Network traffic is the most honest witness in a cyber investigation. Attackers can clear logs, delete files, and wipe systems, but network flows, PCAP captures, and DNS queries often remain as evidence of what occurred, when, and through which systems. The analyst who can read this evidence fluently has a significant investigative advantage. XNFA is built for DFIR professionals, SOC analysts, and threat hunters who want to develop network forensics as a core specialism.
Across five instructor-led days, participants build capability from network protocol fundamentals through advanced traffic analysis with Wireshark, Zeek, and NetworkMiner, encrypted traffic analysis using JA3 and JA3S fingerprinting, DNS forensics, web proxy log analysis, NetFlow analysis, lateral movement and data exfiltration detection in network evidence, and network evidence timeline reconstruction for investigation. Every session uses real PCAP files from real incidents in a structured forensics workflow.
On Day 5, participants investigate a simulated breach through network evidence only: PCAPs, DNS logs, proxy logs, and NetFlow records. They reconstruct the attack, identify attacker infrastructure, map to MITRE ATT&CK, and produce a professional network forensics report. A senior practitioner assesses methodology and report quality. XNFA certificate and Practitioner Assessment Report issued together.
