TracerFIRE 12 (Sandia x UNLV)

Background

TracerFIRE (Forensic and Incident Response Exercise) for the U.S. Department of Energy (DOE) is a program developed by Sandia National Laboratories to educate and train cyber security incident responders (CSIRs), analysts, and University students in critical skill areas. The program also aims to improve collaboration and teamwork among staff members. Several hundred CSIRs from the DOE, other U.S. government agencies, and critical infrastructure organizations have been trained from this program.

Why should you attend?

Attending this event will provide you with: a unique opportunity to have networking opportunities with real industry professionals, gain valuable insights through expert-led workshops, and collaborate with peers in hands-on activities. Whether you're looking to expand your knowledge, try something new, or simply connect and network with like-minded individuals and professionals, this event is for you. 

Requirements: 

• A laptop with network access

• A very basic understanding of computer systems, networks and general cyber security concepts

Event Details

Event Date: October 25th-27th, 2024

Event Address: 4505 S. Maryland Pkwy. Las Vegas, NV 89154 

Building/Room: AEB (Advanced Engineering Building) 140-145

Registration Link

Registration Deadline: October 16th 2024, (deadline passed)

Event Agenda

Friday, October 25, 2024 (All Times PT)

5:00 PM – 5:10 PM Tracer FIRE Introductions

5:10 PM – 5:30 PM IR and Cybersecurity Talk

5:30 PM – 6:00 PM Sandia Info Session

6:00 PM – Chat with the Tracer FIRE Team

Saturday, October 26, 2024 (All Times PT)

10:00 AM – 10:15 AM Tracer FIRE Account Setup

10:15AM – 10:30 AM Introduction to Sysmon & Windows Event Logs

10:30 AM – 11:00 AM Introduction to Elastic Stack

11:00 AM – 11:10 AM Break

11:10 AM – 11:35 AM Introduction to Cloud Forensics

11:35 AM – 11:45 AM Introduction to Disk Forensics with Autopsy

11:45 AM – 1:15 PM Lunch

1:15 PM – 1:30 PM Introduction to Disk Forensics with Velociraptor

1:30 PM – 1:55 PM Introduction to Malcolm

1:55 PM – 2:20 PM Introduction to RE

2:20 PM – 2:30 PM TF12 Story Overview

2:30 PM – 5:00 PM TF12 Exercise

5:00 PM - TF12 Exercise Will Remain Open (without support)

Sunday, October 27, 2024 (All Times PT)

10:00 AM – 1:30 PM TF12 Exercise (with support)

1:30 PM – 2:00 PM Preparations - Team Debriefs (Scoring Paused)

2:00 PM – 3:00 PM Public Top Team Debriefs (Optional)

3:00 PM – 3:10 PM Debrief Deliberations

3:10 PM – 3:30 PM Scenario Overview & Closing