SANS 2026 DFIR Summit Solutions Track

SANS 2026 DFIR Summit Solutions Track delivers a deep technical exploration of the tools, methodologies, and operational models driving next-generation digital forensics and incident response. Sessions focus on advanced evidence acquisition, host and network artifact analysis, memory forensics, cloud-native IR workflows, and the application of machine learning to accelerate triage and attribution. 

 Attendees will learn how to operationalize automation, standardize investigative pipelines, and integrate DFIR technologies into high-scale, distributed environments to improve precision, reduce dwell time, and harden enterprise response capabilities.

 What to Expect

• Technical walkthroughs of emerging DFIR tooling—including endpoint telemetry pipelines, memory forensics frameworks, malware analysis sandboxes, and automated evidence extraction workflows.
• Deep-dive case studies detailing attacker tradecraft, artifact correlation strategies, cross-host timeline reconstruction, and cloud IR techniques across AWS, Azure, and GCP.
• Practical guidance and reference architectures for building scalable DFIR environments with automated triage, standardized enrichment, and integrated SOAR/EDR workflows.

Who Should Attend

• DFIR practitioners, digital forensic examiners, threat hunters, and reverse engineers seeking advanced, tool-focused investigative techniques.
• Incident response leads and SOC engineers responsible for building automated triage pipelines, forensic readiness strategies, and high-throughput investigation environments.
• Security architects and platform engineers integrating DFIR telemetry, EDR/XDR data, and cloud-native artifacts into centralized analysis and response systems.
• Organizations evaluating next-gen DFIR platforms, scaling IR operations, or adopting automation and ML-driven investigative workflows.