Overview

About the course

The Conducting Forensic Analysis and Incident Response Using Cisco Technologies (CBRFIR) v1.0 course is a 5-day training program focused on building your skills in Digital Forensics and Incident Response (DFIR). This course prepares you to effectively identify, analyze, and respond to cybersecurity threats, vulnerabilities, and incidents using Cisco technologies. You’ll gain hands-on experience with digital forensics, incident response frameworks, and cybersecurity threat analysis to proactively audit and defend against future attacks. The course also prepares you for the 300-215 CBRFIR exam.

Audience Profile

• SOC Analysts (Tiers 1-2)
• Threat Researchers
• Malware Analysts
• Forensic Analysts
• Incident Response Analysts
• Security Engineers
• Computer Telephony Integration (CTI) Analysts

Job role: Forensic Analyst, Incident Response Specialist
Preparation for exam: 300-215 CBRFIR

Course Details

• Duration: 5 days
• Course Delivery: Online or Classroom
• Cisco Learning Credits: 40

Prerequisites

• Experience in network and endpoint security concepts
• Familiarity with network intrusion analysis and log analysis
• Understanding of security policies, risk management, and APIs
• 2-3 years of experience in a Security Operations Center (SOC)
• Recommended prior courses:
  • CBRCOR (CyberOps Core)
  • CBROPS (CyberOps Associate)
  • Splunk Fundamentals

Course Objectives

By completing this course, you will:

• Conduct root cause analysis and generate incident response reports
• Utilize tools like YARA for malware detection
• Leverage the MITRE ATT&CK framework for threat analysis
• Use scripting to parse logs and analyze data from tools like Cisco Umbrella, AMP, and Sourcefire IPS
• Conduct forensic analysis on host-based and network-based incidents
• Develop incident response playbooks and post-incident recommendations
• Analyze threat intelligence formats (STIX, TAXII)

Modules Covered

• Incident Response and Forensic Analysis Frameworks
• Digital Forensics Guidelines and Tools
• Threat Detection and Analysis Techniques
• Root Cause Analysis and Reporting
• Breach Containment and Incident Mitigation
• Hands-on labs using Cisco SecureX, Stealthwatch, and ThreatGrid

Certification

• Associated Certification: Cisco CyberOps Professional
• Core Exam: 300-215 CBRFIR