Dropped our Practical Windows Forensic Analyst cert! 🔥👀

bluecapesecurity.com/pwfa

Is this still on?

Just dropped: Our hands-on Windows Forensics investigation scenarios are live! 🔍

-> 20% OFF with code START200

bluecapesecurity.com/practice/#FO...

Enjoy!

We just released a course that embodies our core principles: learn + practice + assess > and it’s free!

DFIR Foundations and Techniques: Professional Skills and Readiness

=> For SecOps and DFIR professionals

Full course: tinyurl.com/mu77u3ab
Youtube playlist: tinyurl.com/2s3n7nfx

#dfir #secops

Still reminiscing about the incredible time at @wildwesthackinfest.bsky.social last week and now counting down to IntelliCon next week in Austin! If you haven’t grabbed your ticket yet, there’s still time: www.intelliguards.com/event-detail...

Final modules for our 301 Enterprise DFIR course have been uploaded. What a journey after developing, analyzing and recording all the materials over many months of work!

I'm excited about the course and also looking forward to head to the WWHF conference next week. Reach out if you are there!

Proud to present our brand new training page and offering for individuals @ Blue Cape Security:

- 301 Enterprise DFIR course launched

- HERO Bundle including 101 / 201 / 301 courses

- Blue Team Master Program is public again

bluecapesecurity.com/individual-t...

HMU for questions or feedback! 💙

We have a giveaway of our brand new course bundle over at LinkedIn for those interested: www.linkedin.com/posts/blueca...

Only 2 more days!

Lots of great things coming next week! 301 Enterprise DFIR course - Launch Party with a special guest, new course bundles and more!

Live Stream: youtube.com/live/MgG_pT1...

Zoom bug: discussions.apple.com/thread/25588...

Since enabling Apple Intelligence an uncontrollable amount of notifications keep popping up (e.g. continuously when I'm screen sharing on Zoom). It doesn't seem they've gotten much smarter navigating me to my webinars either..

🚀 Excited to announce the alpha release of NIMS - a Notion-based Incident Management System!

Designed for SOC/IR teams, NIMS helps streamline incident management and collaboration using Notion's powerful database features.

#InfoSec #DFIR #IncidentResponse #SecOps #Notion

How do you track DFIR timelines and findings? There doesn't seem to be a one size fits all solution in the industry.

Most commonly used are still spreadsheets, where Crowdstrike actually released a pretty nice IR Tracker template a while ago: www.crowdstrike.com/en-us/blog/c...

Sounds interesting. Just subscribed and looking forward to listen to it!

The best conference in the industry is only 1 month away 🤠

I'll be teaching the 2-day Ransomware Attack Simulation and Investigation for Blue Teamers workshop with in-person and virtual seats available!

I’m looking forward to reconnecting with old friends and making new ones at this amazing event!

Good question - here is the more detailed description of the case: www.linkedin.com/posts/blueca...

For those looking to practice a realistic #DFIR scenario, here is a free case for you to investigate.

Provided artifacts:
- Disk Triage Collection
- Memory Image + pagefile.sys:
- PCAP File

Link: bluecapesecurity.com/courses/elev...

AWS: Welcome back! Your t2.xlarge EC2's have been running happily over the holidays 🥲

Practical Windows Forensics - Cheat sheet 💙

Full PDF version: github.com/bluecapesecu...

Looking forward to present our maturity model tomorrow live! Finally visualized the way how we do trainings for teams and individuals.

Link: bluecapesecurity.com/register

Microsoft incident data sets. Haven’t had a chance to test this, but certainly looks interesting.
www.kaggle.com/datasets/Mic...

Oh hey we have a webinar coming up next week!

-> Thursday, December 19th

I'll be sharing our DFIR Training Roadmap that we've been working on since the beginnings of Blue Cape Security (which is more than 2 years now) 🥹

us06web.zoom.us/webinar/regi...

Was just planning on releasing a new DFIR course module on log analysis, but I just uploaded:

2+ hours video
11 Splunk hands-on labs (with over 30 queries)
2 Sigma hands-on labs

Why do these things always get out of hand?

Oh and of course the converter engine: sigconverter.io

#sigmahq