CiscoProfessional
Performing CyberOps Using Cisco Security Technologies
CBRCOR · 5 days
View course →
CiscoProfessional5 daysUpdated: July 2026
CBRFIR Training for Your Team — Conducting Forensic Analysis and Incident Response Using Cisco Technologies
The first hours of a serious incident are also when the most evidence gets destroyed — by the responders. Rebooting the wrong host, working on the original disk, keeping the timeline in someone’s head: all fixable habits, but only before the breach that ends up in front of a regulator. CBRFIR (Conducting Forensic Analysis and Incident Response Using Cisco Technologies) trains the disciplined version: evidence acquisition and chain of custody, host and network forensics, malware analysis scoped to response needs, and reporting that stands up to hostile reading.
The course prepares for exam 300-215, a concentration of the Cisco CyberOps Professional certification — the specialization pairing with the CBRCOR core for analysts whose career is investigation. Just as often, it is booked after an incident exposed exactly how improvised the current process was.
We organize delivery through authorized partners with instructors drawn from working incident response practice — live online in your time zone, on site, or as a private group with exercises aligned to your regulatory environment.
Who this course is for
- Incident responders who need defensible forensic method, not just triage instinct
- SOC tier 2/3 analysts adding the forensics concentration to CyberOps Professional
- CSIRT members who handle evidence that may reach HR, regulators or court
- MSSP engineers running investigations across customer environments
What your team will learn
Topic areas below are grouped in our own words. The full official agenda is available on request — it comes from the authorized partner as part of your quote.
- Collecting evidence that survives scrutiny — chain of custody before curiosity
- Host forensics: what disks, memory and logs still remember after the attacker tidied up
- Network forensics — reconstructing what moved, where, and when from captured traffic
- Taking malware apart far enough to answer the response questions, safely
- Building an incident timeline that holds together under a lawyer's reading
- Writing the post-incident report someone can actually act on
Key facts
| Duration | 5 days |
|---|---|
| Level | Professional |
| Prerequisites | Working SOC or incident response experience; CBRCOR-level knowledge recommended |
| Certification | Prepares for exam 300-215 CBRFIR — a CyberOps Professional concentration |
| Formats | Live online (VILT), On-site at your location, Private group, Seats in scheduled groups |
| Languages | English + local-language instructors on request |
Formats and how we organize it
- Live online (VILT)
- On-site at your location
- Private group
- Seats in scheduled groups
One request → three options
Fill in the form below — it takes a couple of minutes. Within 5 business days you compare 2–3 concrete offers — provider, instructor, dates, price below the public list. We contract and administer the delivery end to end. Details:how we work and vendor training.
CBRFIR vs alternatives: which to choose
Factual criteria only — level, duration, audience and certification. The right choice depends on your team's starting point and stack.
Cisco CBRCOR (CyberOps Core)
The mandatory core of CyberOps Professional: incident response process, threat intel and playbooks. CBRFIR is the concentration that goes deep on evidence and forensic analysis. The usual order is core first, concentration second — but experienced responders sometimes reverse it.
Cisco CBRTHD (Threat Hunting)
The other CyberOps Professional concentration: proactively hunting threats that no alert fired on. Choose CBRTHD to find intrusions earlier; CBRFIR to investigate them rigorously once found. Mature SOCs eventually want both skill sets on the roster.
A custom intensive
Building an in-house forensic capability from scratch — evidence handling policy, jump kits, first-responder procedures for your IT staff? A custom program on our materials sets that up around your legal and regulatory context.
Need only part of CBRFIR?
If your team needs a subset of this program — or a mix of topics from several courses — we build a custom 2–4 day intensive on our own materials, shaped by your infrastructure. One custom program typically replaces 2–3 catalog courses.
Explore custom coursesCBRFIR: frequently asked questions
How does CBRFIR fit into the CyberOps Professional certification?
It prepares for exam 300-215, one of the concentration exams. Passing it together with the core exam 350-201 (the CBRCOR course) completes CyberOps Professional. Analysts choose this concentration when forensics and incident response is their intended specialization.
Do participants need prior forensics experience?
No — forensic method is taught from the ground up. What they do need is real SOC or incident response background: comfort with logs, alerts and operating system internals. The course builds the forensic discipline on top of that operational base.
Does the course cover legal admissibility of evidence?
It covers the technical practices that make evidence defensible — acquisition order, integrity verification, chain of custody, documentation. Jurisdiction-specific legal requirements vary; for regulated industries we can add a custom module with your compliance context.
How much malware analysis is included?
Enough to serve incident response: safe handling, behavioral analysis, and extracting the indicators needed for scoping and containment. It is not a reverse-engineering course — teams needing deep binary analysis should say so in the form and we scope a custom extension.
How do we organize CBRFIR training?
Fill in the request form on this page — team size, format, timing. Within 5 business days you receive 2–3 options from authorized partners with vetted instructors, dates and prices below public lists.
Request 2–3 CBRFIR training options — quotes within 5 business days
No commitment — describe the task and we come back with concrete options, dates and prices.
Cisco, CBRFIR and course names are trademarks of their respective owners. Uptime Skills is an independent training operator and is not affiliated with or endorsed byCisco. Official courses are delivered by authorized training partners.