GEIR prep
Advanced
Enterprise Incident Response at Scale
Lead incident response and threat hunting across large, hybrid environments, and prepare for the GIAC GEIR exam.
Fees on request
Details
← All courses
Advanced
Advanced Incident Response & Threat Hunting
Investigate enterprise intrusions with memory forensics, timelines and threat hunting, and prepare for the GIAC GCFA exam.
This course prepares you for the GIAC GCFA exam objectives. iSecRadar is not affiliated with, sponsored by or endorsed by GIAC or the SANS Institute. GCFA is a certification of GIAC, and exam registration is completed directly with GIAC.
About the Advanced Incident Response & Threat Hunting course
Advanced Incident Response & Threat Hunting prepares you to investigate sophisticated intrusions across an enterprise. You learn to find attackers who use legitimate tools and credentials, analyze memory for hidden malware, and reconstruct an attack from initial access to data theft.
The course follows the GIAC Certified Forensic Analyst (GCFA) exam objectives and ends with a capstone in which you investigate a full intrusion scenario and present your findings.
Who this course is for
- Experienced incident responders and forensic analysts
- Threat hunters and senior SOC analysts
- Security engineers who lead breach investigations
- Graduates of Windows Forensic Analysis
Prerequisites
- Windows forensics experience or Windows Forensic Analysis (GCFE)
- Understanding of incident handling and attacker techniques
- Comfort with the command line and log analysis
What you'll learn
- Scope and investigate intrusions across multiple systems
- Analyze memory to find malware, injection and persistence
- Build super-timelines to reconstruct attacker activity
- Prepare for the GCFA exam objectives
Syllabus
- Enterprise incident response and threat hunting methodology
- Attacker persistence and lateral movement artifacts
- Memory acquisition and analysis
- Timeline and super-timeline analysis
- Anti-forensics detection and file system deep dive
- Intrusion investigation capstone and exam objectives review
Hands-on labs and exercises
- Hunt for lateral movement and credential abuse across hosts
- Analyze memory images for injected code and rootkits
- Build and filter a super-timeline of an intrusion
- Detect anti-forensics and timestamp manipulation
- Capstone: investigate and report a multi-stage intrusion
Where this course takes you
- Senior incident responder and forensic analyst roles
- Threat hunting and compromise assessment work
- Path to DFIR team lead positions
Included
- Live sessions with session recordings
- Guided lab environment
- Certificate of completion
- Community and instructor Q&A
Advanced Incident Response & Threat Hunting: frequently asked questions
What is the GCFA certification?
GCFA (GIAC Certified Forensic Analyst) is a GIAC certification for professionals who conduct formal incident investigations, including advanced intrusions, memory forensics and threat hunting.
Is this an official GIAC or SANS course?
No. iSecRadar is not affiliated with GIAC or SANS. The course is independent training aligned with the published GCFA exam objectives.
Do I need GCFE before GCFA?
It is not required, but Windows forensic skills are expected. Learners without that background should take Windows Forensic Analysis first.
Keep learning
Recommended next courses
GNFA prep
Advanced
Network Forensics & Analysis
Investigate attacks using packet captures, flow data and network logs, and prepare for the GIAC GNFA exam.
Fees on request
Details