FOR608: Enterprise-Class Incident Response & Threat Hunting
About This Course
When attackers breach an enterprise, they don't stop at one machine, and neither can you. FOR608 teaches you to hunt and respond at scale, across hundreds or thousands of systems spanning Windows, Linux, macOS, containers, and cloud platforms. You'll learn to collect the right data fast, automate where it matters, and begin leveraging AI-assisted workflows to accelerate investigations. From proactive deception and threat intelligence to cloud IR in Microsoft 365 and AWS, this course equips you to lead the response when the stakes are highest.
Enterprises today have thousands — maybe even hundreds of thousands — of systems ranging from desktops to servers, from on-site to the cloud. Although geographic location and network size have not deterred attackers in breaching their victims, these factors present unique challenges in how organizations can successfully detect and respond to security incidents. Our experience has shown that when sizeable organizations suffer a breach, the attackers seldom compromise one or two systems. Without the proper tools and methodologies, enterprise incident response security teams will always find themselves playing catch-up, and the attacker will continue to achieve success. This course also prepares students for the GEIR certification (GIAC Enterprise Incident Response), which validates advanced skills in large-scale, coordinated response operations.
What You'll Learn
- Use collaboration tools for seamless remote teamwork
- Gather forensic data from on-prem and cloud sources (M365, AWS)
- Analyze Linux, Mac, and containerized (e.g., Docker) environments
- Correlate data (network, endpoint, etc.) to uncover attacker actions
- Analyze structured and unstructured data to reveal attacker behavior
- Enrich data to identify IOCs, create detection signatures, and track incidents
Entry Requirements
FOR608 is an advanced level course that skips over introductory material of Windows host- and network-based forensics and incident response. This class is not necessarily more technical than our 500-level classes, but it does assume that knowledge so that topics and concepts are not repeated.
More information on the course syllabus and topics covered can be found on our website here: https://www.sans.org/cyber-security-courses/enterprise-incident-response-threat-hunting