Overview

This program is the complete federal incident investigation credential. Participants run a federal incident response program from governance and readiness through detection, containment, recovery, and lessons learned, then specialize in the investigative craft: the forensic process that makes findings defensible, and the malware analysis that explains what actually happened.

The sequence is deliberate: response teaches what to do under time pressure, forensics teaches how to prove it afterwards, and malware analysis teaches how to answer the question everyone asks first, which is what the thing did. It prepares participants for federal incident responder, digital forensic examiner, and SOC investigator roles, and toward the GIAC GCIH and GCFE credentials. The program aligns to NIST SP 800-61 Rev 3, SP 800-86, and SP 800-83, to CISA reporting obligations, and to the CSF 2.0 Functions.

Syllabus

Federal Incident Response for Agency Practitioners Course

Governance and the legal and policy basis for federal IR (FISMA, NIST SP 800-61 Rev. 3, OMB, CISA).
Detecting and classifying incidents with NCISS and the federal incident categories.
Determining which mandatory reporting obligations apply and meeting the deadlines.
Containment, eradication, and recovery carried out without compromising evidence.
Post-incident reviews that drive real program improvement.
Tabletop exercise design and facilitation, including a MSEL.
Working a simulated incident from detection through to the after-action report.

Digital Forensics and Incident Investigation for Federal Employees Course

The NIST SP 800-86 forensic process, tied back to the NIST SP 800-61 IR lifecycle.
The legal and policy foundations for federal digital evidence, including when a matter goes to OIG, counsel, or law enforcement.
Evidence collected and preserved in order of volatility — memory, disk, network, cloud — free of contamination.
IOC investigation across host, network, and behavioral data to fix scope and build a timeline.
Reconstruct timelines and correlate artifacts, with a clear sense of what forensic evidence can and cannot prove.
Hold a defensible chain of custody and write findings for technical, executive, and legal readers.

Malware Analysis Fundamentals Course

Static analysis technique: triage, string and metadata extraction, YARA, and basic disassembly
Reading dynamic analysis output (sandboxing, monitoring, network simulation) and evasive behavior from example reports
Capturing network IOCs and correlating them with threat intel and MITRE ATT&CK
Using FLARE-VM, REMnux, and CISA Malware Next-Gen appropriately, as against public multi-scanners
Writing a CISA-MAR-style report for technical and leadership readers
Tracking one sample from triage through to the finished report