75th TF-CSIRT Meeting: Reykjavik: Agenda

Trainer: Vilius Benetis

Full day training: 09:00 – 17:00

The success of CSIRT/SOCs often depends on how well the team is managed. This training is one of the few available that specifically targets CSIRT/SOC managers, inspiring, motivating, and upskilling them while fostering friendships with other CSIRT/SOC managers. The training is intended for current and future senior and mid-level managers of CSIRTs, SOCs, ISACs, and PSIRTs. The training's objective is to provide time for reflection and collective work on the daily questions and concerns of CSIRT/SOC managers, including KPIs, improving clarity in mandates and strategies, managing stakeholders, developing processes, and achieving process maturity. There will be dedicated time to build relationships between managers and support each other through discussion. This training is an add-on edition of a similar, well-evaluated training delivered at previous TF-CSIRT/FIRST events. Based on feedback, new topics have been added, with a focus on processes and stakeholders.

Trainer: Michael Hamm

Half day training: 9:00 - 13:00

Tools, Tools, Tools, analysts love it to have a large collection of forensics tools available, to perform the analysis and present the results. Unfortunately often the analysts do not exactly know how the tools come to the results. And so, if the tools fail and present wrong results the analyst do not know what is going wrong.

This training will start with a little demo. Different tools produce different output. Than we will:
1. Read a stream of Bit
2. Apply addressing to it
3. Learn to interpret values like integer, signed integer or ASCII
4. Be able to convert a little endian value into a big endian
5. Apply a data structure on the data
6. Recover data manually

At the end of the training the attendee will be able to read a MBR/BootSector and read the partition table manually.

Trainers: Dana Ludviga and Armīns Palms

Full day training: 09:00 – 17:00

Course attendees will acquire hands-on experience in building a powerful DNS Threat Intelligence system with active DNS protection using open-source solution called OpenNameShield. The workshop will cover key areas such as Docker for containerized project management, setting up a DNS server with BIND9, implementing DNS firewalls with Response Policy Zones (RPZ), and using the ELK stack (Elasticsearch and Kibana) for traffic monitoring and analysis. Participants will also learn log normalization and enrichment using rsyslog and Python3, and how to optimize system performance with REDIS to manage outgoing requests efficiently.
By the end of the workshop, attendees will have developed a fully functional OpenNameShield system capable of real-time DNS blocking, DNS threat-hunting, and identifying infected devices based on block statistics, equipping them with the skills to implement their own DNS threat intelligence systems.

Trainer: Thorben Jändling

Half day training:

Take an analyst through triage, investigation, and threat hunting in Elastic Security.