SANS Institute Workshop - Hands-on Agentic AI for digital forensics and incident response

Digital Forensics and Incident Response (DFIR) is one of the most time-intensive disciplines in cyber security. Whether you are triaging a compromised endpoint, reconstructing an attacker's timeline, or correlating indicators across dozens of artefacts, the volume of data involved routinely outpaces what a human analyst can process in a reasonable timeframe. Agentic AI changes that equation, and this workshop from the current SANS FOR508 course shows you how.

Over the past couple of years, AI models have moved well past the "ask it a question, get an answer" phase. Agentic AI systems can now plan multi-step tasks, call forensic tools directly, reason over evidence, and stage findings for human review, all while keeping an investigator in control of what gets committed to the case record. That last part matters. Speed without rigour is just noise.

This hands-on workshop from SANS walks participants through using an agentic AI platform to support a real incident investigation. Working with pre-parsed forensic artefacts from a simulated compromise, participants will direct an AI agent to register evidence, analyse Windows Defender and event logs, identify indicators of compromise, and build an attack timeline. Critically, the workshop places equal emphasis on the human-in-the-loop (HITL) review process, where participants evaluate, edit, approve, or reject AI-generated findings before they are committed to the case.

By the end of the session, participants will have a working understanding of how agentic AI fits into a DFIR workflow, where it genuinely accelerates investigation, and where it still needs a skilled analyst to keep it honest. No prior DFIR experience is required, although a general familiarity with cyber security concepts will help you get the most out of the session.

This workshop is relevant to incident responders, security analysts, threat hunters, and anyone who wants a practical, no-hype look at what AI can actually do in an investigation today, not in some hypothetical future.