SANS 2026 DFIR Summit Solutions Track

Thu, Oct 15, 2026
10:00AM - 1:30PM EDT
English
Megan Roddie-Fonseca
Solutions Forum

Thank You To Our Sponsors

SANS 2026 DFIR Summit Solutions Track delivers a deep technical exploration of the tools, methodologies, and operational models driving next-generation digital forensics and incident response. Sessions focus on advanced evidence acquisition, host and network artifact analysis, memory forensics, cloud-native IR workflows, and the application of machine learning to accelerate triage and attribution.

Attendees will learn how to operationalize automation, standardize investigative pipelines, and integrate DFIR technologies into high-scale, distributed environments to improve precision, reduce dwell time, and harden enterprise response capabilities.

What to Expect

Technical walkthroughs of emerging DFIR tooling—including endpoint telemetry pipelines, memory forensics frameworks, malware analysis sandboxes, and automated evidence extraction workflows.
Deep-dive case studies detailing attacker tradecraft, artifact correlation strategies, cross-host timeline reconstruction, and cloud IR techniques across AWS, Azure, and GCP.
Practical guidance and reference architectures for building scalable DFIR environments with automated triage, standardized enrichment, and integrated SOAR/EDR workflows.

Who Should Attend

DFIR practitioners, digital forensic examiners, threat hunters, and reverse engineers seeking advanced, tool-focused investigative techniques.
Incident response leads and SOC engineers responsible for building automated triage pipelines, forensic readiness strategies, and high-throughput investigation environments.
Security architects and platform engineers integrating DFIR telemetry, EDR/XDR data, and cloud-native artifacts into centralized analysis and response systems.
Organizations evaluating next-gen DFIR platforms, scaling IR operations, or adopting automation and ML-driven investigative workflows.

Don't Forget to Register for Day 2.

Join Slack

Schedule

Showing 8 of 8

Filter by:

Select day:

Opening Remarks

10:00AM - 10:15AM EDT

Virtual

Presented by

Megan Roddie-Fonseca

Senior Security Engineer at Datadog

From Alert to Evidence: Event-Driven Collections for Faster DFIR Investigations

Legacy DFIR stacks are slowing teams down with unreliable off-network collections, brittle or bloated agents, and too many disconnected point products and scripts. This creates operational drag that translates into increased risk, higher costs, and longer investigation timelines.

In this session, we'll demonstrate how Magnet Forensics solutions provide a faster, more resilient approach by replacing outdated remote collection methods while simplifying deployment and day-to-day operations. You'll see how investigators can leverage Magnet Nexus to remotely preview and collect evidence from live online endpoints, allowing teams to quickly target and acquire the data that matters most without waiting for devices to be physically accessed.

We’ll also explore how API-driven integrations with EDR and XDR platforms can automatically trigger collections the moment an alert fires, ensuring critical evidence is preserved before users shut down devices, systems go offline, or artifacts are overwritten. This session connects the dots across an integrated workflow spanning alerting, targeted collection, automated evidence acquisition, forensic analysis, and investigator collaboration.

*Sponsored by Magnet Forensics

10:15AM - 10:45AM EDT

Virtual

Presented by

Jeff Rutherford

Forensic Consultant

Execution-Level Analysis of a Russian-Speaking Multi-Operator Intrusion Campaign: Operation STANDOFF

VMRay Labs identified a previously unattributed cybercriminal campaign, tracked as Operation STANDOFF, assessed with high confidence to be run by a Russian-speaking threat group and to remain actively maintained. It started with one behavioral detection. Execution-level analysis and infrastructure pivoting grew it into an operation combining commodity malware distribution, a proxy botnet, hands-on-keyboard intrusion and an AI-assisted influence capability.

In this session we will walk through that investigation end to end: how unrelated-looking findings connect, and how execution data drives infrastructure pivoting. One part of the infrastructure hid behind 301 redirects to GitHub. That behavior, together with certificate, TLS and hosting patterns, helped surface 48 related hosts, 44 of them published as indicators. GitHub was never compromised. The redirect was camouflage.

We will also cover STANDOFF COORD, the operators' own intrusion console, whose internal workflow could largely be reconstructed because its client-side code was exposed, and a Telegram account farm using AI-generated personas and automated engagement. Attendees will leave with the pivots and detection opportunities that turned one detection into campaign-level intelligence.

*Sponsored by VMRay

10:45AM - 11:15AM EDT

Virtual

Presented by

Hasan Mevzi

Agentic Workflows in Practice: Architecting Multi-Agent Investigations in a Production SOC

Everyone claims an "AI SOC." This session shows the working machinery - and the evidence discipline that keeps it honest. You'll see how a triage agent defensibly auto-closes 80% of alert volume with evidence attached, how an orchestrator supervises specialist agents for packet forensics, identity, and threat intel, and why one wall is load-bearing: RAG advises, records prove.

Takeaways include bounding agents like service accounts (tool allowlists, query caps, read-only lanes), writing prompts as contracts rather than personas, containing false-negative risk with a sampled QA loop, and defending your retrieval pipeline against poisoned knowledge that rewrites agent behavior.

*Sponsored by Extrahop

11:15AM - 11:45AM EDT

Virtual

Presented by

Jamie Moles

Head of Technical Marketing at Extrahop

Break

11:45AM - 12:00PM EDT

Virtual

Watching the Watcher: Catching FalconFlank Where EDR Can't Look

When a critical vulnerability is disclosed, defenders often have only public research and limited detection content to assess exposure. Using FalconFlank, a local privilege escalation vulnerability in CrowdStrike Falcon Sensor, as a case study, this session demonstrates how to rapidly translate advisories and proof of concept research into actionable threat hunting content.

Attendees will learn how to identify exploitation artifacts across process, file system, and memory telemetry, then apply a repeatable detection engineering framework to future vulnerabilities, helping close visibility gaps before patches and detection coverage become available.

*Sponsored by Leap

12:00PM - 12:30PM EDT

Virtual

Presented by

Jon Nelson

FIeld Solutions Architect

From Signal to Story: How Agentic AI Is Reshaping Incident Response

DFIR teams don't have a data problem—they have a correlation problem. Every investigation starts the same way: pulling telemetry from a dozen sources, manually stitching together a timeline, and racing the clock while attackers move faster than any human analyst can type. Agentic AI changes that equation, but only if it's built on evidence, not guesswork.

In this session, Dave Gold explores how AI agents are moving from alert triage to full investigative workflows—correlating signal across endpoint, identity, cloud, and network telemetry into a single narrative instead of a dozen disconnected consoles. You'll see how autonomous investigation can compress alert-to-root-cause timelines from hours to minutes, what guardrails keep an AI-driven investigation defensible and auditable, and where human judgment still has to anchor the process.

Attendees will walk away with a practical framework for evaluating agentic AI capabilities in their own DFIR stack—what to automate, what to verify, and how to scale investigations without losing the rigor the job demands.

*Sponsored by SentinelOne

Presented by Dave Gold VP, Global Field CTO/CISO at SentinelOne.

12:30PM - 01:00PM EDT

Virtual

Closing Remarks

01:00PM - 01:15PM EDT

Virtual

Presented by

Megan Roddie-Fonseca

Senior Security Engineer at Datadog

Meet Your Chair

Megan Roddie-Fonseca

Senior Security Engineer at Datadog

Megan is a Senior Security Engineer at Datadog, SANS DFIR faculty, and co-author of FOR509. She holds two master’s degrees, serves as CFO of Mental Health Hackers, and is a strong advocate for hands-on cloud forensics training and mental wellness.

SEC536: Adversarial AI - Penetration Testing AI Systems

SANS 2026 DFIR Summit Solutions Track

Share

Thank You To Our Sponsors

What to Expect

Who Should Attend

Don't Forget to Register for Day 2.

Join Slack