First responders. Digital Forensics and Incident Response.

For all those who need to act first in an emergency before forensic experts take over. The workshop shows which information, clues, and decisions are crucial in the first few minutes to ensure a meaningful forensic analysis later on.

No lab required. No infrastructure hurdles. Artifacts and scenarios from real DFIR operations. Training focuses on decision-making under time pressure, not just knowledge.

Incident Response
DFIR
Preservation of evidence
Remote
2 days
NIS-2
Book now – €1.490 per person →
View content
Workshop details
Format
2-day workshop
Date
28.10.2026 27.01.2027
Execution
Remote
Duration
2 x 8 hours
Participants
12 max
En casa
On request
Trainer
IR Practitioner
1.490 €,- per person net · no lab required

All the things that go wrong in the first 60 minutes.

IT teams react incorrectly without training – not due to incompetence, but because no one has ever practiced making these decisions under real time pressure.

No security concept

︾
Evidence is destroyed before it has been secured – through reboot, scan, or isolation.

Lack of attacker perspective

︾
Those who don't know how attackers operate won't recognize any clues and will secure the wrong things first.

Unclear decisions

︾
Isolation now or monitoring? Block account or monitor? Without training: gut feeling.

External forensics comes too late

︾
Travel time is 4–8 hours. What happens beforehand – or is done wrong – determines the outcome.
"Before forensic experts take over, it's your turn. The workshop shows which information, clues and decisions are important in the first few minutes so that a subsequent forensic analysis is even possible in a meaningful way."

For everyone who needs to act first in an emergency.

Not for beginners. Not for experienced forensic experts. But for the people who are first confronted with the problem, before external support arrives.

 

👤

IT administrators with security responsibilities

Responsible for systems, but rarely prepared for emergencies. This workshop fills that gap.

 

🛡️

SOC Analysts Level 1 / 2

Basic understanding is present, but there is a lack of practice in structured initial contact with an incident under time pressure.

 

🏳️

Internal Security Officer & Incident Manager

Responsible for coordination in an emergency: Clear processes, role clarity and decision-making criteria are needed.

 

⚠️

Not suitable for: Beginners without system responsibility · Experienced forensic experts with established IR processes · Penetration testers (→ ProSec Networks Portfolio) · Management without an IT background.

Five blocks. Two days. One common thread.

The sequence is based on pedagogical principles: first secure the information, then analyze, then decide. Not the other way around. Day 1 lays the foundations and guides participants through the first simulation. Day 2 increases complexity and role division.

  • Incident vs. IT problem: How do I distinguish what really happened?
  • Escalation logic and internal reporting channels: Who needs to be informed and when?
  • NIS-2 reporting obligations: 24-hour initial report, 72-hour full report – what this means in practice
  • Out-of-band communication: why normal company channels are taboo in an incident
  • Transience hierarchy: What disappears immediately, what remains, and why the order is crucial.
  • Creating a RAM dump: DumpIt and WinPMem in practice
  • Back up network connections (netstat snapshot) before isolating.
  • Exporting Windows Event Logs: Security, System, Application – which logs are relevant and when
  • Chain of Custody: Who backed up what, when, on which medium, with which hash
  • Evaluating EDR alerts: what is a false positive, what is real?
  • Detect lateral movement in Windows event logs (4624, 4648, 4768/4769, 4776)
  • Live demo: compromised system – what does the admin see first?
  • Containment decision: Isolation vs. Monitoring – when, what and why
  • Locking an AD account vs. changing the password: Understanding the Kerberos problem
  • Incident Simulation I: first run under time pressure, mistakes allowed
 
 
  • Second simulation: multiple systems simultaneously, increased time pressure, division of roles within the team
  • Incident lead, evidence gathering, communication, management liaison – who does what?
  • Coordinating parallel incidents: Prioritization without information silos
  • Preparing for external forensics: what ProSec needs when they arrive
  • Writing an incident report: what to include, what not to include
  • Briefing management in 3 minutes: situation, measures, risk, recommendation – without technical jargon
  • Lessons Learned and BSI Report: What Needs to Be Documented
  • The 5 most common mistakes as case studies: Decision analysis, not a list of errors
  • Personal action plan: 3 immediately implementable measures, developed in plenary session

Practical experience before academics.

What sets us apart is not the format. It's what our coaches did last week.

Offensive security is part of our DNA. We understand how attackers think and act. That's why we don't teach defense from textbooks, but from real project experience.

The workshop is conducted by practitioners from the ProSec defense project business. The scenarios are based on real DFIR deployments – anonymized, but realistic.

Active Incident Responders

Not academics. Coaches who do this regularly themselves and know what traces attackers leave behind and why certain decisions are fatal.

Genuine artifacts from DFIR operations

The scenarios in the workshop are based on anonymized cases from real ProSec operations. Not a contrived teaching scenario, but rather what actually happens in practice.

Direct transferability

Participants leave the workshop with a clear action plan – without needing external commissioning for each subsequent step.

The 5 most common mistakes in the first 60 minutes.

This is not a contrived scenario. Each of these errors has had consequences in a real incident. Not because IT teams are incompetent, but because no one has ever practiced this situation under real time pressure.

1

Restart server

"Then it will definitely work again." RAM data, running processes and active network connections are thus irretrievably lost.

→ All volatile evidence destroyed. Forensic analysis severely limited.

2

Start antivirus scan

It alters timestamps on affected files and can overwrite artifacts. Forensically worthless afterwards.

→ Timestamps falsified. Not admissible in court or for insurance purposes.

3

Change password instead of locking account

The attacker's Kerberos ticket can remain active for hours. The account is locked, but the attacker is still logged in.

→ Attacker retains access. No real containment despite password change.

4

Screenshots instead of forensic images

Screenshots prove nothing – neither in court nor with the insurance company. Chain of custody begins with the very first action.

→ No evidentiary value. Insurance companies and law enforcement cannot rely on it.

5

Coordinate via Teams or company Slack.

If the infrastructure is compromised, the attacker may be able to read along – including your response strategy.

→ The attacker informs you of your reaction. Out-of-band communication is not a luxury.

Two formats. One curriculum.

Both formats share the same content structure. The difference lies in the context, not the content.

In-house at the customer's premises

On request · individually planned
On request
  • ProSec comes to you. Particularly useful as a follow-up format after a penetration test or AD assessment: The attack paths from the project are directly embedded.
  • Advantages: ProSec's knowledge of the customer environment
  • Environment: No lab infrastructure required
  • GROUPPossible for groups of 4 or more.
Inquire about in-house training →

Open Workshop

January 27, 2027 · 2 days
1.490 €
-
  • Fixed dates, open group of participants. Bookable as an individual or as a team. Conducted entirely remotely – no lab, no setup.
  • Advantages: Flexible booking without project reference
  • Advantages: Exchange with participants from other companies
  • Participants: 12 max · Remote setup incl.
Book an open appointment
12 max

Open Workshop

January 27, 2027 · 2 days
1.490 €
-
  • Fixed dates, open group of participants. Bookable as an individual or as a team. Conducted entirely remotely – no lab, no setup.
  • Advantages: Flexible booking without project reference
  • Advantages: Exchange with participants from other companies
  • Participants: 12 max · Remote setup incl.
Book an open appointment
12 max

Register now.

Open workshop: €1.490 per person net · Remote · October 28, 2026 · January 27, 2027 · Max. 12 participants

 

REGISTRATION FORM

Incident Response

Workshop

Open workshop: €1.490 per person net. In-house format: On request. Contact us – we'll discuss dates and formats.

Book an open appointment →
Inquire about in-house training
edu@prosec-networks.com

Contact form

Share your feedback and help us improve our services!

Share your feedback and help us improve our services!

Take 1 minute to give us some feedback. This way we can ensure that our IT security solutions meet your exact needs.

Survey
Survey