What Your Team Will Be Able to Do
After the workshop, your investigators run cases in DFIRe without guesswork — from intake to closing report.
Open and run a case end-to-end
Triage intake, assign a team, attach evidence, track custody, document findings, and produce a defensible investigation report.
Handle evidence safely
Use DFIRe's encrypted attachment pipeline, chain-of-custody transfers, and direct-storage tier for large forensic images — without breaking encryption guarantees.
Work with IOCs and threat intel
Manage indicators with TLP and enrichment workflows, ingest from MISP, and publish through the built-in TAXII 2.1 server.
Automate the repetitive parts
Apply runbooks to cases and items, build playbooks and workflows, and wire DFIRe into Slack, Jira, and webhook-driven systems your team already uses.
Curriculum
Six modules across four hours. Hands-on throughout, with Q&A interspersed and a longer Q&A block at the end.
Case Lifecycle & Team Workflows
Investigation versus incident modes. Case statuses (OPEN, CLOSED, ARCHIVED) and write protection. Team roles — lead investigator, investigator, viewer — and the practical implications of each. Working with unassigned cases.
Evidence Handling & Chain of Custody
Items, attachments, and the parent-child hierarchy. How DFIRe's three-layer key hierarchy protects evidence at rest. Custody transfers, the immutability model, and when to use a correction transfer. Direct-storage tier for forensic disk images.
Threat Intelligence & IOCs
The indicator registry, STIX types, TLP handling, and the TLP:RED publish gate. Multi-provider enrichment. Operating the built-in TAXII 2.1 server. Pulling threat intel from a MISP feed.
Workflows, Runbooks & Automation
Attaching runbooks to cases and items, and the snapshot pattern that keeps in-flight work stable. Designing playbooks. Workflow automation for repeatable response patterns. When to automate and when not to.
Reporting & Integrations
Investigation reports and CAN reports. The timeline view and timeline events. Slack and Jira integration. Outgoing webhooks — design, retries, and SSRF protection. Optional: AI-assisted report generation and the MCP server.
Administration & Security
RBAC roles and case-scope versus tenant-wide capabilities. The audit log and its fail-closed behavior. Backup and restore. SSO via OIDC. Operational guardrails to keep your deployment secure as the team grows.
Format & Delivery
A live remote workshop, scheduled around your team's timezone.
What's Included
- Four hours, live over Zoom, Google Meet or Microsoft Teams
- Up to 20 attendees from a single organisation
- Workshop recording shared with attendees for internal reuse
- Slides and reference materials provided
- Scheduled at a time that suits your team's timezone
Workshops are delivered by the platform's author, Antti Kurittu. Lead time is typically four to six weeks. Larger groups or multi-session formats can be quoted on request.
Pricing
All prices in EUR, VAT 0% (reverse charge for EU B2B; standard rules apply within Finland).
Workshop Only
- 4-hour live workshop
- Up to 20 attendees
- Recording included
- Slides & materials included
License + Workshop Bundle
- Annual License (post-1.7.2026 list: €9,900)
- Workshop (€3,500)
- Bundle saving: €900
- Workshop scheduled within 90 days of purchase
How to Book
A short, low-friction process. We'll have you scheduled in days, not weeks.
Send an enquiry
Email [email protected] with your preferred format (remote or on-site), team size, target timezone, and a rough date window. Mention if you're combining with a new license.
Confirm scope & date
A short call or email exchange to confirm the curriculum fits your team's level and to lock in a date. Lead time is typically four to six weeks; rush slots quoted on request.
Invoice & payment
Invoice issued by DFIRe Oy with Net-30 terms, SEPA bank transfer. Reverse-charge VAT for EU B2B; standard Finnish VAT within Finland; out of scope for non-EU.
Workshop day
Live delivery on the agreed date. Recording shared with attendees within one business day. A follow-up email captures any open questions and shares the slide deck.