Top Instructors Share Their Expertise ONLINE at SANS - Special Offers Available NOW!

NetWars: DFIR Continuous

Learn how to solve unique, in-depth challenges through interactive case scenarios designed to help you gradually build your DFIR skillset, right from home.

DFIR NetWars Continuous is an incident simulator packed with a vast amount of forensic, malware analysis, threat hunting, and incident response challenges designed to help you gain proficiency without the risk associated with working on real-life incidents. It delivers the same interactive learning program as DFIR NetWars but is fully executed online over a four-month period. The program also delivers twice as many CPE credits (12) as a live DFIR NetWars Tournament (6), and the cost of participation is less than a standard SANS course.

DFIR NetWars Continuous enables you to:

  • Learn anytime and from anywhere
  • Solve key challenges and work on your DFIR skills at your own pace
  • Engage in interactive case scenarios that teach you effective ways to solve the most complex challenges involved in stopping data breaches and solving crimes
  • Identify skills you might be missing and walk away with confidence in your abilities
  • Acquire real-world tactics and techniques and immediately apply them to real-life cases
  • Learn in a safe environment and be prepared to apply your knowledge when a real incident occurs
DFIR NetWars Continuous Topics Who should take the program?
  • Digital Forensics
  • Incident Response
  • Threat Hunting
  • Malware Analysis
  • Endpoint Forensics
  • Network Forensics
  • Memory Analysis
  • Digital Forensic Analysts
  • Forensic Examiners
  • Malware Analysts
  • Incident Responders
  • Threat Hunters
  • Security Operations Center (SOC) Personnel
  • Law Enforcement Officers, Federal Agents, and Detectives
  • Cyber Crime Investigators


The Features of DFIR NetWars Continuous

  • Learn anytime, anywhere: Over the course of four months and four levels, you will progress through multiple skill levels of increasing difficulty, learning first-hand how to solve key challenges at your own pace, and from wherever you might be.
  • Test your skills with more in-depth challenges: NetWars Continuous offers a completely separate set of challenges from the DFIR NetWars Tournament. Although it is organized into the same four levels, there are more in-depth challenges in DFIR NetWars Continuous given its four-month timespan.
  • Learn in a fun, interactive environment: Sharpen new skills with fun "game-like" scenarios. Each of these scenarios teaches you to apply the right skill at the right time, and under the right conditions to accurately solve critical challenges.
  • Build your skills regardless of your level of expertise: Anybody can play! No matter if you are new to the field or a seasoned forensicator or threat hunter, DFIR NetWars Continuous features different levels to help you improve your skill set or show you where you might need improvement.
  • Take hints to develop your skills faster: An innovated Automated Hint System helps you identify the most efficient way to solve challenges or determine when you've found an even better way to solve them. Requesting a hint does not impact your score, but the number of hints you have taken will be displayed as a separate column on the scoreboard.
  • Free yourself from the limitations of tools: It is not the tool that makes a good forensicator, but rather the forensicator's ability to apply the tool or technique at the right time and under the right conditions to accurately solve critical challenges. Each level of NetWars Continuous is designed not only to challenge your capabilities to solve a particular problem, but to teach you proper analysis techniques regardless of the tool you use.
  • Evaluate and show your performance: Walk away with confidence in your abilities and a scorecard that illustrates the areas where you have demonstrated deep skills and knowledge.
  • Apply what you learn immediately: Master real-world tactics and techniques that can be applied to real-life cases as soon as you learn them.

The DFIR NetWars Continuous Tournament Scoreboard

NetWars Continuous Levels

DFIR Netwars Continuous includes multiple levels to help you improve your skills as well as automated hints and support from the SANS NetWars team to ensure that you have the most rewarding experience possible.

Automated Hint System

NetWars Continuous includes an innovated Automated Hint System to help you develop your skills further and faster. All challenges in Levels 1, 2, 3, and 4 allow you to take a hint by simply clicking on a button. Each question has three hints that can be requested to help solve the challenge. Requesting a hint does not impact your score, but the number of hints you have taken will be displayed as a separate column on the scoreboard. In the event of a tie score, the person who has taken fewer hints will get a higher ranking.

In addition, when you conquer a challenge, the system will automatically display all the hints associated with it (without increasing your hint count), so you can still learn from the hints. The hints may provide you a more efficient way to solve the challenge, or they could help you determine that you've found an even better way to solve it!

Generally, the hints for a question are structured as follows:

  • The first hint for a question is typically a Wikipedia search term or a general direction of research.
  • The second hint will provide the player with the most commonly missed logical leap or skill needed to solve the challenge.
  • The third and final hint provides the most information to help the player answer the question specifically.

If you have further questions about registering for DFIR NetWars Continuous, contact us at