Final Days to get an iPad Mini, ASUS Chromebook, or $250 Off Online Training

NetWars: DFIR Tournament

Challenge yourself before the enemy does!

Digital Forensics and Incident Response investigations demand practitioners who can apply unique skills to overcome the many obstacles they face daily in their jobs. Practitioners have to keep their abilities razor sharp to keep up with changes in technology and intelligent adversaries. Staying up-to-date on the latest challenges in the field requires analytical skills that cannot be learned by only reading a textbook. Just like firefighters could never learn how to combat a blaze by only studying theory, incident responders, threat hunters, and digital forensic investigators can only attain the proficiency they need through hands-on, practical experience. Unfortunately, gaining this proficiency when an incident occurs can have serious consequences, as mistakes can potentially damage an entire investigation and put your organization at higher risk.

DFIR NetWars is an incident simulator packed with a vast amount of forensic, malware analysis, threat hunting, and incident response challenges designed to help you gain proficiency without the risk associated with working on a real-life incident. DFIR NetWars is unique in that it provides time-limited challenges that can be used to test the skills you've mastered and at the same time help you identify the skills you're missing. It is designed to test and sharpen each participant's skills in an individual or team-based "firefight" setting that enables participants to:

  • Engage in interactive case scenarios that teach effective ways to solve even the most complex challenges.
  • Obtain the latest hands-on training available from incident responders, threat hunters, and forensic analysts who themselves face the most complex challenges in stopping data breaches and solving crimes.
  • Learn in a safe environment where they can discover possible mistakes, identify the skills they might be missing, and ultimately be prepared to apply their knowledge when a real incident occurs.
DFIR NetWars Topics Who Should Take the Program?
  • Digital Forensics
  • Incident Response
  • Threat Hunting
  • Malware Analysis
  • Endpoint Forensics
  • Network Forensics
  • Memory Analysis
  • Digital Forensic Analysts
  • Forensic Examiners
  • Malware Analysts
  • Incident Responders
  • Threat Hunters
  • Security Operations Center (SOC) Personnel
  • Law Enforcement Officers, Federal Agents, and Detectives
  • Cyber Crime Investigators

The DFIR NetWars Tournament Room

DFIR NetWars allows you to:

  • Learn in a fun, interactive environment: Sharpen new skills with fun "game-like" scenarios. Each of these scenarios teaches you to apply the right skill at the right time, and under the right conditions to accurately solve critical challenges.
  • Build skills regardless of your level of expertise: Anybody can play! No matter if you are new to the field or a seasoned forensicator or threat hunter, DFIR NetWars features different levels to help you improve your skill set, or show you where you might need improvement.
  • Take hints to develop your skills faster: An innovated Automated Hint System helps you identify the most efficient way to solve challenges or determine when you've found an even better way to solve them. Requesting a hint does not impact your score, but the number of hints you have taken will be displayed as a separate column on the scoreboard.
  • Free yourself from the limitations of tools: It is not the tool that makes a good forensicator, but rather the forensicator's ability to apply the tool or technique at the right time and under the right conditions to accurately solve critical challenges. Each level of NetWars is designed not only to challenge your capabilities to solve a particular problem, but to teach you proper analysis techniques regardless of the tool you use.
  • Evaluate and show your performance: Walk away with confidence in your abilities and a scorecard that illustrates the areas where you have demonstrated deep skills and knowledge.
  • Apply what you learn immediately: Master real-world tactics and techniques that can be applied to real-live cases as soon as you learn them.

Want to work on your skills right from home? You can with DFIR NetWars Continuous

DFIR NetWars Continuous delivers the same interactive learning program as DFIR NetWars but over a four-month period. DFIR NetWars Continuous is fully executed online, so you can learn at your own pace and work from wherever you want. It includes automated hints and support from the SANS NetWars team to ensure that you have the most rewarding experience possible. The program also delivers twice as many CPE credits (12) as a live DFIR NetWars Tournament (6), and the cost of participation is less than a standard SANS course.

DFIR Netwars Continuous allows you to:

  • Learn anytime, anywhere: Over the course of four months and four levels, you will progress through multiple skill scenarios of increasing difficulty, learning first-hand how to solve key challenges at your own pace, and from wherever you might be.
  • Test your skills with more in-depth challenges: NetWars Continuous offers a completely separate set of challenges from the DFIR NetWars Tournament. Although it is organized into the same four levels, there are more in-depth challenges in DFIR NetWars Continuous, given its four-month timespan.

For more information about DFIR NetWars Continuous email us at


How does the program work?

  • When players sign into the DFIR NetWars environment, they face multiple levels of questions regarding an incident. Players are presented with several evidence files - including system, network, memory, and malware samples - from which they need to answer questions.
  • When players answer questions correctly, they earn points posted on the DFIR NetWars Tournament scoreboard.
  • If players answer a question wrong, points are deducted from their score after the second incorrect answer to the same question.
  • If players don't know where to start or need a refresher, they can request a series of hints to guide their analysis without affecting their score.
  • Each player can observe his or her ranking compared to other players. The player with the highest score at the end of the DFIR NetWars Tournament wins.

DFIR NetWars Tournament Sample Questions - Level 1

How do I "level up" in a DFIR NetWars Tournament?

Players progress through the levels by answering questions and earning points. The next level will unlock after a certain number of points is obtained. The points are cumulative across all levels. The better a player does on one level, the quicker the next level will open up.

There are currently four levels in the DFIR NetWars Tournament. Levels 1 and 2 are designed to be approachable by those completely new to forensics. They include hints that will not only help answer the questions, but also teach the players specific techniques as they progress. The upper levels are meant to challenge you and expose where your skills need more work.

DFIR NetWars Tournament Sample Questions - Level 3

What tools can be utilized to solve the challenges?

The DFIR NetWars Tournament Scoreboard

The DFIR NetWars Tournament is designed to test the skills of the analyst rather than the analyst's ability to navigate a specific toolset. Challenge answers do not change regardless of the tool used to solve them. Participants are allowed to bring any toolset or capability to the tournament. If players don't bring their own tools, they will be provided with the SIFT WorkStation, a free collection of tools that can be utilized to solve every challenge in the game.

Upcoming Events
Event Location Dates
SANS 2018 Orlando, FL April 6, 2018 -
April 7, 2018
SANS Security West 2018 San Diego, CA May 14, 2018 -
May 15, 2018
SANS Melbourne 2018 Melbourne, May 24, 2018 -
May 25, 2018
DFIR Summit & Training 2018 Austin, TX June 12, 2018 -
June 13, 2018
SANSFIRE 2018 Washington, DC July 19, 2018 -
July 20, 2018
Threat Hunting & Incident Response Summit & Training 2018 New Orleans, LA September 11, 2018 -
September 12, 2018
SANS Network Security 2018 Las Vegas, NV September 26, 2018 -
September 27, 2018
SANS DFIR Prague Summit & Training 2018 Prague, October 5, 2018 -
October 6, 2018