GNFA prep
Advanced
Network Forensics & Analysis
Investigate attacks using packet captures, flow data and network logs, and prepare for the GIAC GNFA exam.
Fees on request
Details
← All courses
Advanced
Cloud Forensics & Incident Response
Investigate incidents in cloud and SaaS environments using provider logs, and prepare for the GIAC GCFR exam.
This course prepares you for the GIAC GCFR exam objectives. iSecRadar is not affiliated with, sponsored by or endorsed by GIAC or the SANS Institute. GCFR is a certification of GIAC, and exam registration is completed directly with GIAC.
About the Cloud Forensics & Incident Response course
Cloud Forensics & Incident Response teaches you to investigate attacks in cloud and SaaS environments, where there may be no disk to image and evidence lives in provider logs. You learn which logs matter, how to collect them before they expire, and how to trace attacker activity through identities and APIs.
The course follows the GIAC Cloud Forensics Responder (GCFR) exam objectives and covers investigations across major cloud providers and productivity platforms.
Who this course is for
- Incident responders handling cloud incidents
- Cloud security and platform engineers
- Forensic analysts expanding beyond on-premises systems
- Graduates of Cloud Security Essentials
Prerequisites
- Working knowledge of at least one major cloud platform
- Incident response or forensic fundamentals
- Cloud Security Essentials recommended
What you'll learn
- Identify and collect evidence from cloud and SaaS platforms
- Investigate identity, API and audit log activity
- Respond to compromised cloud accounts and workloads
- Prepare for the GCFR exam objectives
Syllabus
- Cloud incident response challenges and shared responsibility
- Cloud audit, identity and API logs
- Investigating compromised accounts and access keys
- Cloud workload and storage investigations
- Microsoft 365 and SaaS investigations
- Exam objectives review
Hands-on labs and exercises
- Enable and collect cloud audit logs for an investigation
- Trace a compromised account through identity logs
- Investigate access-key abuse and API activity
- Review storage access and data exposure
- Write a cloud incident findings report
Where this course takes you
- Cloud incident responder and cloud forensic analyst roles
- Cloud security operations responsibilities
- Extends DFIR skills to hybrid environments
Included
- Live sessions with session recordings
- Guided lab environment
- Certificate of completion
- Community and instructor Q&A
Cloud Forensics & Incident Response: frequently asked questions
What is the GCFR certification?
GCFR (GIAC Cloud Forensics Responder) is a GIAC certification focused on incident response and forensic investigation in cloud environments.
Is this an official GIAC or SANS course?
No. iSecRadar is not affiliated with GIAC or SANS. The course is independent training aligned with the published GCFR exam objectives.
How is cloud forensics different from traditional forensics?
Cloud investigations rely mainly on provider logs and APIs rather than disk images, and evidence can expire quickly, so collection must be planned in advance.
Keep learning
Recommended next courses
GCFA prep
Advanced
Advanced Incident Response & Threat Hunting
Investigate enterprise intrusions with memory forensics, timelines and threat hunting, and prepare for the GIAC GCFA exam.
Fees on request
Details