ICS515 Live Online February

ICS515: ICS Visibility, Detection, and Response - Live Online

In an ICS environment, the answer to "should we shut down?" carries weight no IT incident ever does. Getting it right means knowing what is on the network, what changed, and whether the change threatens safe operation, usually before the evidence is complete.

ICS515 builds that judgment over six days of live, virtual instruction. Roughly half the week is hands-on, working through packet captures from ICS ranges, memory images from infected HMIs, manipulated controller logic, and real malware deployed in a simulated environment. You build a programmable logic controller from the student kit and keep it, so the practice continues after the class ends.

During The Week, You'll Work Through:

• 22 hands-on labs plus a full-day capstone
• PLC construction, operation, and logic analysis
• ICS protocol and traffic analysis across DNP3, Modbus TCP, S7, and more
• HMI memory forensics and phishing vector analysis
• YARA rule development from a live malware sample
• Case studies covering STUXNET, CRASHOVERRIDE, TRISIS, and PIPEDREAM

Frameworks You Can Use on Monday

ICS515 was built around repeatable models rather than tool tutorials: the ICS Cyber Kill Chain, the Collection Management Framework, and the Active Cyber Defense Cycle. You’ll get 36 CPE credits for this course, and it’s aligned to the GIAC Response and Industrial Defense (GRID) certification.

Who Should Take This Course?

ICS and OT security staff, incident responders working in industrial environments, SOC analysts asked to monitor OT alongside IT, and IT security professionals moving into critical infrastructure. Prior ICS experience is not required, but comfort with SCADA, DCS, PLC, and RTU terminology will help.

Download the Course Syllabus

• Syllabus

To learn more about ICS515, business takeaways, laptop requirements, and more, please visit the course page.