Evergreen Alliance Training Program for GIAC Cloud Forensics Responder (GCFR)

AWS Cloud Platform Logging
The candidate will demonstrate knowledge of the generation, collection, retention, and storage of logs within the AWS environment, and how this data can be leveraged for forensic investigations.

AWS Architecture and Access Methods
The candidate will demonstrate an understanding of AWS architecture, logging mechanisms, data access, and the investigative potential these structures provide.

Azure & M365 Cloud Platform Logging
The candidate will show understanding of the logging processes within Azure and Microsoft 365, including the collection, retention, and storage of log data for forensic analysis.

Azure & M365 Architecture and Access Methods
The candidate will demonstrate an understanding of the architecture of Azure and M365, including how logs are generated, collected, and accessed, and the investigative opportunities these platforms present.

Cloud Forensic Artifact Techniques
The candidate will demonstrate proficiency in identifying and utilizing cloud services, tools, and resources to automate and assist with forensic investigations.

Cloud Storage Platforms
The candidate will demonstrate knowledge of the characteristics of various cloud storage resources, as well as how to create, secure, access, and manage each storage type within the cloud environment.

Cloud Virtual Machine Architecture
The candidate will show an understanding of the various types of virtual machines available across cloud platforms, along with their configuration and availability in different environments.

Cloud-based Attacks
The candidate will demonstrate knowledge of the tactics, techniques, and procedures used in attacks against the computing resources of major cloud providers.

GCP and Google Workspace Cloud Platform Logging
The candidate will demonstrate understanding of log generation, collection, retention, and storage processes within Google Cloud Platform (GCP) and Google Workspace, and how this data can be used for forensic investigations.

GCP and Google Workspace Architecture and Access Methods
The candidate will demonstrate an understanding of the GCP and Google Workspace architectures, how data is logged, collected, and accessed, and how these systems support forensic analysis.

In-Cloud Investigations
The candidate will demonstrate how to collect forensic images and extract data from cloud environments to conduct thorough forensic investigations.

Introduction to Enterprise Cloud Digital Forensics and Incident Response
The candidate will have an understanding of essential cloud concepts, including key cloud resources and logs, and how these resources are used to support incident response and digital forensics.

Multi-Cloud Virtual Networking
The candidate will demonstrate knowledge of networking topologies across multiple cloud environments, including how resources are grouped for network communication, and the methods for inspecting and controlling network traffic.