Training
Featured CourseView All Courses
Get a free hour of SANS training

Experience SANS training through course previews.

Learn More
Learning Paths
FeaturedView all Focus Areas
Cloud Security Training
Can't find what you are looking for?

Let us help.

Contact us
Resources
SANS Community Benefits

Connect, learn, and share with other cybersecurity professionals

CISO Network

Engage, challenge, and network with fellow CISOs in this exclusive community of security leaders

Join the SANS Community

Become a member for instant access to our free resources.

Sign Up
For Organizations
Public Sector

Mission-focused cybersecurity training for government, defense, and education

Partnerships

Explore industry-specific programming and customized training solutions

Sponsorship Opportunities

Sponsor a SANS event or research paper

Interested in developing a training plan to fit your organization’s needs?

We're here to help.

Contact Us
Talk with an expert
Talk with an expert

FOR509: Enterprise Cloud Forensics and Incident Response

FOR509Digital Forensics and Incident Response
  • 6 Days (Instructor-Led)
  • 36 Hours (Self-Paced)
Course created by:
David CowenJosh LemonPierre LidomeMegan Roddie-Fonseca
David Cowen, Josh Lemon, Pierre Lidome & Megan Roddie-Fonseca
Register NowCourse Preview
FOR509: Enterprise Cloud Forensics and Incident Response
Course created by:
David CowenJosh LemonPierre LidomeMegan Roddie-Fonseca
David Cowen, Josh Lemon, Pierre Lidome & Megan Roddie-Fonseca
Register NowCourse Preview
  • GIAC Cloud Forensics Responder (GCFR)

    Learn about certification

  • 36 CPEs

    Apply your credits to renew your certifications

  • In-Person, Virtual or Self-Paced

    Attend a live, instructor-led class at a location near you or remotely, or train on your time over 4 months

  • Intermediate Skill Level

    Course material is geared for cyber security professionals with hands-on experience

  • 20 Hands-On Lab(s)

    Apply what you learn with hands-on exercises and labs

Jump to:

Learn how to uncover new evidence sources that only exist in the cloud. Expand your ability to perform enterprise cloud forensics and incident response.

Featured Quote

FOR509 was absolutely awesome! The depth of knowledge is unparalleled. I see this becoming a very popular class in the future.
Terrie MyerchinAT&T

Course Overview

The world is changing and so is the data we need to conduct our investigations. Cloud platforms change how data is stored and accessed. They remove the examiner's ability to directly access systems and use classical data extraction methods. Unfortunately, many examiners are still trying to force old methods for on-premises examination onto cloud-hosted platforms. Rather than resisting change, examiners must learn to embrace the new opportunities presented to them in the form of new evidence sources. FOR509: Enterprise Cloud Forensics and Incident Response addresses today's need to bring examiners up to speed with the rapidly changing world of enterprise cloud environments by uncovering the new evidence sources that only exist in the cloud.

What You’ll Learn

  • Master the tools, techniques, and procedures necessary to effectively locate, identify, and collect data no matter where it is located
  • Identify and utilize new data only available from cloud environments
  • Utilize cloud-native tools to capture and extract traditional host evidence
  • Quickly parse and filter large data sets using scalable technologies such as the Elastic Stack
  • Understand what data is available in various cloud environments

Business Takeaways

  • Understand digital forensics and incident response as it applies to the cloud
  • Identify malicious activities within the cloud
  • Cost-effectively use cloud-native tools and services for DFIR
  • Ensure the business is adequately prepared to respond to cloud incidents
  • Decrease adversary dwell time in compromised cloud deployments

Meet Your Authors

Slide 1 of 0

Course Syllabus

Explore the course syllabus below to view the full range of topics covered in FOR509: Enterprise Cloud Forensics and Incident Response.

Section 1Microsoft 365 and Graph API

Before you can begin exploring the universe of cloud data, you must learn where and how it exists. In this section, you will explore common cloud concepts such as snapshots and cloud flows. You will understand what kind of logging and data access is provided by each cloud architecture and how to extract and process this data.

Topics covered

  • SOF-ELK
  • Key Elements of Cloud for DFIR
  • Microsoft 365 Unified Audit Log
  • Microsoft Graph API

Labs

  • Visualize Data in SOF-ELK
  • Suspicious Email
  • Extortion
  • Privilege Escalation with Graph API

Section 2Microsoft Azure

One of the most popular cloud providers for large enterprises is Microsoft Azure. Azure offers an impressive array of services and with that comes numerous data sources for us to explore. In this section, we will learn about the various Azure activity and diagnostics logs. Finally, we will find out how to deploy our own analysis tools in the cloud.

Topics covered

  • Understanding Azure
  • VMs, Networking, and Storage
  • Log Sources for IR
  • Virtual Machine Logs
  • In-cloud IR

Labs

  • Using SOF-ELK with Azure Logs
  • AAD Password Spray
  • Tracking Resource Creations
  • Detecting Data Exfiltration

Section 3Amazon (AWS)

Now it's time to turn to the market leader in cloud services. In this section we will explore how AWS can be used for the responder, how to deploy your own analysis system into your region, the new and relevant log sources for your investigation and how to bring it all together in lab scenarios designed to help you quickly solve the most common AWS cases.

Topics covered

  • Understanding IR in AWS
  • Networking, VMs, and Storage
  • Log Sources for IR
  • Event Drive Response
  • In-cloud IR

Labs

  • Reviewing CloudTrails Logs
  • Finding Rogue VMs
  • VPC Flow Logs and Route 53 Logs
  • S3 Analysis
  • Tracking Lateral Movement

Section 4Google Workspace

This section will start with a high-level overview of Kubernetes and the logs available in each of the cloud providers. As one of the first SaaS solutions for organizations dating back to 2006, Google Workspace has a wide array of evidence artifacts for investigators to use when conducting incident response or internal investigations.

Topics covered

  • Kubernetes Forensics and IR
  • Understanding Google Workspace
  • Google Workspace Evidence
  • ATT&CKing Workspace

Labs

  • Kubernetes Log Analysis
  • Google Workspace Admin BEC
  • OAuth Abuse with Third-Party Apps
  • Google Workspace Data Exposure
  • Collecting Workspace Logs in GCP via CLI

Section 5Google Cloud

Google Cloud fundamentally changes how identity access management is treated compared to AWS and Azure. Using a combination of the GCP platform, its built-in auditing, agent-based logging, and external log analysis tools like ELK, this section will teach DFIR professionals with limited knowledge of GCP how to conduct investigations into common attacks.

Topics covered

  • Understanding Google Cloud
  • Log Sources, Collection, & Log Routing
  • VM & Storage Investigations
  • Google Cloud Network Forensics

Labs

  • Google Cloud IAM and Access Tracking
  • Collecting Logs in Google Cloud via CLI
  • Google VM and Ops Agent Log Analysis
  • Storage Abuse and Exfil
  • Google Cloud: Network Forensics

Section 6Multi-Cloud Intrusion Challenge

In the final section, students will form teams to solve an intrusion that spans all three major cloud providers. Students will need to refer to all their new knowledge for the week and divide and conquer the evidence to find out how the intrusion occurred. Multiple interconnected cloud systems will be examined as students work to determine what happened.

Things You Need To Know

Relevant Job Roles

Cyber Incident Responder

European Cybersecurity Skills Framework

Monitor the organisation’s cybersecurity state, handle incidents during cyber-attacks and assure the continued operations of ICT systems.

Explore learning path

Insider Threat Analysis

NICE: Protection and Defense

Responsible for identifying and assessing the capabilities and activities of cybersecurity insider threats; produces findings to help initialize and support law enforcement and counterintelligence activities and investigations.

Explore learning path

Digital Forensics Analyst

Digital Forensics and Incident Response

This expert applies digital forensic skills to a plethora of media that encompass an investigation. The practice of being a digital forensic examiner requires several skill sets, including evidence collection, computer, smartphone, cloud, and network forensics, and an investigative mindset. These experts analyze compromised systems or digital media involved in an investigation that can be used to determine what really happened. Digital media contain footprints that physical forensic data and the crime scene may not include.

Explore learning path

Threat Detection & Response

Cloud Security

Monitor, test, detect, and investigate threats to cloud environments.

Explore learning path

Digital Forensics (OPM 212)

NICE: Protection and Defense

Responsible for analyzing digital evidence from computer security incidents to derive useful information in support of system and network vulnerability mitigation.

Explore learning path

Military Operations / Law Enforcement Agents

Digital Forensics and Incident Response

Execute digital forensic operations under demanding conditions, rapidly extracting critical intelligence from diverse devices. Leverage advanced threat hunting and malware analysis skills to neutralize sophisticated cyber adversaries.

Explore learning path

Incident Response Team Member

Digital Forensics and Incident Response

This dynamic and fast-paced role involves identifying, mitigating, and eradicating attackers while their operations are still unfolding.

Explore learning path

Cybersecurity Analyst / Engineer

Cyber Defense

As this is one of the highest-paid jobs in the field, the skills required to master the responsibilities involved are advanced. You must be highly competent in threat detection, threat analysis, and threat protection. This is a vital role in preserving the security and integrity of an organization’s data.

Explore learning path

Digital Evidence Analysis (OPM 211)

NICE: Investigation

Responsible for identifying, collecting, examining, and preserving digital evidence using controlled and documented analytical and investigative techniques.

Explore learning path

Course Schedule & Pricing

Looking for Group Purchase Options?Contact Us

GIAC Certification Attempt

Add a GIAC certification attempt and receive free two practice tests. View pricing in the info icons below.

OnDemand Course Access

When purchasing a live instructor-led class, add an additional 4 months of online access after your course. View pricing in the info icons below.

Filter by:
  • Location & instructor

    Virtual (OnDemand)

    Instructed by David Cowen
    Date & Time
    OnDemand (Anytime)Self-Paced, 4 months access
    Course price
    $8,780 USD*Prices exclude applicable local taxes
    Enrollment options
    Self-Paced
  • Location & instructor

    London, GB & Virtual (live)

    Instructed by David Szili
    Date & Time
    Fetching schedule..View event details
    Course price
    £7,160 GBP*Prices exclude applicable taxes | EUR price available during checkout
    Enrollment options
    In-PersonVirtual
  • Location & instructor

    Washington, DC, US & Virtual (live)

    Instructed by Terrence Williams
    Date & Time
    Fetching schedule..View event details
    Course price
    $8,780 USD*Prices exclude applicable local taxes
    Enrollment options
    In-PersonVirtual
  • Location & instructor

    Salt Lake City, UT, US & Virtual (live)

    Instructed by Pierre Lidome
    Date & Time
    Fetching schedule..View event details
    Course price
    $8,780 USD*Prices exclude applicable local taxes
    Enrollment options
    In-PersonVirtual
  • Location & instructor

    Las Vegas, NV, US & Virtual (live)

    Instructed by Terrence Williams
    Date & Time
    Fetching schedule..View event details
    Course price
    $8,780 USD*Prices exclude applicable local taxes
    Enrollment options
    In-PersonVirtual
  • Location & instructor

    Prague, CZ & Virtual (live)

    Instructed by Megan Roddie-Fonseca
    Date & Time
    Fetching schedule..View event details
    Course price
    €8,230 EUR*Prices exclude applicable local taxes
    Enrollment options
    In-PersonVirtual
  • Location & instructor

    Denver, CO, US & Virtual (live)

    Instructed by Terrence Williams
    Date & Time
    Fetching schedule..View event details
    Course price
    $8,780 USD*Prices exclude applicable local taxes
    Enrollment options
    In-PersonVirtual
  • Location & instructor

    Riyadh, SA & Virtual (live)

    Instructed by David Szili
    Date & Time
    Fetching schedule..View event details
    Course price
    $8,900 USD*Prices exclude applicable local taxes
    Enrollment options
    In-PersonVirtual
Showing 8 of 22

Learn Alongside Leading Cybersecurity Professionals From Around The World

Slide 1 of 0

Benefits of Learning with SANS

Instructor teaching class with code in the background

Get feedback from the world’s best cybersecurity experts and instructors

Learning via laptop

Choose how you want to learn - online, on demand, or at our live in-person training events

Learning via laptop

Get access to our range of industry-leading courses and resources