DFIR Labs – Frequently Asked Questions (FAQ)

About DFIR Labs

What are DFIR Labs?

DFIR Labs provide hands-on experience investigating real-world intrusion cases. Each lab includes telemetry data, detection alerts, and dashboards (such as Elasticsearch and Kibana) to simulate real-world investigation scenarios.

Lab Access and Activation

How long are the labs available after purchase?

Labs are available to activate at any time within 3 months of purchase. Once a lab is activated, you can access it for the duration you selected at purchase—2, 7, or 14 days.

What happens if I don't activate my lab right away?

You have up to 3 months from the purchase date to activate any lab. There is no requirement to start immediately.

Can I revisit a lab after my access period ends?

Yes, but revisiting the same lab requires using another activation. Each activation grants access for the chosen duration (2, 7, or 14 days). After the access period ends, the lab environment is removed.

How does lab duration work?

🕒 Consecutive Hours

A 2-day lab provides 48 continuous hours starting from the moment you activate it.

⏸️ No Pause/Resume

Once a lab is started, the timer runs continuously. There is currently no pause or resume feature, so we recommend starting the lab only when you're ready to begin.

New Portal Access

How do I access and manage my labs?

We've launched a new DFIR Labs portal that allows you to manage your labs directly—no more relying on emails for access. Through the portal, you can view your purchased labs, activate them when ready, and track your remaining activations.

Access the portal here:
DFIR Labs Portal

What are the benefits of the new portal?

• Manage and activate labs on your own schedule.
• See available activations and lab status at a glance.
• Enjoy a smoother, more reliable user experience without the need to wait for email-based activation links.

If you'd like a quick walkthrough of the portal features, feel free to reach out—we're happy to help!

Lab Environment and User Policy

Can I share my lab access with a colleague?

No, each DFIR Lab license is for one individual user only. Lab environments are isolated, and sharing a session between multiple users is not allowed.

Is there a way to track my progress across labs?

Currently, there is no centralized manager dashboard for progress tracking. However, many labs include hints, instructional content, and links to public reports to support your investigation process. A progress-tracking feature is in development.

Learning Support and Resources

Do the labs include hints or guidance?

Yes. Especially for easier cases, hints and feedback are available throughout the lab to help guide your investigation and learning.

Are there any video walkthroughs available?

Not yet. We are looking to collaborate with educators to bring video walkthroughs to life. This is an area we're actively developing to enhance the learning experience.

Digital Forensics Challenge Events

What can I expect from a Digital Forensics Challenge event?

Digital Forensics Challenge events feature multiple DFIR Labs cases that you can solve within a set timeframe. You will investigate real-world inspired intrusions using provided telemetry data and detection tools. These events are designed to be educational and competitive, offering both beginners and experienced analysts a chance to sharpen their skills.

Do I need to be an expert to participate in the Digital Forensics Challenge?

No, Digital Forensics Challenge events are open to a range of skill levels. While some familiarity with intrusion analysis and security tools is helpful, many of the cases include hints and guidance to support learning along the way.

Are there prizes for the winners of the Digital Forensics Challenge?

Yes, Digital Forensics Challenge events often include prizes for the top performers. The exact prize details may vary by event, so be sure to check the specific event page for up-to-date information.

Where can I see the past winners of Digital Forensics Challenge events?

You can view a list of previous Digital Forensics Challenge winners on the Digital Forensics Challenge Winners page. This page celebrates top performers and highlights their achievements in past competitions.

DFIR Labs Leaderboard and Scoring

How does the DFIR Labs leaderboard work?

The leaderboard tracks participant scores across DFIR Labs cases and events. Points are typically awarded based on the difficulty of the case, completion time, and accuracy of the investigation.

Do I need to join a Digital Forensics Challenge to appear on the leaderboard?

No, you can gain points and appear on the leaderboard by participating in individual DFIR Labs cases, not just during Digital Forensics Challenge events.

Testimonials and User Feedback

What do participants say about DFIR Labs?

Participants often highlight the real intrusion scenarios, the quality of the telemetry and data, and the hands-on learning approach as key benefits of DFIR Labs. Many users appreciate how the labs help them build or reinforce practical investigation skills. You can read testimonials here

Are DFIR Labs useful for both beginners and experienced analysts?

Yes. DFIR Labs cases range from beginner-friendly investigations with hints and instructional content to advanced scenarios that challenge even seasoned analysts. This makes the labs a great fit for continuous learning, no matter your experience level.

Extension Credits (Pro & Enterprise)

What are extension credits?

Extension credits are a premium feature available to Pro and Enterprise subscribers that allow you to extend the duration of running labs beyond their original time limit. Each credit provides 24 hours of additional lab access time.

How many extension credits do I get?

• Pro subscribers: 2 extension credits per month
• Enterprise subscribers: 2 extension credits per month per team member
• Basic subscribers: No extension credits (upgrade to access this feature)

How do extension credits work?

1. Automatic Allocation: Credits are automatically added to your account on the 1st of each month
2. Easy Usage: Click the "Extend Lab" button on any running lab to use 1 credit for 24 hours of additional access
3. Real-time Updates: Your remaining credits are displayed in your dashboard sidebar and updated immediately after use
4. Monthly Reset: Unused credits do not roll over - you get a fresh allocation each month

When should I use extension credits?

Extension credits are perfect when you:

• Need more time to complete a complex investigation
• Want to explore additional attack vectors or evidence
• Are conducting team training sessions that run longer than expected
• Discovered interesting artifacts that require deeper analysis

What happens if I run out of extension credits?

If you've used all your monthly extension credits, you can:

• Wait until the next month for your credits to refresh
• Upgrade to a higher tier if available
• For Enterprise customers, contact sales for additional credit packages

Enterprise Subscription Options

Do you offer a monthly subscription?

Yes, we offer a monthly subscription that gives you access to all available labs, including both public and private labs.

Are there subscription plans available for organizations?

Yes. We offer enterprise subscription plans designed to support organizations that want to provide ongoing DFIR training for their teams. These subscriptions provide access to our full catalog of labs with flexible token allocations and extension credits for all team members.

Enterprise subscriptions are ideal for:

• Training multiple analysts across your organization
• Running internal workshops and continuous education programs
• Providing structured, self-paced training without infrastructure management
• Extended lab sessions with team-wide extension credit access

For more details on enterprise options and pricing, contact our sales team.

What if our team needs more tokens?

Enterprise accounts can purchase additional blocks of tokens within their active subscription year if their initial allocation is depleted. Contact our sales team for assistance.

Need More Help?

If you have other questions or need assistance, feel free to reach out to us via our Contact Page.