SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
SANS DFIRCON Miami 2025
- Sun, Nov 16 - Sat, Nov 22, 2025
- 15 Courses
- 1 Tournament
- English
Hyatt Regency Coral Gables & Virtual (ET)
50 Alhambra Plaza, Coral Gables, FL 33134
Event Highlights
Exclusive SANS@Night Talk
Hear from SANS expert instructors, during our SANS@Night talks for the latest techniques.
FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
FOR508Digital Forensics and Incident Response
- GIAC Certified Forensic Analyst
- 6 Days
- 36 CPEs
- Carlos Cajigas
- Starts 17 Nov 2025 at 8:30 AM ET
- $8,780 USD (Course)
- $999 USD (Certification)
- *Prices exclude applicable local taxes
FOR610: Reverse-Engineering Malware: Malware Analysis Tools and Techniques
FOR610Digital Forensics and Incident Response
- GIAC Reverse Engineering Malware
- 6 Days
- 36 CPEs
- Evan Dygert
- Starts 17 Nov 2025 at 8:30 AM ET
- $8,780 USD (Course)
- $999 USD (Certification)
- *Prices exclude applicable local taxes
FOR572: Advanced Network Forensics: Threat Hunting, Analysis, and Incident Response
FOR572Digital Forensics and Incident Response
- GIAC Network Forensic Analyst
- 6 Days
- 36 CPEs
- Philip Hagen
- Starts 17 Nov 2025 at 8:30 AM ET
- $8,780 USD (Course)
- $999 USD (Certification)
- *Prices exclude applicable local taxes
Registration
Day 010:00AM - 11:00AM ESTIn-Person
SOF-ELK Hands-on Workshop 2025 Edition
Learn how to use SOF-ELK®, a free and open-source Elastic Stack distribution tailored for security and DFIR. This hands-on workshop includes the latest 2025 updates and guides you through loading logs, analyzing data via Kibana, and building visualizations to support real-world investigations.
In-Person
Mastering Investigations with EZ Tools: Fast, Focused, and Forensically Sound
Join Eric Zimmerman for a hands-on dive into EZ Tools, the widely used open-source suite for Windows forensics. Learn how to leverage tools like KAPE, RECmd, and ShellBags Explorer to collect, parse, and analyze evidence efficiently. This session includes the latest expert tips on integrating new features into your investigative workflow.
In-Person
Lunch Break
Day 012:45PM - 01:45PM ESTIn-Person
ArtExperimentation
Get hands-on with ArtEx, a powerful tool for researching and testing forensic artifacts with speed and precision. Learn how to navigate file systems, analyze serialized data, and explore key structures across multiple sources. This session includes what you need to integrate ArtEx into your workflow for artifact validation and investigative support.
In-Person
Open Source Digital Forensics using Python: The LEAPPs Toolset
Explore the LEAPPs suite for fast, structured parsing of mobile and cloud artifacts. This hands-on session covers expanded support for Google Takeout, vehicle data, and more to help streamline triage and improve investigation accuracy.
In-Person
Break
Day 003:45PM - 04:00PM ESTIn-Person
Getting Hands-On with SIFT: Practical Forensics Using the SANS Investigative Toolkit
Get hands-on with the SANS Investigative Forensic Toolkit (SIFT), a powerful open-source workstation built to support in-depth forensic analysis. SIFT integrates several open-source tools to help you examine compromised systems, extract key artifacts, and reconstruct attacker timelines. This session walks you through practical, repeatable workflows you can apply directly to real-world investigations.
In-Person
Incident Response with Velociraptor: Investigating a Cyber Attack from Initial Access to Exfiltration
This hands-on workshop explores the core capabilities of Velociraptor, a powerful open-source DFIR tool for scalable endpoint visibility, live forensics, and threat hunting. Through guided exercises, you’ll learn how to deploy and configure Velociraptor, query endpoint data, and conduct targeted hunts across multiple systems. The session focuses on integrating Velociraptor into real-world investigative workflows, helping you build confidence in live response, artifact collection, and analysis at scale.
In-Person
Break
Day 005:45PM - 06:00PM ESTIn-Person
SIFT + AI: Less Suffering, More Finding
This wrap up workshop explores how integrating practical AI capabilities into the SIFT Workstation can speed up DFIR triage by surfacing anomalies, summarizing logs, and assisting with repetitive analysis tasks. Learn how local, auditable AI tools—designed for investigators, not data scientists—can act like a smart assistant to help cut through noise without replacing human judgment. AI won't solve forensics. But it can make it suck less.
In-Person
Closing Remarks
Day 007:00PM - 07:45PM ESTIn-Person
Welcome Reception
Kick off your SANS DFIRCON Miami 2025 experience at the Welcome Reception. Be part of this kickoff event and join the industry’s most powerful gathering of cybersecurity professionals. Share stories, make connections, and learn how to make the most of your week in Miami, FL. Come join your instructors and fellow students for a fun, relaxed evening. Beverages (adult and otherwise) and small bites will be included.
In-Person
Keynote: Code, Community, and the Calling: Building Tools That Serve the Mission
Eric shares the power of open-source development, how community collaboration drives innovation, and the value of creating tools that help defenders stay ahead. This session includes the live reveal of the winning EZ Tool Challenge submission — a new tool built and launched live at DFIRCON.
In-Person & Virtual
Reception: DFIR AlumNight
Come join us for a casual networking event for SANS alumni and current attendees.
In-Person
DFIR Bytes: Operation Phantom Thread: Tracing the Attacker from First Foothold to Final Exfil (Part 1)
In this hands-on, instructor-led case simulation, attendees will act as members of an incident response team investigating a multi-phase intrusion into an international consulting firm’s network. The investigation begins after suspicious outbound traffic is detected from a financial analyst’s workstation. Early indicators suggest unauthorized access to sensitive internal repositories.
In-Person
Reception: DFIR AlumNight
Come join us for a casual networking event for SANS alumni and current attendees.
In-Person
DFIR Bytes: Operation Phantom Thread: Tracing the Attacker from First Foothold to Final Exfil (Part 2)
The investigation continues with deeper analysis of attacker movement, persistence mechanisms, and exfiltration methods. Participants will complete their response strategy and strengthen their investigation workflow.
In-Person
Tournament: DFIR NetWars
Registration: All students who register for a 4-6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.
About DFIR NetWars: Focused on digital forensics, incident response, threat hunting, and malware analysis, this tool-agnostic approach covers everything from low-level artifacts to high-level behavioral observations.
In-Person
Tournament: DFIR NetWars
Registration: All students who register for a 4-6 day course will be eligible to play NetWars for free. Registration for this event will be through your SANS Account Dashboard the week of the event.
About DFIR NetWars: Focused on digital forensics, incident response, threat hunting, and malware analysis, this tool-agnostic approach covers everything from low-level artifacts to high-level behavioral observations.
In-Person
Hyatt Regency Coral Gables
A special discounted rate of $245.00 S/D plus applicable taxes will be honored based on space availability.
A limited number of Government Per Diem rooms at the prevailing rate are available with proper ID.
These rates include:
- Internet in your room
- Complimentary access to the fitness center, pool area, jacuzzi, and sauna
These rates are only available through Friday, October 24, 2025.
The $25 daily destination fee is waived for SANS attendees who book through the links below.
An on-site raffle will be held during the event to award a SANS attendee who booked their room in the hotel block 5,000 World of Hyatt points! Hotel rooms need to be reserved through the booking link above to qualify.
3 Reasons To Stay At The Event Venue
