The DFIR analyst path
You work out what happened after a breach, in enough detail that it stands up later — your findings may end up in a legal process, and how you handle evidence can decide whether it is admissible. It is essentially always entered from a SOC or security analyst role: you need to have watched alerts before you can reconstruct an intrusion from them.
Published 2026-10-09 · generated from the lesson data · serves DFIR analyst
Work the groups in order. Each checkpoint is a gate: do not move on until you can do it unaided. The capstone is level 4 — original work, made public, verifiable by a stranger.
Before you start
This path assumes the SOC analyst path is complete. The role page is explicit: DFIR is a step up from SOC work, not a first job — it does not start at Stage A directly.
Forensics and response
1. DFIR deep: disk, memory, network forensics
Stage D · Specialist
2. Malware analysis: concepts
Stage D · Specialist
3. Log Sources That Matter
Stage C · Professional
4. Writing Detections with Sigma
Stage C · Professional
5. Incident Response Basics
Stage C · Professional
Malware analysis is concepts plus triage workflow here; detonation is reader-side in your own isolated lab.
Checkpoints
- A timeline reconstructed from lab logs or a disk image, with every entry sourced.
- A memory-forensics exercise with documented findings — what you looked for, what you found, what you ruled out.
- A chain-of-custody record maintained across an exercise, unbroken.
- An incident report written for non-technical readers — a lawyer or executive must be able to act on it.
The capstone
Level 4 — Extend: Full forensic case study from a simulated breach. A published case study: timeline, evidence-handling notes, findings, and an executive report — all reproducible from the labeled data you publish alongside it. That is the artifact a hiring stranger checks.