Training
Featured CourseView All Courses
Get a free hour of SANS training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
Cloud Security Training
Can't find what you are looking for?

Let us help.

Contact us
Community Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely.

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Talk With an Expert
Talk With an Expert

State of New Jersey ICS515 | September 2025

Online Monday, Sep 8 – Saturday, Sep 13, 2025

Register Now
Jump to:

Welcome to ICS515: ICS Visibility, Detection, and Response

Instructor: TBD | 36 CPEs Associated Certification: GIAC Response and Industrial Defense (GRID)

ICS515: ICS Visibility, Detection, and Response will help you gain visibility and asset identification in your Industrial Control System (ICS)/Operational Technology (OT) networks, monitor for and detect cyber threats, deconstruct ICS cyber attacks to extract lessons learned, perform incident response, and take an intelligence-driven approach to executing a world-leading ICS cybersecurity program to ensure safe and reliable operations. Note: This class was previously named ICS515: ICS Active Defense and Incident Response. The course has gone through a significant update changing much of the content, most of the labs, and adding a day in course length.

SANS Logo

What You Will Learn

Prerequisites

GIAC Response and Industrial Defense (GRID) Certification

The GRID certification is for professionals who want to demonstrate that they can perform Active Defense strategies specific to and appropriate for an Industrial Control System (ICS) network and systems. Candidates are required to demonstrate an understanding of the Active Defense approach, ICS-specific attacks and how these attacks inform mitigation strategies. Candidates must also show an understanding of the strategies and fundamental techniques specific to core subjects with an ICS-focus such as network security monitoring (NSM), digital forensics and incident response (DFIR).

  • Active Defense Concepts and Application, Detection and Analysis in an ICS environment
  • Discovery and Monitoring in an ICS environment, ICS-focused Digital Forensics, and ICS-focused Incident Response
  • Malware Analysis Techniques, Threat Analysis in an ICS environment, and Threat Intelligence Fundamentals

More Certification Details

What You Will Receive

    • Protocol samples of OPC, ModbusTCP, DNP3, BACnet, EthernetIP/CIP, S7, and more
    • System files from infected DCS and HMI systems
    • A CLICK PLC Plus Controller, with additional modules and cards for communications with a sector simulation board
    • Physical components and attachments for I/O connections to the SANS sector simulator board
    • Commercial Click PLC Programming software from KOYO Electronics 
    • Commercial HMI control system runtime applications from Rockwell Automation
    • Commercial OPC server application software from Matrikon
  • A SANS ICS515 Windows Virtual Machine
  • A SANS ICS515 RELICS Virtual Machine

Pricing & Registration

This course is part of the SANS Partnership Program. Attendees from eligible state, local, tribal and territorial governments and accredited educational institutions may enroll to attend this course online at a discounted rate of $3,725 per attendee. All registrations using a code will be audited to confirm that they are eligible to receive the discounted rate.

This class is Live Online only, please click the "Register Now" button below. If you are affiliated with a Partnership-eligible institution enter discount code NJCyber_ICS515 to receive your Partnership pricing!

Please note that these links will take you to the login page for a SANS account. If you have a SANS account, please enter your Username and Password to register for the class. If you do not have a SANS account, you will need to create one before registering.

Register Now
Purple Abstract

Course Syllabus