SANS 2026 DFIR Summit Solutions Track

SANS 2026 DFIR Summit Solutions Track delivers a deep technical exploration of the tools, methodologies, and operational models driving next-generation digital forensics and incident response. Sessions focus on advanced evidence acquisition, host and network artifact analysis, memory forensics, cloud-native IR workflows, and the application of machine learning to accelerate triage and attribution. 

 Attendees will learn how to operationalize automation, standardize investigative pipelines, and integrate DFIR technologies into high-scale, distributed environments to improve precision, reduce dwell time, and harden enterprise response capabilities.

 What to Expect

• Technical walkthroughs of emerging DFIR tooling—including endpoint telemetry pipelines, memory forensics frameworks, malware analysis sandboxes, and automated evidence extraction workflows.

• Deep-dive case studies detailing attacker tradecraft, artifact correlation strategies, cross-host timeline reconstruction, and cloud IR techniques across AWS, Azure, and GCP.

• Practical guidance and reference architectures for building scalable DFIR environments with automated triage, standardized enrichment, and integrated SOAR/EDR workflows.

Who Should Attend