Training
Featured CourseView All Courses
Get a Free Hour of SANS Training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
Cloud Security Training, Courses, and Resources
Can't find what you are looking for?

Let us help.

Contact us
Community Resources

SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

AI Risk & Readiness

Explore expert-driven guidance, training, and tools to help defend against AI-powered threats and adopt AI securely.

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations

Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Talk With an Expert
Talk With an Expert

Phil Hagen

FellowPrincipal Information Security Researcher at Red Canary

Specialities

Digital Forensics and Incident Response

Connect with Phil

Phil Hagen
Jump to:

About Phil Hagen

Phil Hagen is a SANS Faculty Fellow and the author and lead of SANS FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response. As the architect of FOR572, Phil integrates his investigative expertise into every lab so students practice workflows that have been tested in real-world cases. Phil is also the Principal Information Security Researcher at Red Canary, a ZScaler Company, where he supports the company’s content creation and open source programs.

Press & Media

More From Phil

Students Say

  • Slide 1 of 3
    Even by SANS standards, Phil clearly 'goes the extra mile' in depth of information, especially on exercises.
    Dai MorganFOR572 Student
  • Slide 2 of 3
    I really like how Phil incorporates real-life examples into the material. It really helps me visualize it!
    Ryan NelsonFOR572 Student
  • Slide 3 of 3
    As a long-time, enterprise network defender, I can say that Phils knowledge is excellent and this class should be manditory training for all blue training.
    NicFOR572 Student
Slide 1 of 0

Virtual Events

Explore content featuring this instructor’s insights and expertise.

Free Resources

Review relevant educational resources made with contribution from this instructor.

SOF-ELK®

Open Source ToolsDigital Forensics and Incident Response
  • 17 Jun 2025
  • Phil Hagen

SOF-ELK

Open Source ToolsDigital Forensics and Incident Response
  • 24 Apr 2025
  • Phil Hagen

SOF-ELK®'s Evolution: A Comprehensive Update for Enhanced Digital Forensics

BlogDigital Forensics and Incident Response
  • 3 Dec 2024
  • Phil Hagen

Next Generation FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response

BlogDigital Forensics and Incident Response
  • 6 Nov 2023
  • Phil Hagen