SANS DFIR Stay Sharp series are 2-to-3-day courses that teach specialized topics which also follow the core concepts covered in SANS Digital Forensics and Incident Response 6-day courses. The instructional material in each Stay Sharp course has been carefully selected by SANS DFIR Curriculum authors to help students learn or sharpen a specific technical knowledge or skill in a more targeted, faster learning setting without sacrificing teaching quality or course in-depth technical content.
Here is what you can expect when you take a SANS DFIR Stay Sharp course:
- Instructor-led training taught by the world’s leading DFIR professionals.
- Quality training with less time away from work and home responsibilities
- Targeted short courses to help you build specific skills that you can apply the same week you take your course
- Virtual, livestream training delivered Live Online.
AVAILABLE DFIR STAY SHARP COURSES
FOR498A teaches the latest tools, digital container access techniques, and enterprise methodologies to identify, access, and preserve evidence across a vast range of devices, repositories, and non-traditional storage areas. Learn how to extract actionable intelligence in 90 minutes or less. LEARN MORE
JOB ROLES: Federal Agents and Law Enforcement Personnel, First Responders, Digital Forensic Analysts, Information Security Professionals, Incident Responders, Media Exploitation Analysts, Department of Defense and Intelligence Community Professionals, and anyone interested in an understanding of the proper preservation of systems
ASSOCIATED 6-DAY COURSE: FOR498: Battlefield Forensics & Data Acquisition
FOR572A teaches the three primary sources of network-based evidence: full packet capture, NetFlow, and logs. Whether used together or separately, or in conjunction with host-based evidence or alone, these sources can provide critical insight into the actions attackers have taken or continue to take in their victims’ environment. LEARN MORE
JOB ROLES: Incident Responders, Threat Hunters, Security Operations Center (SOC) personnel, Law Enforcement officers, Federal agents, Detectives, Network Defenders, Information Security Managers, Network engineers, IT Professionals, and anyone interested in computer network intrusions and investigations
ASSOCIATED 6-DAY COURSE: FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response
FOR585A teaches the proper handling and parsing skills needed to bypass locked iOS devices and correctly interpret the data. It delves into the iOS file system and discusses common areas containing files of evidentiary value. This course will prepare you to deal with the iOS device that will likely be a major component in a forensic investigation. LEARN MORE
JOB ROLES: Experienced Digital Forensic Examiners, Media Exploitation Analysts, Information Security Professionals, Incident Response Teams, Law Enforcement Officers, Federal Agents, Detectives, Accident Reconstruction Investigators, and IT auditors
ASSOCIATED 6-DAY COURSE: FOR585: Smartphone Forensic Analysis In-Depth
FOR610A supercharges your incident response and forensics skills by teaching you how to use key malware analysis tools and techniques. This practical, hands-on course builds upon your existing network, system and InfoSec skills and teaches you how to turn Windows and related malware inside out. LEARN MORE
JOB ROLES: Malware Analysts, Incident Responders, Forensic Investigators, Information Security Professionals, Threat Intelligence Professionals, and Threat Hunters
ASSOCIATED 6-DAY COURSE: FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques
- What are Stay Sharp courses?
SANS DFIR Stay Sharp are 2- to 3-day courses that teach specialized topics and also parallel the core concepts covered in SANS Digital Forensics and Incident Response 6-day courses.
- How much do they cost?
2-Day courses cost $2,900 and 3-Day courses cost $4,350.
- Why were they developed?
The material in each DFIR Stay Sharp course has been carefully selected by SANS course authors to help students learn or sharpen a specific technical knowledge or skill. They have been built to expedite skill development without sacrificing quality or course in-depth technical content.
- What is the difference between DFIR Stay Sharp courses and regular long courses such as DFIR
5-day and 6-day courses?
Stay Sharp courses are shorter courses that target different skills within the 5-day or 6-day (long courses). The Stay Sharp material was selected from each Stay Sharp associated course (long courses) to sharpen your knowledge on a specific topic. The Stay Sharp courses are not an exact excerpt from the associated long course – authors’ re-arranged material, created specialized labs and may address different topics in the Stay Sharp course. The 5-day or 6-day associated long courses will always provide a more comprehensive approach to a course topic.
- What are DFIR Stay Sharp “associated courses”?
DFIR Stay Sharp associated courses are the 5-day or 6-day long courses from where Stay Sharp topics originate.
- Do these courses have the same course author as the associated courses?
Yes, these courses were developed by SANS authors. Also, the “foundation” of the material upon which we built the Stay Sharp courses stemmed from their respective associated long courses to help you develop a specific skill. This ensures you get the same technical depth and course quality.
- Should/could I attempt a GIAC certification after I take a Stay Sharp course?
In order to be fully prepared to take the GIAC certification associated with a 5-Day or 6-Day course, we recommend that you take the full 5-Day or 6-Day course. However, students may always attempt any GIAC exam without SANS training by following the guidelines here
Please note: The Affiliate Pricing for GIAC Certification Attempts purchased with SANS training (“Bundled Rate”) and Affiliate Pricing for GIAC Certification Attempts purchased after SANS training (“Alumni Rate”) are NOT offered / combinable with DFIR Stay Sharp courses.
- I previously completed a DFIR Stay Sharp course. If I want to come back and take the associated
long course, is there an incentive?
Yes, alumni of a DFIR Stay Sharp course will receive “alumni credit” toward the associated long course. Please note: Course numbers must match — this is a hard “alumni credit” requirement. How and when can I take these courses? DFIR Stay Sharp courses are currently available Live Online and are scheduled throughout the year at specific events.
For more information about all available SANS Stay Sharp courses visit here