Run a case from start to finish
Acknowledge a new case, work through its phases with the case team, group related cases in a project, and close it with a finished report.
Training
Mastering case management with DFIRe.
A focused four-hour workshop for the people who run cases. The author of the platform teaches it live online.
- 4 hof live online training
- 20attendees from one organisation
- 6hands-on modules
- Recordedfor reuse inside your team
01Outcomes
What your team can do afterwards.
The analyst workshop starts from one question: what does an incident responder need to know to run a case in DFIRe?
Keep the work moving
Pick up and assign actions, block the ones that wait on someone else, skip what does not apply, and record the result of each step.
Meet every deadline
Start the right compliance timer for GDPR, NIS 2 or DORA, follow the incident SLA targets, and pause the SLA timer when you wait on another party.
Keep a record that holds up
Write notes and timeline entries as you go, handle evidence with an unbroken chain of custody, and turn the case record into CAN reports and the investigation report.
02Curriculum
Six modules in four hours.
Every module is hands-on and works on one practice case from intake to closure. Questions are welcome between modules, and a longer question block ends the workshop.
- 01
Opening and running a case
Investigation and incident modes. Acknowledging a new case. The case team and who can do what. The case overview and the sidebar. Grouping cases in a project. Resolving, closing and reopening a case.
- 02
Actions
The action checklist the playbook creates, phase by phase. Starting an action and assigning it to an investigator or an outside team. Blocking an action with a note on what it waits for. Skipping what does not apply. Completion notes on the timeline. Adding steps the playbook did not foresee, and moving between phases.
- 03
Notes and the timeline
Writing notes as you work. Posting a note to the timeline or adding it to the report as an appendix. What DFIRe records on the timeline for you, adding your own entries, hiding events, and filtering the timeline during analysis.
- 04
Deadlines: compliance timers and SLAs
Starting the right regulatory timer, such as GDPR, NIS 2 or DORA. Warnings before a deadline and completing a timer. Incident SLA targets for acknowledgement and resolution, and pausing the SLA timer while you wait on another party. Deadlines and blockers on the dashboard.
- 05
Evidence handling
Evidence items, their files and the parent-child hierarchy. Owner, user and custodian. Custody transfers, correction transfers and the printable receipt. Indicators on a case, TLP, and keeping case-specific detail in the case context field.
- 06
Reporting and shared knowledge
The CAN report for shift changes and status updates. The investigation report: sections, evidence references, the review workflow and printing. The knowledge base for procedures and lessons learned. A short look at what your administrators can connect: Slack, Jira, webhooks and automation.
03Format
Live online training in your time zone.
The platform's author, Antti Kurittu, delivers every workshop. Lead time is typically four to six weeks. We quote on-site training, larger groups and multi-session formats on request.
04Pricing
Workshop prices
All prices are for online delivery and are in EUR with VAT 0%. Reverse charge applies to EU B2B sales, and standard rules apply within Finland.
For analysts
Analyst workshop
3,500EUR, online*
Per workshop
- 4-hour live online workshop
- The six modules on this page
- Up to 20 attendees
- Recording, slides and materials included
Administrator workshop
2,500EUR, online*
Per workshop
- Shorter live online session
- For the people who deploy and run DFIRe
- Installation and updates
- Configuring DFIRe to fit your needs
* Prices are for online delivery. On-site training price depends on time and location. Ask us for a quote and availability. Booking, cancellation and refunds follow our workshop terms.
05Booking
How booking works
Four short steps from the first email to the workshop day.
Send an enquiry
Email contact@dfire.fi with the workshop you want, your team size, time zone and a rough date window. For on-site training, include the location.
Confirm scope and date
A short call or email exchange confirms that the curriculum fits your team's level and fixes the date. Lead time is typically four to six weeks. We quote rush slots on request.
Invoice and payment
DFIRe Oy issues an invoice with 30-day payment terms, paid by SEPA bank transfer. To pay by card instead, use the card payment link under Workshop prices. Reverse-charge VAT applies to EU B2B, standard Finnish VAT within Finland, and sales outside the EU are out of scope.
Workshop day
Live delivery on the agreed date. Attendees get the recording within one business day, and a follow-up email answers open questions and shares the slides.
Ready to book?
Send a short note and I will reply within one business day.