SANS Course: FOR509: Enterprise Cloud Forensics and Incident Response
Certification: GIAC Cloud Forensics Responder (GCFR)
3 Credit Hours
In ISE 6442: Enterprise Cloud Forensics and Incident Response, examiners will learn how each of the major cloud service providers (Microsoft Azure, Amazon AWS and Google Cloud Platform) are extending analyst's capabilities with new evidence sources not available in traditional on-premise investigations. Incident response and forensics are primarily about following breadcrumbs left behind by attackers. This class is primarily a log analysis class to help examiners come up to speed quickly with cloud based investigation techniques. Numerous hands-on labs throughout the course will allow you to access evidence generated based on the most common incidents and investigations. You will learn where to pull data from and how to analyze it to find evil.