Advance your DFIR skills on your own schedule and at your own pace
DFIR NetWars Continuous is an incident simulator packed with a vast amount of forensic, malware analysis, threat hunting, and incident response challenges designed to help you gain proficiency without the risk associated with working on real-life incidents. It delivers the same interactive learning program as DFIR NetWars but is fully executed online over a four-month period. The program also delivers twice as many CPE credits (12) as a live DFIR NetWars Tournament (6), and the cost of participation is less than a standard SANS course.
DFIR NetWars Continuous enables you to:
- Learn anytime, anywhere: Over the course of four months and four levels, you will progress through multiple skill levels of increasing difficulty, learning first-hand how to solve key challenges at your own pace, and from wherever you might be.
- Test your skills with more in-depth challenges: NetWars Continuous offers a completely separate set of challenges from the DFIR NetWars Tournament. Although it is organized into the same four levels, there are more in-depth challenges in DFIR NetWars Continuous given its four-month timespan.
- Learn in a fun, interactive environment: Sharpen new skills with fun "game-like" scenarios. Each of these scenarios teaches you to apply the right skill at the right time, and under the right conditions to accurately solve critical challenges.
- Build your skills regardless of your level of expertise: Anybody can play! No matter if you are new to the field or a seasoned forensicator or threat hunter, DFIR NetWars Continuous features different levels to help you improve your skill set or show you where you might need improvement.
- Take hints to develop your skills faster: An innovated Automated Hint System helps you identify the most efficient way to solve challenges or determine when you've found an even better way to solve them. Requesting a hint does not impact your score, but the number of hints you have taken will be displayed as a separate column on the scoreboard.
- Free yourself from the limitations of tools: It is not the tool that makes a good forensicator, but rather the forensicator's ability to apply the tool or technique at the right time and under the right conditions to accurately solve critical challenges. Each level of NetWars Continuous is designed not only to challenge your capabilities to solve a particular problem, but to teach you proper analysis techniques regardless of the tool you use.
- Evaluate and show your performance: Walk away with confidence in your abilities and a scorecard that illustrates the areas where you have demonstrated deep skills and knowledge.
- Apply what you learn immediately: Master real-world tactics and techniques that can be applied to real-life cases as soon as you learn them.
DFIR NetWars Continuous Levels
Who Should Attend
|Digital Forensic Analysts|
|Security Operations Center (SOC) Personnel|
|Law Enforcement Officers, Federal Agents, and Detectives|
|Cyber Crime Investigators|
Mandatory NetWars Host Configuration and Software Requirements
Host Operating System
|Latest version of Windows 10 or macOS 10.15.x|
|Windows Hosts||On Windows hosts, VMware products cannot coexist with the Hyper-V hypervisor. Disable Hyper-V and ensure VMware can boot a virtual machine. Disabling Hyper-V, Device Guard, and Credential Guard can be accomplished using these instructions.|
|OS Updates||Please note that it is necessary to fully update your host operating system prior to the class to ensure you have the right drivers and patches installed to utilize the latest USB 3.0 devices.|
|Linux||Linux hosts cannot be supported in the classroom due to their numerous variations. Students that wish to use Linux hosts must be experienced users or administrators, and must also be able to access ExFAT partitions using the appropriate kernel and/or FUSE modules.|
Mandatory NetWars System Hardware Requirements
|CPU||64-bit Intel i5/i7 (4th generation+) - x64 bit 2.0+ GHz processor or more recent processor is mandatory for this class (Important - Please Read: a 64-bit system processor is mandatory)|
|OS||It is critical that your CPU and operating system support 64-bit so that our 64-bit guest virtual machine will run on your laptop. VMware provides a free tool for Windows that will detect whether or not your host supports 64-bit guest virtual machines. For further troubleshooting, this article also provides good instructions for Windows users to determine more about the CPU and OS capabilities. For Macs, please use this support page from Apple to determine 64-bit capability.|
|BIOS||BIOS settings must be set to enable virtualization technology, such as "Intel-VTx". Be absolutely certain you can access your BIOS if it is password protected, in case changes are necessary. Test it!|
16 GB (Gigabytes) of RAM or higher is mandatory for this class (Important - Please Read: 16 GB of RAM or higher of RAM is mandatory and minimum.)
|USB||USB 3.0 Type-A port is required. At least one open and working USB 3.0 Type-A port is required. (A Type-C to Type-A adapter may be necessary for newer laptops.) (Note: Some endpoint protection software prevents the use of USB devices - test your system with a USB drive before class to ensure you can load the course data.)|
|STORAGE||200 Gigabytes of Free Space on your System Hard Drive - Free Space on Hard Drive is critical to host the VMs and data sets we distribute|
|PERMISSIONS||Local Administrator Access is required. This is absolutely required. Don't let your IT team tell you otherwise. If your company will not permit this access for the duration of the course, then you should make arrangements to bring a different laptop.|
|WIFI||Wireless 802.11 Capability - there are no wired networks in the classroom.|