Cloud DFIR Foundations (Logs, Identity Trails, Cloud Evidence Capture)

Cloud DFIR Foundations is designed for analysts who need to investigate cloud incidents using the evidence that cloud platforms actually provide: audit logs, identity trails, and service telemetry. You will learn how to frame an investigation, pull the right signals, and build a defensible narrative without relying on assumptions. This approach maps to established incident handling lifecycles, including detection and analysis, containment, and recovery.

Delivered through mentor-led sessions, the course uses practical scenarios to develop a repeatable, tool-agnostic workflow: define the question, identify the evidence sources, collect and preserve evidence responsibly, correlate events into timelines, and write a clean handover. The evidence capture discipline is guided by recognised digital forensic process thinking, with a focus on integrity and documentation.

Across two intensive days, you will produce investigation outputs that are usable in real SOC and IR operations: cloud evidence packs, identity pivot notes, and escalation briefs. We also reference modern cloud log management expectations, including why poorly managed cloud logs can make investigations infeasible. Aligned with recognised best practices including ISO, GDPR, NIST and SOC 2, ensuring skills remain practical and deployable in real organisations. All prices are exclusive of VAT (where applicable). Group enrolments and custom packages available.