DFIR NetWars Continuous

Solve unique, in-depth challenges through interactive case scenarios designed to help you gradually build your DFIR skillset, right from home.

Advance your DFIR skills on your own schedule and at your own pace

DFIR NetWars Continuous is an incident simulator packed with a vast amount of forensic, malware analysis, threat hunting, and incident response challenges designed to help you gain proficiency without the risk associated with working on real-life incidents. It delivers the same interactive learning program as DFIR NetWars but is fully executed online over a four-month period. The program also delivers twice as many CPE credits (12) as a live DFIR NetWars Tournament (6), and the cost of participation is less than a standard SANS course.

Topics Include:

Digital Forensics
Incident Response
Threat Hunting
Malware Analysis
Endpoint Forensics
Network Forensics
Memory Analysis

DFIR NetWars Continuous enables you to:

    • Learn anytime, anywhere: Over the course of four months and four levels, you will progress through multiple skill levels of increasing difficulty, learning first-hand how to solve key challenges at your own pace, and from wherever you might be.
    • Test your skills with more in-depth challenges: NetWars Continuous offers a completely separate set of challenges from the DFIR NetWars Tournament. Although it is organized into the same four levels, there are more in-depth challenges in DFIR NetWars Continuous given its four-month timespan.
    • Learn in a fun, interactive environment: Sharpen new skills with fun "game-like" scenarios. Each of these scenarios teaches you to apply the right skill at the right time, and under the right conditions to accurately solve critical challenges.
    • Build your skills regardless of your level of expertise: Anybody can play! No matter if you are new to the field or a seasoned forensicator or threat hunter, DFIR NetWars Continuous features different levels to help you improve your skill set or show you where you might need improvement.
    • Take hints to develop your skills faster: An innovated Automated Hint System helps you identify the most efficient way to solve challenges or determine when you've found an even better way to solve them. Requesting a hint does not impact your score, but the number of hints you have taken will be displayed as a separate column on the scoreboard.
    • Free yourself from the limitations of tools: It is not the tool that makes a good forensicator, but rather the forensicator's ability to apply the tool or technique at the right time and under the right conditions to accurately solve critical challenges. Each level of NetWars Continuous is designed not only to challenge your capabilities to solve a particular problem, but to teach you proper analysis techniques regardless of the tool you use.
    • Evaluate and show your performance: Walk away with confidence in your abilities and a scorecard that illustrates the areas where you have demonstrated deep skills and knowledge.
    • Apply what you learn immediately: Master real-world tactics and techniques that can be applied to real-life cases as soon as you learn them.

DFIR NetWars Continuous Levels

DFIR Netwars Continuous includes multiple levels to help you improve your skills as well as automated hints and support from the SANS NetWars team to ensure that you have the most rewarding experience possible.

Who Should Attend

Digital Forensic Analysts
Forensic Examiners
Malware Analysts
Incident Responders
Threat Hunters
Security Operations Center (SOC) Personnel
Law Enforcement Officers, Federal Agents, and Detectives
Cyber Crime Investigators

Laptop Requirements

Mandatory NetWars Host Configuration and Software Requirements

Host Operating System

Latest version of Windows 10 or macOS 10.15.x
Windows HostsOn Windows hosts, VMware products cannot coexist with the Hyper-V hypervisor. Disable Hyper-V and ensure VMware can boot a virtual machine. Disabling Hyper-V, Device Guard, and Credential Guard can be accomplished using these instructions.
OS UpdatesPlease note that it is necessary to fully update your host operating system prior to the class to ensure you have the right drivers and patches installed to utilize the latest USB 3.0 devices.
LinuxLinux hosts cannot be supported in the classroom due to their numerous variations. Students that wish to use Linux hosts must be experienced users or administrators, and must also be able to access ExFAT partitions using the appropriate kernel and/or FUSE modules.

Mandatory NetWars System Hardware Requirements
CPU64-bit Intel i5/i7 (4th generation+) - x64 bit 2.0+ GHz processor or more recent processor is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)
OSIt is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop. VMware provides a free tool for Windows that will detect whether or not your host supports 64-bit guest virtual machines. For further troubleshooting, this article also provides good instructions for Windows users to determine more about the CPU and OS capabilities. For Macs, please use this support page from Apple to determine 64-bit capability.
BIOSBIOS settings must be set to enable virtualization technology, such as "Intel-VTx". Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary. Test it!

16 GB (Gigabytes) of RAM or higher is mandatory for this class (Important - Please Read: 16 GB of RAM or higher of RAM is mandatory and minimum.)

USBUSB 3.0 Type-A port is required. At least one open and working USB 3.0 Type-A port is required. (A Type-C to Type-A adapter may be necessary for newer laptops.) (Note: Some endpoint protection software prevents the use of USB devices - test your system with a USB drive before class to ensure you can load the course data.)
STORAGE200 Gigabytes of Free Space on your System Hard Drive - Free Space on Hard Drive is critical to host the VMs and data sets we distribute
PERMISSIONS    Local Administrator Access is required. This is absolutely required. Don't let your IT team tell you otherwise. If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.
WIFIWireless 802.11 Capability - there are no wired networks in the classroom.


Having participated in NetWars Continuous and in the NetWars Tournament, I can honestly say that they were the most intellectually challenging and enjoyable tests of technical skills in which I have participated.
Kees Leune
- Adelphi University
Had a great four months with NetWars Continuous. Thanks for the great learning environment.
Jason Mull
- General Informatics
NetWars is challenging for all levels of expertise, has great hints if you get stuck, and promotes continuous education.
Jon-Michael Lacek
- Wegmans Food Market