This five-day live class prepares you for the Mile2 Certified Cyber Forensics Threat Analyst (C)CFTA) certification. You will learn to collect, preserve, and analyze network-based digital evidence for cyber incident investigations and threat analysis. The course covers the full network forensics lifecycle, including evidence acquisition, protocol analysis, NetFlow and Zeek, Snort and Suricata, log correlation, wireless and cloud forensics, threat investigation, and anti-forensics detection. It includes 15 hands-on labs and maps to the NICE Cybersecurity Workforce Framework.
Who Should Attend
Forensic examiners, IS managers, network auditors, IT managers, and security professionals who investigate network incidents.
Prerequisites
- Two years of networking experience
- Two years of IT security experience
- Working knowledge of TCP/IP
Course Objectives
- Acquire and preserve network evidence while maintaining chain of custody
- Apply the OSCAR investigative methodology
- Perform deep packet analysis with Wireshark, tshark, and tcpdump
- Analyze NetFlow, IPFIX, and Zeek data and configure Snort and Suricata
- Correlate logs into a timeline and investigate C2, tunneling, and exfiltration
- Map findings to MITRE ATT&CK and produce forensic reports
