Explore Real-World Cybersecurity Intrusions

Your practical experience starts here.

Our cloud-based DFIR (Digital Forensics and Incident Response) Labs give you hands-on learning experience using real data from real intrusions.

Real Incidents. Real Knowledge.

Each lab immerses you in scenarios based on real public and private intrusions. We sanitize the attack data so you get the most authentic  and up-to-date learning experience possible.

Engage with Elastic or Splunk instances to sift through real logs to investigate actual cyber-attacks. Logs include:

System Logs:

Windows Event Logs + Sysmon Logs

Network Logs:

Zeek Logs + Suricata alerts

Memory Logs:

Memory timeline processed via MemProcFS

Sigma Alerts:

Sigma HQ + The DFIR Report Detection Rules (Private & Public)

ACCESS DFIR LABS

A Personalized Approach to Learning

Our labs are designed to engage and educate with interactive case studies where you can investigate logs, find connections, and solve cases. With flexible access and learning speed (labs range from 2 days to 2 weeks), each option is tailored to fit your needs, allowing  you to explore digital forensics at your own pace.

Access DFIR Labs

Easy

Characterized by smaller datasets  and straightforward quizzes, often including public reports to provide additional guidance  and resources in the investigation process

Medium

Feature moderately sized cases with more challenging quizzes and require a good grasp of DFIR concepts. Public reports are sometimes available but less direct than in easy labs

Hard

Involve the most complex cases with the largest datasets and network sizes  as well as more challenging quizzes and a lack of public report availability

Why DFIR Labs Stand Out

DFIR Labs is more than just a digital course. When it comes to strengthening your cybersecurity expertise, our interactive labs help advance your skills with dedicated support and impressive credentials that help propel your career forward.

ACCESS DFIR LABS

Personalized Support

Enhance your learning by having sessions with our experts to help you with difficult questions, talk through investigative methods, and guide you through the lab.

Earn Badges, Certificates, and CPE Credits

After completing the lab, you’ll receive a Certificate of Achievement as well as a badge. This certificate is more than just recognition — it’s a step forward in your professional development, counting towards your Continuing Professional Education (CPE) credits.

Educational Discounts

We offer students a discount off every case. Please send  an email to [email protected] from your school-affiliated email address to receive your discount. Teachers  are also eligible for volume discounts that accommodate classroom needs. Please contact us to learn more. Together, we can make education more affordable and accessible.

Customized Training
& Lab Access for Businesses

Our packages can be tailored to fit the goals and needs  of your organization. If you would like to purchase a pack  of cases for your business, please see our options here.

Disclaimer: All information in the DFIR Labs and analysis of that information shall be treated as TLP:RED. This classification mandates that the information is not shared publicly or privately without explicit permission from The DFIR Report.

Access DFIR Labs Book a Demo

The DFIR Report provides in-depth, real-world intelligence based on observed intrusions, enabling security analysts and teams  to strengthen defenses, enhance detection,  and accelerate response.