GCFR prep
Advanced
Cloud Forensics & Incident Response
Investigate incidents in cloud and SaaS environments using provider logs, and prepare for the GIAC GCFR exam.
Fees on request
Details
← All courses
Advanced
Network Forensics & Analysis
Investigate attacks using packet captures, flow data and network logs, and prepare for the GIAC GNFA exam.
This course prepares you for the GIAC GNFA exam objectives. iSecRadar is not affiliated with, sponsored by or endorsed by GIAC or the SANS Institute. GNFA is a certification of GIAC, and exam registration is completed directly with GIAC.
About the Network Forensics & Analysis course
Network Forensics & Analysis teaches you to investigate incidents using network evidence. When endpoint data is missing or incomplete, network traffic and logs often show how attackers entered, which systems they reached and what data left the environment.
The course follows the GIAC Network Forensic Analyst (GNFA) exam objectives and uses widely available analysis tools so the skills transfer to any environment.
Who this course is for
- Incident responders and forensic analysts
- Network security engineers and SOC analysts
- Threat hunters who work with network telemetry
- Graduates of Network Security & Defense who want to specialize
Prerequisites
- Solid TCP/IP and protocol knowledge
- Network Security & Defense or equivalent experience
- Basic incident response knowledge
What you'll learn
- Analyze packet captures and NetFlow to trace attacker activity
- Investigate DNS, HTTP, TLS and other protocol evidence
- Correlate firewall, proxy and network device logs
- Prepare for the GNFA exam objectives
Syllabus
- Network evidence sources and collection
- Packet analysis and protocol reconstruction
- NetFlow and connection log analysis
- DNS, web proxy and TLS investigations
- Command-and-control and exfiltration detection
- Investigation capstone and exam objectives review
Hands-on labs and exercises
- Reconstruct sessions and files from packet captures
- Trace an intrusion using NetFlow and connection logs
- Investigate suspicious DNS and web proxy activity
- Identify command-and-control and data exfiltration
- Capstone: network-based intrusion investigation
Where this course takes you
- Network forensic analyst and incident responder roles
- Threat hunting with network telemetry
- Strengthens SOC and detection engineering work
Included
- Live sessions with session recordings
- Guided lab environment
- Certificate of completion
- Community and instructor Q&A
Network Forensics & Analysis: frequently asked questions
What is the GNFA certification?
GNFA (GIAC Network Forensic Analyst) is a GIAC certification focused on network forensics, including analysis of traffic, flow data and network logs during investigations.
Is this an official GIAC or SANS course?
No. iSecRadar is not affiliated with GIAC or SANS. The course is independent training aligned with the published GNFA exam objectives.
Do I need full packet capture in my environment?
No. The course also covers flow data and device logs, which many organizations collect even without full packet capture.
Keep learning
Recommended next courses
GCFA prep
Advanced
Advanced Incident Response & Threat Hunting
Investigate enterprise intrusions with memory forensics, timelines and threat hunting, and prepare for the GIAC GCFA exam.
Fees on request
Details