Threat Hunting & DFIR Certification
- CCDL2 (formerly CCD)
Investigate nation-state attacks from detection to resolution. Hunt threats, analyze disk and memory evidence, and build detailed attack timelines through real-world investigations.
Key Features
Real-World Readiness
Investigate realistic, multi-stage incidents that mirror actual SOC environments and APT campaigns.
Battle-Tested Content
Trusted by defenders at Microsoft, Kaspersky, PwC, and Accenture who use these skills to protect their organizations every day.
Industry Aligned
Vendor-neutral, hands-on certification with a 48-hour practical exam that tests real investigation skills across enterprise environments.
Comprehensive Coverage
Deep coverage of threat hunting and disk, network, and memory forensics across enterprise environments.
Who It's For
Experienced SOC/Security Analysts
Analysts with 1+ years of experience ready to go beyond alert triage into full incident investigation and response.
Threat Hunters
Professionals who want to proactively uncover threats that evade automated detection across enterprise environments.
DFIR Professionals
DFIR professionals building skills in disk forensics, memory forensics, and end-to-end investigation workflows.
Team Managers & SOC Leads
Organizations seeking a standardized program to validate and develop analysts who can independently handle sophisticated attacks.
What You'll Learn
Through the CCDL2 program, you'll develop the advanced analytical and investigative skills that separate elite SOC analysts from the rest.
Hunt Threats Proactively
Use Elastic SIEM to detect, investigate, and hunt for threats across enterprise environments.
Investigate Disk Evidence
Perform disk forensics to trace attacker activities, recover artifacts, and reconstruct attack timelines.
Analyze Volatile Memory
Conduct memory forensics to uncover malicious processes, injected code, and persistence mechanisms.
Collect & Preserve Evidence
Acquire, handle, and analyze digital evidence following forensic best practices and chain-of-custody procedures.
Build Incident Timelines
Investigate real-world intrusions end-to-end: from initial compromise through lateral movement to data exfiltration.
Investigate With Confidence
Apply your skills across realistic, multi-stage investigations and develop the analytical mindset to handle any incident independently.
Curriculum
Master the skills that define elite SOC analysts
1. SecOps Fundamentals
Understand how SOCs operate, triage alerts, and leverage threat intelligence to detect and prioritize real-world cyberattacks.
2. Incident Response
Apply structured incident response workflows from detection through containment, eradication, and recovery.
3. Email Security
Analyze phishing attacks, BEC campaigns, and email-based threats using real investigation techniques.
4. Evidence Collection
Acquire, preserve, and handle digital evidence following forensic best practices and chain-of-custody procedures.
5. Disk DFIR
Perform disk forensics to trace attacker activities, recover artifacts, and reconstruct attack timelines.
6. Memory DFIR
Conduct volatile memory analysis to uncover injected code, malicious processes, and persistence mechanisms.
7. Threat Hunting
Use Elastic SIEM to proactively hunt for threats, detect lateral movement, and investigate suspicious activity.
8. Malware Analysis
Perform static and dynamic analysis on documents, scripts, and executables to understand attacker tooling.
FAQ
Common questions about CCDL2.
Need More Information? Visit our Help Center for detailed articles about the CCDL2 certification, exam preparation, and more.
Stop Escalating. Start Investigating.
Develop the skills to investigate sophisticated attacks across enterprise environments.