may take 30 minutes or more to complete these instructions.

Your class uses an electronic workbook for its lab instructions. In this new environment, a second monitor and/or a tablet device can be useful for keeping class materials visible while you are working on your course's labs.

If you have additional questions about the laptop specifications, please contact support.

Author Statement

"Many DFIR professionals have dismissed the cloud as 'someone else's computer' missing the wealth of new evidence sources and possibilities that now exist. From audit logs that attackers can't clear without full tenant compromise to the ability to turn on Netflow data with a single line of code/click and no additional hardware needed the cloud offers a world of new possibilities to those DFIR professionals who embrace what the cloud brings to them.

FOR509 was written to give you a headstart in understanding, analyzing and solving cloud-based investigations. Not only do we cover the most popular cloud solutions on the market we also help the student to understand now just how to interpret the data but how they can take their detection and response capabilities to the next level. Cloud automation, flexible infrastructure on demand and entire processing clusters on standby mean you can make your enterprise ready for an event at any scale. We've dealt with some of the biggest breaches in some of the biggest networks and we'll show students how they can be ready to do the same in the cloud."

- David Cowen

"Just as we got better at defending our on-premise environment, the shiny new object called the "cloud" has radically changed our battlefield. Corporations are moving their systems and data to the cloud at breakneck speed, leaving us as their defenders scrambling for new playbooks and know-how to keep them safe. Lacking direct access to the physical systems means that many traditional forensic methods no longer work. The good news is that we now have cloud specific tools and logs that empowers us to respond to incidents faster and better. FOR509 will examine these tools and techniques to take your skills to the cloud level."

- Pierre Lidome

"Organizations are rapidly moving to cloud environments and this trend is only going to continue. Unfortunately, the incident responders and digital forensics professionals who previously worked in traditional, on-premise environments are left to get up to speed on these new technologies. FOR509 provides defenders and responders with the knowledge and skills needed to continue defending their organizations against threats even in this new environment. Learning how to obtain, analyze, and interpret cloud evidence is pivotal to ensuring DFIR professionals are equipped for this rapid cloud migration."

- Megan Roddie

"As organizations rush to find quicker and more flexible ways to build their IT infrastructure and online applications, they leave behind their on-premises infrastructure and the visibility their incident response and digital forensics teams have built over many years. On top of this, new Cloud features and services are being introduced at a rapid pace making it challenging for incident response professions to know what evidence they have available in the event of a cybersecurity incident. The FOR509 class will give both incident response and digital forensics professionals the knowledge and skills they need to know what evidence is available to them, how they can obtain and interpret evidence for the three commonly used IaaS Clouds and common SaaS Clouds. If you or your organization work with Cloud infrastructure, then this class is "a must" to get an advantage over threat actors!"

- Josh Lemon

Ways to Learn

OnDemand

Cybersecurity learning – at YOUR pace! OnDemand provides unlimited access to your training wherever, whenever. All labs, exercises, and live support from SANS subject matter experts included.

Live Online

The full SANS experience live at home! Get the ultimate in virtual, interactive SANS courses with leading SANS instructors via live stream. Following class, plan to kick back and enjoy a keynote from the couch.

View Available Dates & Time Zones

In Person (6 days)

Did someone say ALL-ACCESS? On-site immersion via in-classroom course sessions led by world-class SANS instructors fill your day, while bonus receptions and workshops fill your evenings.

View Available Dates & Locations

Who Should Attend FOR509?

Incident Response Team Members who may need to response to security incidents/intrusions impacting cloud hosted software, infrastructure or platforms and need to know how to detect, investigate, remediate, and recover from compromised systems across the enterprise cloud.

Threat Hunters who are seeking to understand threats more fully and how to learn from them in order to more effectively hunt threats and counter their tradecraft.

SOC Analysts looking to better understand alerts, build the skills necessary to triage events, and fully leverage cloud log sources.

Experienced Digital Forensic Analysts who want to consolidate and enhance their understanding of cloud-based forensics.

Information Security Professionals who directly support and aid in responding to data breach incidents and intrusions.

Federal Agents and Law Enforcement Professionals who want to master advanced intrusion investigations and incident response, and expand their investigative skills beyond traditional host-based digital forensics.

SANS FOR500, FOR508, SEC541, and SEC504 Graduates looking to add cloud-based forensics to their toolbox.

NICE Framework Work Roles:

Cyber Defense Incident Responder (OPM 531)

Cyber Crime Investigator(OPM 221)

Law Enforcement /CounterIntelligence Forensics Analyst ( OPM 211)

Cyber Defense Forensics Analyst (OPM 212)

See prerequisites

Need to justify a training request to your manager?

Use this justification letter template to share the key details of this training and certification opportunity with your boss.

Download the Letter

FOR509: Enterprise Cloud Forensics and Incident Response™

GIAC Cloud Forensics Responder (GCFR)

Course Authors:

David Cowen

Pierre Lidome

Josh Lemon

Megan Roddie-Fonseca

What You Will Learn

Find the Storm in the Cloud

FOR509: Enterprise Cloud Forensics and Incident Response will help you

FOR509 Enterprise Cloud Forensics Will Prepare Your Team To

FOR509 Enterprise Cloud Forensics Course Topics

Business Takeaways

What You Will Receive

What To Take Next

Syllabus (36 CPEs)

Microsoft 365 and Graph API

Overview

Exercises

Topics

Microsoft Azure

Overview

Exercises

Topics

Amazon (AWS)

Overview

Exercises

Topics

Google Workspace

Overview

Exercises

Topics

Google Cloud

Overview

Exercises

Topics

Multi-Cloud Intrusion Challenge

Overview

GIAC Cloud Forensics Responder

Prerequisites

Laptop Requirements

MANDATORY FOR509 SYSTEM HARDWARE REQUIREMENTS

MANDATORY FOR509 HOST CONFIGURATION AND SOFTWARE REQUIREMENTS

Author Statement

Ways to Learn

Who Should Attend FOR509?

Need to justify a training request to your manager?

Reviews

Filters:

Register for FOR509

Loading...