FOR563: Applied AI for Digital Forensics and Incident Response: Leveraging Local Large Language Models

Important! Bring your own system configured according to these instructions.

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will not be able to fully participate in hands-on exercises in your course. Therefore, please arrive with a system meeting all of the specified requirements.

Back up your system before class. Better yet, use a system without any sensitive/critical data. SANS is not responsible for your system or data.

Mandatory FOR563 System Hardware Requirements

• Students must have a laptop, not a tablet

Mandatory FOR563 Host Configuration and Software Requirements

• Please have Chrome installed prior to class
• Must have admin rights

FOR563 training is recommended for a diverse range of individuals, including:

• Digital Forensics and Incident Response (DFIR) professionals
• Security analysts and forensic examiners
• Threat hunters and detection engineers
• Investigators interested in AI and data automation
• Cybersecurity researchers and lab developers
• Security professionals wanting to explore LLM use cases

• Downloadable course materials, including Jupyter notebooks used in the labs
• Access to hands-on, GPU-powered cloud lab environments with free account credits (no high-end hardware required)
• A curated set of DFIR-focused data examples and code templates for applying LLMs to real-world scenarios
• Continued access to lab notebooks and lab environment after the course for further experimentation and practice
• Fully explained walkthroughs of code used in each lab—designed to be modifiable and reusable
• Guidance and resources for getting started with fine-tuning models using your own datasets

There are no formal prerequisites for FOR563, and the course is designed to be accessible to a wide range of DFIR and security professionals. Prior experience in digital forensics or incident response is not required. While some comfort with reading simple Python code and basic command-line usage can be helpful, many of the tools used in the course offer intuitive graphical interfaces, and all code examples are well-explained and beginner-friendly. The techniques taught are broadly applicable across DFIR, threat hunting, cybersecurity automation, and other domains involving structured data analysis.

• Digital Forensics Practitioner or Incident Responder:
• FOR500: Windows Forensic Analysis
• FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
• FOR528: Ransomware and Cyber Extortion
• AI/ML Security Specialist:
• SEC495: Leveraging LLMs: Building & Securing RAG, Contextual RAG, and Agentic RAG
• SEC535: Offensive AI - Attack Tools and Techniques
• SEC545: GenAI and LLM Application Security
• SEC595: Applied Data Science and Machine Learning for Cybersecurity Professionals
• SEC598: AI and Security Automation for Red, Blue, and Purple Teams

Local Large Language Models (LLMs) are important in cybersecurity because they enable organizations to leverage AI capabilities such as threat detection, log analysis, and automation, while maintaining full control over sensitive data. Unlike public LLMs, local deployments keep information private, align with regulatory frameworks (like NIST CSF and NERC CIP), and reduce risk by eliminating exposure to third-party APIs.

This course addresses challenges like context limitations and model fine-tuning through four technical labs, empowering students to automate investigations and tailor AI tools without compromising sensitive data. FOR563 bridges the gap between cutting-edge AI and secure forensic workflows, giving teams the confidence to integrate AI into their operations, privately and effectively.

In a time where cybersecurity teams are increasingly exploring AI to improve investigation speed and accuracy, FOR563 positions you at the forefront of this transformation. This one-day, hands-on course is tailored specifically for DFIR professionals who want to integrate Artificial Intelligence into their workflows without exposing sensitive data to third-party platforms. By focusing on LLMs, FOR563 teaches you how to securely harness the power of AI to automate, accelerate, and scale your forensic and incident response capabilities. These skills are not only highly relevant but also immediately applicable, making you a more agile and impactful analyst in a rapidly evolving threat landscape.

Through this course, you'll learn to:

• How to deploy private, self-hosted LLMs to maintain full control over sensitive forensic data
• Configuration and setup of local AI environments for real-world DFIR tasks
• Building custom forensic agents to automate investigative workflows using natural language
• Analyzing logs, forensic artifacts, and databases—including those with proprietary or undocumented formats—using LLMs
• Fine-tuning and optimizing LLMs for specialized use cases in digital forensics and incident response
• Navigating practical challenges like context limitations and inference accuracy through hands-on labs
• Extending skills to cloud or API-based LLMs, enabling flexibility across different environments and organizational needs
• Accelerating investigations and automating repetitive tasks without compromising privacy or compliance