By the numbers
So what happens when one of those companies gets compromised? How do you conduct an investigation when there is no centralized logging?
That's exactly why I built this course. To help you become the person who can step in when a company needs it most.
Every single module follows the same rhythm. Every artifact covered in theory has a walkthrough. Nothing is skipped.
I cover the artifact, what it is, and why it matters. Without the theory, the rest doesn't stick.
I generate the artifact live, run it through the common tools, and walk through how to read the output.
You parse the artifact yourself. Each lab adds to your investigation timeline. Piece by piece, the case comes together.
As you progress, your timeline grows and the investigation comes together piece by piece. By the end, you've worked a full intrusion from initial phish to final report.
Plus mini-labs throughout to give you extra reps on individual artifacts.
You work it like a consultant would. Pull the artifacts. Build the timeline. Correlate across hosts. Write the report.
Walk into an interview and talk about a real end-to-end investigation that you ran yourself. Not a tutorial you watched. Not a lab you followed.
If you've seen the name in a DFIR job posting, it's probably in here.
This course works for one specific person. Make sure that's you.
You're a SOC analyst comfortable triaging alerts, you understand the basics of how a SOC operates, and you're ready to take the next step into actually investigating intrusions.
If you've never touched a SIEM, never triaged an alert, and you're still figuring out what a SOC analyst even does, start with the 90-Day SOC Accelerator first. It's also in the Forge.
If you're already five or ten years deep into incident response, you've probably seen most of this material. This is built for the analyst past the basics, ready to become an incident responder.
Already a Forge monthly member? Upgrade to annual →
No. The course is included with Forge membership. The community, simulator, and live calls are part of why it works.
No. It's deep. It has to be, because DFIR is deep. If you want to actually do this work, the time you spend in the material is what makes the difference.
No. We give you real artifact experience, a capstone you can talk through, and the working tools used in the field. Interviews are still up to you.
You lose access. Forge is a membership, not a one-time purchase. The standalone SOC Analyst Course at $499 is a different product if owning content matters more.