GCFR prep
Advanced
Cloud Forensics & Incident Response
Investigate incidents in cloud and SaaS environments using provider logs, and prepare for the GIAC GCFR exam.
Fees on request
Details
← All courses
Advanced
Enterprise Incident Response at Scale
Lead incident response and threat hunting across large, hybrid environments, and prepare for the GIAC GEIR exam.
This course prepares you for the GIAC GEIR exam objectives. iSecRadar is not affiliated with, sponsored by or endorsed by GIAC or the SANS Institute. GEIR is a certification of GIAC, and exam registration is completed directly with GIAC.
About the Enterprise Incident Response at Scale course
Enterprise Incident Response at Scale prepares you to lead investigations when an incident spans hundreds or thousands of systems. You learn to collect and triage evidence remotely, centralize and correlate data, hunt for attacker activity across mixed operating systems and cloud services, and coordinate containment without disrupting the business.
The course follows the GIAC Enterprise Incident Response (GEIR) exam objectives and builds on host forensic skills, so it is the capstone of the DFIR learning path.
Who this course is for
- Incident response leads and senior responders
- DFIR consultants and threat hunters
- SOC managers who coordinate major incidents
- Graduates of Advanced Incident Response & Threat Hunting
Prerequisites
- Incident response and host forensics experience
- Advanced Incident Response & Threat Hunting (GCFA) or equivalent recommended
- Familiarity with Windows, Linux and cloud environments
What you'll learn
- Plan and coordinate incident response across thousands of endpoints
- Collect and triage evidence at scale with remote collection tools
- Hunt for attacker activity across Windows, Linux, macOS and cloud
- Prepare for the GEIR exam objectives
Syllabus
- Enterprise incident response planning and coordination
- Scalable evidence collection and triage
- Centralized log analysis and enterprise timelines
- Threat hunting across Windows, Linux and macOS
- Cloud, identity and container investigations
- Containment at scale, reporting and exam objectives review
Hands-on labs and exercises
- Deploy remote collection and triage across a lab enterprise
- Aggregate and search evidence from many hosts
- Build an enterprise-wide timeline of an intrusion
- Hunt for persistence and lateral movement across operating systems
- Plan and document coordinated containment and recovery
Where this course takes you
- Incident response lead and DFIR consultant roles
- Threat hunting and compromise assessment at scale
- Path to managing incident response teams and major incidents
Included
- Live sessions with session recordings
- Guided lab environment
- Certificate of completion
- Community and instructor Q&A
Enterprise Incident Response at Scale: frequently asked questions
What is the GEIR certification?
GEIR (GIAC Enterprise Incident Response) is a GIAC certification focused on incident response and threat hunting across large enterprise environments, including scalable collection, analysis and coordination.
Is this an official GIAC or SANS course?
No. iSecRadar is not affiliated with GIAC or SANS. The course is independent training aligned with the published GEIR exam objectives.
How is GEIR preparation different from GCFA preparation?
Advanced Incident Response & Threat Hunting (GCFA) focuses on deep investigation of individual systems. Enterprise Incident Response at Scale (GEIR) focuses on running investigations and hunts across an entire organization.
Keep learning
Recommended next courses
GREM prep
Advanced
Reverse-Engineering Malware
Analyze malicious software with behavioral and code analysis techniques, and prepare for the GIAC GREM exam.
Fees on request
Details