Training and Technical Courses on CIRCL

Introduction to Incident Response

Mon, 01 Jan 0001 00:00:00 +0000

Learning goals

Understand how most security incidents are detected.
Secure evidence after detecting an incident.
Acquire file-system, memory, and network evidence.
Interact with local and international CERTs.
Balance remediation with incident-response requirements.

Audience and prerequisites

This course is intended for IT department staff, managers, and local incident response teams. Basic knowledge of operating systems is required.

Practical information

Duration: 3 hours
Languages: English, French, German, or Luxembourgish

File-system Post-mortem Forensic Analysis

Mon, 01 Jan 0001 00:00:00 +0000

Forensic analysis is based on the principle that every action leaves a trace. This course shows participants how to determine what happened by analyzing the layers from physical media and file systems through to applications.

Learning goals

Perform disk acquisition correctly.
Analyze NTFS and FAT file systems.
Analyze Microsoft Windows artifacts.
Find evidence in communication applications, including browser and chat history.

Audience and prerequisites

This course is intended for IT department staff and local incident response teams. Knowledge of operating systems and IT security is required.

Introduction to Penetration Testing

Mon, 01 Jan 0001 00:00:00 +0000

Defensive controls such as firewalls, VPNs, and endpoint protection are important, but understanding offensive security is also essential. This course presents an attacker’s view of a corporate network and helps participants select appropriate security controls.

Learning goal

Learn to assess your network before others attack it.

Audience and prerequisites

This course is intended for IT security teams and administrators. A good level of IT security knowledge is required.

Practical information

Duration: 1 or 2 days
Languages: English or German
Materials: Introduction to Penetration Testing materials

Introduction to Malware Reverse Engineering

Mon, 01 Jan 0001 00:00:00 +0000

Identifying whether unknown software is malicious or benign is a critical task. In this course, each participant sets up a malware laboratory and learns proven introductory reverse-engineering strategies.

Learning goals

Understand common malware-analysis techniques.
Create a custom laboratory environment.
Collect indicators that help determine whether a file is malicious or benign.
Develop strategies to collect indicators of compromise (IOCs).
Build a solid foundation for further study.

The course does not teach x86 assembly language or cover deep reverse engineering.

MISP Threat Sharing

Mon, 01 Jan 0001 00:00:00 +0000

MISP is an open-source threat intelligence and sharing platform for collecting, storing, correlating, and exchanging information about cybersecurity threats. This practical course shows participants how to share, comment on, and enrich threat information using the platform.

Learning goals

Use MISP to support operational cybersecurity intelligence.
Work with MISP interfaces and APIs to support security operations teams.
Contribute to the MISP ecosystem through code, documentation, taxonomies, and other community resources.

Audience and prerequisites

This course is intended for security engineers, ICT administrators, and analysts. Good knowledge of information-security fundamentals is required.