Agentic DFIR Intermediate - 4 days - 4200€ HT
Description
Language models and AI agents are changing the way digital investigations are conducted: collection analysis, parser writing, query and detection rule authoring, malware triage. This course offers a practical and critical approach, starting from the manual analysis of a realistic compromise and going all the way to its automation, while keeping control over the limits and risks of AI.
Over these four days, you will learn to design, equip and evaluate agents to speed up your incident response. Given the recent and fast-moving nature of this topic, Synacktiv reserves the right to modify the course content according to the latest developments.
-
4 days (28 hours)
-
From the fundamentals of language models to the design of an incident response agent
-
Realistic compromise investigated end to end, first manually then with agents, based on ORC and UAC collections, firewall logs, malware and memory
-
Windows and Linux investigation
Objectives
- Understand how language models work, and their capabilities and limits when applied to digital investigation
- Design, equip and evaluate AI agents to speed up the analysis of collections, logs and malicious code
- Master the forensic requirements and security risks specific to agents (traceability, evidence integrity, prompt injection)
Public and prerequisites
This course is suited for digital investigation professionals who want to integrate agentic AI into their practices, notably:
-
SOC analysts
-
Incident response analysts
-
Forensic investigators
Experience in Windows and Linux digital investigation, good command line skills and a basic level of Python are required. No prior knowledge of artificial intelligence is necessary.
Content
Day 1
Language models: how they work and their limits (tokens, context window, specialized models, reasoning models), model classes (proprietary and open-weight, local or cloud deployment, selection criteria), capabilities and data confidentiality. Vibe coding and parsers: overcoming the historical difficulties of investigation through vibe coding, rapid creation of a parser for an undocumented technology, identification of relevant information in logs, known formats (JSON, CSV/TSV, SQLite, ESE, key-value) and limits of unknown formats (encryption, entry delimitation, naive extraction). DFIR collectors: ORC and UAC, configuration and content of the archives, manual processing and pipeline. Workshop: setting up the common thread with a first manual analysis of the collection, then deploying agents to identify an artifact without prior knowledge.
Day 2
Anatomy of an agent: reasoning and action loop, tool calling, context management, instructions, tooling protocols, skills and the value of sub-agents, tool-based approach versus code generation, model size, existing agents, development frameworks and model access gateways. Validation and data volume: writing and automated testing of detection rules, MITRE ATT&CK coverage, processing data volumes that exceed a model’s capacity. Collection exploitation: timeline, anomaly detection, persistence and memory. Workshops: writing skills, generating queries for EDR/XDR and SIEM solutions (SPL, KQL), processing large volumes of firewall logs and persistence mechanism cases.
Day 3
Agent-assisted malware analysis: analysis of malicious code by levels of complexity (obfuscated commands, web shells, multi-stage scripts, binaries). Indicators and detection: indicator extraction and YARA rule generation. Specialized or generalist agent: attack surface, auditability and control. Workshop: malware analysis and memory analysis.
Day 4
Incident response mini-agent: design through prompt iterations (“vibe coding”), from specification to deployment on a compromised Linux system. Trust in results: agent evaluation (use case: web compromise) and forensic requirements (traceability, evidence integrity, reproducibility). Agent security: prompt injection and risks related to third-party tools. News and outlook. Workshop: orchestration of the week’s work and writing assistance.
All the details regarding how the training is conducted are described on this page.