Learning Paths

Skills

Cyber Defense Forensics Analyst | IN-FOR-002 | Work Role 212

26 courses
43 hours

A cyber defense forensics analyst collects, processes, preserves, analyzes, and presents computer-related evidence in support of network vulnerability mitigation and/or criminal, fraud, counterintelligence, or law enforcement investigations.

This path will get you started on your journey to becoming a cyber defense forensics analyst! Begin with the fundamental concepts of collecting logs and investigating network attacks through hands-on labs, dive into the essential skills necessary to perform the day-to-day functions and then expand your skill set with tools, more advanced concepts and knowledge from adjacent roles!

Path estimated completion time is ~40 hours for total content.

This path aligns to the Knowledge, Skills, Abilities and Tasks (KSAs) within the Workforce Framework for Cybersecurity (CSWF) and the DoD Cyber Workforce Framework (DCWF) for the work role of:

Cyber Defense Forensics Analyst Work Role212 or IN-FOR-002

For complete coverage of skill paths and tooling for the Cyber Defense Forensics Analyst role, please navigate to the supplemental skill paths in the About section.

Courses in this path

Fundamentals

Begin your learning journey with the fundamental concepts of operating systems, networking and collecting security logs through some hands-on labs and courses!

*Note the lab length is showing the allotted time that the environment will be open and available before resetting. The estimated completion time of each lab is 45 minutes.

NICE Framework Overview

by Pluralsight
5m

Enterprise Security: Executive Briefing

by Aaron Rosenmund
39m
(66)

Windows Endpoint Security: Networking

by Michael Teske
21m
(23)

Advanced Cyber Defense Analysis with Wireshark

by Sean Wilkins
2h 31m

Skill Essentials

Now that you know the fundamentals, dive into the essential skills necessary to perform the day-to-day functions and investigations of a cyber defense forensics analyst.

Setting up a Forensic Workstation

by Robert McMillen
1h 2m

Incident Forensics: Digital Media Acquisition

by Ricardo Reimao
1h 31m
(24)

Incident Response: Host Analysis

by Aaron Rosenmund
1h 37m
(13)

Enumerating the Network Infrastructure as a Forensics Analyst

by Phil Chapman
2h 55m

Specialized DFIR: Windows Registry Forensics

by Tyler Hudak
1h 10m
(19)

Malware Analysis Fundamentals

by Tyler Hudak
3h 20m
(166)

Fileless Malware

by Tyler Hudak
1h 40m
(33)

Legal and Ethical Considerations for Digital Forensics

by Bobby Rogers
2h 11m

Expanded Skillset

It's time to expand your skill set with tools, more advanced concepts and emerging malware analysis trends!

This section gives you a brief introduction into many, additional skills that you will find helpful as a cyber defense forensics analyst. We have full training paths on all of these skills; see the Supplemental Skill Paths section to learn more.

AccessData Forensic Toolkit (FTK) Imager

by Phil Chapman
1h 27m
(13)

AccessData Registry Viewer

by Larry Glusman
1h 10m

AccessData Password Recovery Toolkit (PRTK)

by Larry Glusman
1h 58m

OS Analysis with Volatility

by Tim Coakley
27m

Getting Started with Memory Forensics Using Volatility

by Collin Montenegro
1h 21m
(20)

OS Analysis with The Sleuth Kit & Autopsy

by Ashley Pearson
15m

Malware Analysis: Identifying and Defeating Code Obfuscation

by Josh Stroschein
2h 22m
(28)

Performing Malware Analysis on Malicious Documents

by Tyler Hudak
2h 59m
(65)

Malware Detection and Analysis with Python

by Cristian Pascariu
1h 8m

Adjacent Skill Knowledge

Now that you've mastered all the skills for cyber defense forensics analyst, learn about additional cyber roles and their responsibilities.

Getting Started with Reverse Engineering

by Josh Stroschein
3h 40m
(88)

Incident Response: Detection and Analysis

by Aaron Rosenmund
2h 19m
(37)

Incident Response: Network Analysis

by Brandon DeVault
1h 10m
(20)

Incident Response: Containment, Eradication and Recovery

by Aaron Rosenmund
1h 6m

Law, Ethics, and Security Compliance Management

by Christopher Rees
2h 9m
(20)

Learn with the best

Aaron Rosenmund

Aaron M. Rosenmund is a cyber security operations subject matter expert, with a background in federal and business defensive and offensive cyber operations and system automation. Leveraging his administration and automation experience, Aaron actively contributes to multiple open and closed source security operation platform projects and continues to create tools and content to benefit the community. As an educator & cyber security researcher at Pluralsight, he is focused on advancing cyber secur... more

Michael Teske

Michael Teske is a principal security author with Pluralsight helping people build their skills toolkit. Michael has 25+ years of experience in the IT Ops/Cloud/Cybersecurity industry including 17 of those years as an IT instructor at a technical college, focusing on Microsoft server infrastructure, security and automation. Michael attained his MBA with an emphasis in Computer Information System Security several years ago. Michael still keeps up with the industry as an independent consultant in ... more

Sean Wilkins

Sean Wilkins, with over two decades of experience in the IT industry, serves as a distinguished networking consultant and contributor at Tech Building Blocks. His professional journey spans multiple prominent enterprises, underlining his extensive field expertise. Sean's credentials include esteemed certifications from Cisco (CCNP/CCDP), Microsoft (MCSE), and CompTIA (A+ and Network+). Academically, he has achieved a Master’s of Science in Information Technology, specializing in Network Architec... more

Robert McMillen

Professor Robert McMillen is a networking consultant with over 50 technical certifications. He has an MBA where he teaches Windows Server Administration at two colleges, and has earned his MCSE and MCT from Microsoft. Robert McMillen is the president and founder of All Tech 1, a Portland-based network consulting company. Robert has over 20 years of experience in network engineering and earned certifications from companies like Microsoft, Checkpoint, IBM, and Cisco. He also hosts a weekly syndi... more

Ricardo Reimao

Ricardo is a Cybersecurity Consultant based in Toronto (Canada). He has 14+ years of IT experience, 10 of them in the IT Security field. His main interests are: SIEM solutions (IBM QRadar), Enterprise Security Risk, Penetration Testing, Security processes/procedures and Network Security.

Phil Chapman

Phil Chapman is a senior instructor. He is responsible for the delivery of a range of courses including official Microsoft, CompTIA, EC Council and BCS official certifications. He is also the subject matter expert and project lead for the bespoke Law Enforcement Cyber Security training packages which are delivered to UK Law Enforcement agencies and forces. He holds a variety of IT Technical and Security qualifications across many fields. Phil spent 23 years in the Royal Air Force as an Intellige... more

Tyler Hudak

Tyler Hudak has more than 15 years of extensive real-world experience in incident handling, malware analysis, computer forensics, and information security for multiple Fortune 500 firms. He has spoken and taught at a number of security conferences on the topics of malware analysis, incident response, and penetration testing, and brings his frontl ine experience and proven techniques to bear in his training.

Bobby Rogers

Bobby E. Rogers is an information security engineer working as a contractor for Department of Defense agencies, helping to secure, certify, and accredit their information systems. His duties include information system security engineering, risk management, and certification and accreditation efforts. He retired after 21 years in the U.S. Air Force, serving as a network security engineer and instructor, and has secured networks all over the world. Bobby has a master’s degree in information assura... more

Larry Glusman

Larry has been in the IT field for over 30 years, doing break / fix, custom PC builds, SMB network design and maintenance, and just about everything else a SMB may need. Currently doing network administration for a non-profit.

Tim Coakley

Tim Coakley is a Senior Security Solutions Architect for a large multi-national organisation and an author at Pluralsight. Tim started a long and successful full-time career in Digital Forensics supporting the criminal justice system and law enforcement on a long list of criminal cases. Parallel to this Tim ran a research and development business creating solutions from design through to support resulting in some unique and niche software not developed anywhere else. Tim now works fully within t... more

Collin Montenegro

Collin Montenegro is a Cybersecurity professional who is passionate about all things cybersecurity and IT related! He is based out of Las Vegas, NV where he runs the largest local cybersecurity hacker group named Shad0w Synd1cate. He holds a Master's degree in Cybersecurity and Information Assurance where his specialties include incident response, forensics, and other facets of the blue team spectrum. You can reach Collin via Instagram (@collinmontenegro), Twitter (@_Unkn0wn1), LinkedIn, or hi... more

Ashley Pearson

Ashley Pearson is a former system administrator turned threat hunter. She has spent the past 3 years of her 8+ year IT career specializing in cyber security. She currently works as a threat hunter and occasional incident responder or forensic analyst. She continues to feed her passion by actively participating in the InfoSec community, attending conferences, and pursuing higher education. Outside of work, Ashley enjoys running, video games, and reading.

Josh Stroschein

Josh is an experienced malware analyst and reverse engineer and has a passion for sharing his knowledge with others. He is a reverse engineer with the FLARE team at Google, where he focuses on tackling the latest threats. Josh is an accomplished trainer, providing training at places such as Ring Zero, BlackHat, Defcon, Toorcon, Hack-In-The-Box, Suricon, and other public and private venues. Josh is also an author on Pluralsight, where he publishes content around malware analysis, reverse engineer... more

Cristian Pascariu

Cristian took part in auditing and implementation of infosec capabilities to uplift security posture. He managed codification efforts to extract indicators of compromise and created rules in the scope of defending against new emerging threats. He has also developed tools and scripts to overcome security gaps within the corporate network. Cristian has mentored L1 and L2 analysts to increase triage efficiency and combat new threats. He has experience in the field of Application Security and has pr... more

Brandon DeVault

Brandon DeVault is a Security Researcher focused on threat hunting at CrowdStrike. He is also a member of the Florida Air National Guard with a variety of offensive and defensive experience. Prior to joining CrowdStrike, Brandon worked full-time as an author with Pluralsight and at Elastic, creating and delivering security content. He also worked with Special Operations Command, where he had two deployments to Afghanistan on deployable communications teams. His experience spans incident response... more

Christopher Rees

Chris is a professional information technologist, author, trainer, manager and a lifelong learner. He is married with 3 beautiful children and interested in working out, spending time with family and friends and being creative whenever possible. He has been an author for over 25 years and has created over 60 IT Certification training courses. Chris really enjoys helping people advance in their careers through training and personal development.

Contact Sales