Summit: August 15-16 | Summit CPE Credits: 12 | Training: August 17-22 | Co-Chairs: Heather Mahalik & Phil Hagen

As we celebrate the 15th anniversary of the SANS DFIR Summit & Training, we're feeling nostalgic and having some fun looking back on the great strides we've made since our first DFIR Summit. It feels like just yesterday when a group of DFIR superheroes gathered for the first time to share ideas, learn new techniques, and have a little bit of fun. The DFIR community has come a long way since then, and we can’t wait to see what’s next.

Join us this year at the 2022 SANS DFIR Summit Live Online or attend in Austin! If you’ve attended before, you know you’ll walk away from the summit with a story, connection, and maybe even one of those limited edition DFIR superhero Legos. If it’s your first time attending, we look forward to meeting you at the most comprehensive DFIR event of the year!


Don't miss your chance to enjoy:

  • Highly Technical Summit Talks -
    The industry's top practitioners will share their latest digital forensics and incident response research, solutions, tools, and case studies. You’ll have more than 20 talks to choose from, plus lots of new virtual event features that will have you schooled up before the Summit is done.

  • Double the Fun | TWO Summit Night Outs Packed into One Event -
    • Night One - It's GAME ON! | August 15th from 6:30 - 8:30 PM
      DFIR Summit Night Out The DFIR Summit has reached level 15! Come celebrate with a night fun and games at the Recess Arcade.
    • Night Two - SHOWTIME with The Spazmatics! | August 16th from 6:00 - 9:00 PM
      Closeout your time at the DFIR Summit with an Austin 80's tribute band crowd favorite, The Spazmatics! Head over to Speakeasy for music, bowling, food and drinks!
  • Closely Aligned SANS DFIR Courses -
    Enhance your knowledge base and add to your toolkit with a hands-on, immersive course taught by top SANS instructors and course authors. This year, we’re excited to welcome new DFIR courses to the event lineup:
    • FOR710: Reverse-Engineering Malware: Advanced Code Analysis
    • FOR509: Enterprise Cloud Forensics and Incident Response
    • FOR608: Enterprise-Class Incident Response & Threat Hunting
  • DFIR NetWars and Coin Slayer -
    Students enrolled in in-person courses at DFIR Summit & Training 2022 can join us for everyone’s favorite action-packed challenge environment where participants can build their skills while having fun.


"We’ve seen the SANS DFIR Summit grow over the years. What started as a handful of enthusiastic practitioners has grown to hundreds of colleagues gathering in Austin, to nearly 20,000 virtual attendees.

This year we return to Austin and go hybrid – simultaneously welcoming attendees in person and around the world. Heather and I are honored to host the 2022 SANS DFIR Summit and can’t wait to share the latest groundbreaking research, case studies, and tool releases that our friends and colleagues have been working on during the past year. We hope you can join us in person or online and experience what only the SANS DFIR Summit can deliver."

- Phil Hagen and Heather Mahalik

Who Should Attend

Every year, forensic and incident response professionals from around the world attend the SANS DFIR Summit to learn how to overcome their latest obstacles, learn about the latest open-source forensic tools, share methods and strategies proven effective in their investigations, and learn from the top DFIR practitioners in the industry. This year, the addition of talks focused on threat hunting expands the scope of material to include proactively searching your environment for attackers that have escaped detection so far.

The knowledge shared over just two days is enough to last the entire year. Whether this is your first or fifteenth DFIR Summit, you’ll be joining a community that is driven by the search for truth in digital forensics and eradicating adversaries from their target environment through incident response engagements.

Ask any of the returning attendees - a key benefit is that you’ll have the opportunity to network with other like-minded DFIR professionals. If you work in digital forensics or incident response, the SANS DFIR Summit is the must-attend event of the year.

The DFIR Summit 2022 Call for Presentations has closed. The advisory board is busy reviewing submissions. The advisory board carefully evaluates proposals to ensure the Summit agenda delivers actionable content that meets the needs of the community.

To get a taste of the type of dynamic presentations and speakers you’ll see at DFIR Summit 2022 check out these talks from the 2021 Summit here.

The Summit informed me of the latest forensic advancements that I would not otherwise hear about.
Al Hirst
- N.I.S.T.
The DFIR Summit never disappoints and is still the #1 DFIR event. As a leader, it allows me to keep a pulse on cutting-edge research.
Brad Garnett
- Cisco Talos
Every talk has a little nugget that you can add to your forensic toolbox no matter what your forensic wheelhouse may be. This is a must-attend event.
A. Sparling
I think this is the very best event in the DFIR Community, bar none. The combination of the best networking opportunities and the world's best instructors and content can't be beat.
John McCash
- Northern Trust


    Anomali-logo_lion-wordmark_RGB-color.pngCisco_Secure_Horizontal.pngCorelight_Transparent.pngCyborg-Logo-Full-Color-CMYK_(1).pngDevo.pngDomainTools_Logo_Color_(1).pngExtraHop_Networks-logo.pngGigamon-Logo.pngMagnet_Forensics_Horz_RGB.pngPalo_Alto_Networks.pngPentera Logopicnic_primary_id-01.pngrapid7.pngsophos-logo-strapline-center_rgb-1.pngtq_main-logo-color.pngVectra.png

    Important Dates

    Refund Date Hotel Group Discount Deadline
    July 29, 2022 July 29, 2022


    Hilton Austin

    500 East 4th Street 

    Austin, Texas 78701, USA

    Phone: 512-482-8000

    Hilton Austin

    At the center of Downtown, the Hilton Austin hotel is attached to Austin Convention Center via covered walkway. Reach East Sixth Street nightlife two blocks away, and explore the picturesque Rainey Street Historic District, less than a mile from the door. The full-service spa boasts a sauna and steam room, and perks include a rooftop pool overlooking the city.

    Hotel Special Rates and Reservations

    A special discounted rate of $219.00 S/D plus applicable taxes will be honored based on space availability.

    A limited number of Government Per Diem rooms at the prevailing rate are available with proper ID.

    These rates include Internet in your room and are only available through Friday, July 29, 2022.

    To make a regular reservation, please visit this link.

    To make a government per diem reservation, please visit this link.

    Top 3 reasons to stay at the Hilton Austin

    1. No need to factor in daily cab fees and the time associated with travel to alternate hotels. Everything is in one convenient location!
    2. By staying at the Hilton Austin, you gain the opportunity to further network with your industry peers and remain in the center of the activity surrounding the conference.
    3. SANS schedules evening events at the Hilton Austin that you won't want to miss!

    Travel Arrangements and Directions

    A discounted parking rate of $20.00 per day for daily attendees is available. Discounted parking is not available for overnight guests. Please check the hotel website for updated pricing and more information.

    From Austin-Bergstrom International Airport (AUS): Approximately 6.7 miles.

    Google Maps

    Experience Austin

    3 Quick Facts about Austin

    1. Austin has the largest urban bat colony in North America.
    2. Austin gets an average of 300 days of sunshine and is one of the sunniest cities in America.
    1. Austin is the only city in the world that still operates moonlight towers.

    Recommended Web Links

    Health and Safety Information

    As we welcome you back to In-Person Training, your safety remains our greatest priority. We continue to make proactive decisions that are grounded in care, ensuring your peace of mind and we are grateful for the trust you have shown us over the years.

    SANS continues to adhere to all official government and local authority guidance, as well as any venue or location-specific imposed regulation.

    It is important to consider your own personal situation and the risk to you, your fellow attendees, and SANS faculty and staff before attending in-person training.

    Our measures will be implemented in accordance with local government agencies guidance in effect during the event. As a result, our practices may vary from event to event.

    • We take great pride in only working with hotel venues that
      maintain rigorous standards of cleanliness and hygiene and continue
      to monitor the evolving situation and guidelines.
    • We will ensure proper distancing, where needed, inside of classrooms and event seating areas.
    • We intend to deliver the highest level of hygiene and safety
      protocol during our event to ensure attendees, faculty, staff,
      sponsors, and vendors can connect, learn, network, and return to
      business as usual, effectively, and safely.