Investigation-Driven DFIR Training.
From SOC fundamentals to advanced incident response.
Structured tracks that build real investigation skills through hands-on training.
Compare Training Tracks
Each track builds on the last. Pick your starting point or get everything with the Hero Bundle.
| Analyst Core | Analyst I | Analyst II | Best Value Hero Bundle |
|
|---|---|---|---|---|
| Focus | SOC operations & enterprise defense |
Windows disk & memory forensics |
Advanced IR, ransomware, enterprise-scale |
Complete analyst progression |
| Course | Enterprise Security Operations |
Practical Windows Forensics |
Advanced Enterprise DFIR |
All three courses |
| Hands-on labs | 39 labs | 52 labs | 58 labs | 149 labs total |
| Investigations | — | 4 × FOR200 forensic cases |
3 × IR300 DFIR cases |
All 7 scenarios |
| Certification | — | ✓ PWFA (2 attempts) | — | ✓ PWFA included |
| Bonus | — | — | — | ✓ 12 months Analyst Defense Labs |
| Lab environment | Browser-based | Persistent forensic VMs | Persistent forensic VMs | All environments |
| Access | 365 days | 365 days | 365 days | 365 days |
| Price | $147 one-time |
$697 one-time |
$997 one-time |
$1,497 one-time · save $643 |
| Learn More | Learn More | Learn More | Get the Bundle → |
* Payment plans available via PayPal · 100% money-back guarantee within 72 hours
Not Sure Where to Start?
Match your experience level to the right training path.
What Analysts Are Saying
From SOC analysts to senior DFIR engineers — real feedback from real defenders.
The practice labs are on another level compared to Analyst I. Way more data, way more artifacts to correlate. Proper timelines and IOC documentation suddenly become non-negotiable, exactly like in a real investigation. The IR300 lab with its fully simulated APT attacks was pure joy.
As someone who does DFIR for a living, spending my evenings on this does feel like “work after work.” But honestly? It’s pure fun. I get to examine new and old attacker techniques, experiment with rarely used tools, and actually feel my analytical skills getting sharper with every lab session. This is exactly the kind of “work” I’ll gladly stay up late for.
Tim Coerlin
DFIR Engineer, Telekom Security
Highly recommend this to anyone who wants to battle-test their forensic investigative methods. I came in already knowing a lot of the lecture material, but the 4 labs and final exam helped solidify my investigative processes. Building a timeline helped me create a cohesive story of what happened. Markus’s labs exceeded my expectations.
Michael Cheng
Cybersecurity Analyst · GCFA · PWFA
The course was well structured, highly informative, and I recommend it to anyone interested in digital forensics. The virtual lab scenarios provided a very useful method of putting what you learn to practice — I only learn by doing. The exam was very challenging, exciting, and truly felt like I was in the middle of a real investigation.
Griffin Stiens
Senior Analyst, CrowdStrike
This Windows-focused digital forensics certification simulated a real-world, week-long incident response scenario — really similar to one I recently handled in practice a few weeks ago. A great way to validate and strengthen my skills in Windows forensics and incident response.
Luca M.
Cyber Security Specialist, CybergON
We simulated each phase of a ransomware attack, from initial infection to execution. This approach not only enhanced my understanding but also honed my practical skills in real-world scenarios. The blend of knowledge and hands-on practice was a career-enhancing experience.
Glenn McDowell
Manager of Detection and Response
I thoroughly enjoyed the training, scenarios, and exam. The investigative process felt like solving puzzles, following trails of evidence, and piecing them together to prove or disprove hypotheses. The exam was a challenging and highly practical experience.
Menno van Veenendaal
PWFA — Passed with Distinction
Just wrapped up one of the most solid forensic courses I’ve taken. Really glad to have gotten the award with distinction for scoring over 85%. It’s rare to find training that’s this focused and immediately useful. Here’s to more timelining and hunting!
Seifer Rija Boado
DFIR / Security Analyst, Continent8
In November 2024 I began my DFIR journey with Markus and Blue Cape Security. Reflecting on the experience, I’m truly grateful for how much I’ve learned and how far I’ve come. This training has made me a better cybersecurity practitioner. I look forward to learning even more as I move to the next level.
David Mendoza Jr.
Information Security Manager
Just in the first module I learned to manage Active Directory, Group Policy Objects, and deploy attack simulations. Markus’s experience shows in the course material. I can already foresee the course being a must for enterprise defenders.
Carlos Espinoza
CIRT Senior Analyst
I’m only past a third of the content and I’m already feeling sad that it’s going to come to an end some day. That’s a feeling I don’t get a lot when doing these kind of courses.
Mathias
System Engineer
Markus Schober’s expertise shines through, making complex Windows forensics concepts not only understandable but also highly practical. His engaging teaching style and real-world examples make this course a must.
Ayoub Labidi
Principal Information Security Consultant
Analyst Core: Enterprise Security Operations
Build the foundational security knowledge every SOC analyst needs — threat behavior, critical log sources, system visibility, and analysis of attacker techniques through hands-on labs.
What’s Included
- Enterprise Security Operations course
- 9 domains, 28 video lessons
- 39 hands-on labs
- Browser-based lab environments
- 365-day access
Who It’s For
- Junior–intermediate SOC analysts
- IT staff transitioning to security
- Red teamers wanting defender fundamentals
- System administrators
Analyst I: Practical Windows Forensics
Investigate real Windows systems using core forensic artifacts, timelines, and evidence-based analysis. Build hands-on skill with disk images and memory dumps, then prove your readiness with the PWFA certification exam.
What’s Included
- Practical Windows Forensics course
- 8 domains, 17 video lessons, 52 labs
- 4 investigation scenarios (FOR200)
- PWFA certification exam (2 attempts)
- Persistent forensic lab VMs
- 365-day access
Who It’s For
- SOC analysts
- Incident responders
- Digital forensic investigators
- IT professionals with foundational security knowledge
FOR200 Investigation Scenarios
PWFA Certification
7-day hands-on forensic investigation exam. Analyze a compromised Windows system, reconstruct attacker activity, and deliver a professional DFIR report. Passing earns a lifetime-valid certification. Two exam attempts included.
Analyst II: Advanced Enterprise DFIR
Enterprise-scale incident response. Investigate multi-host environments with memory forensics, SIEM log correlation, malware behavior analysis, and full ransomware attack reconstruction using Splunk, Velociraptor, and advanced forensic utilities.
What’s Included
- Advanced Enterprise DFIR course
- 7 domains, 30 video lessons, 58 labs
- 3 investigation scenarios (IR300)
- Persistent forensic lab VMs
- 365-day access
Who It’s For
- Intermediate–advanced SOC analysts
- Threat hunters
- Incident responders managing enterprise threats
IR300 Investigation Scenarios
Hero Bundle: The Complete Analyst Training
Everything in one package — all three tracks plus 12 months of Analyst Defense Labs. The most cost-effective way to go from SOC fundamentals to advanced incident response.
✓ Analyst I: Windows Forensics + PWFA
✓ Analyst II: Advanced Enterprise DFIR
7 investigation scenarios
PWFA certification (2 attempts)
Persistent forensic VMs
Analyst Defense Labs
Monthly investigation scenarios for working SOC analysts. Each lab drops you into a realistic case with logs, artifacts, and a guided in-browser environment. New scenarios added regularly.
Frequently Asked Questions
What tools or software do I need?
What’s the difference between the tracks?
Can I upgrade from one track to the Hero Bundle later?
Is there a payment plan?
What is the PWFA certification?
How long do I have access?
What’s your refund policy?
What is Analyst Defense Labs?
Ready to Start Investigating?
Questions? Contact us or join our Discord.