Find answers to common questions about DFIR Labs, lab access, and training options
DFIR Labs provide hands-on experience investigating real-world intrusion cases. Each lab includes telemetry data, detection alerts, and dashboards (such as Elasticsearch and Kibana) to simulate real-world investigation scenarios.
Labs are available to activate at any time within 3 months of purchase. Once a lab is activated, you can access it for the duration you selected at purchase—2, 7, or 14 days.
You have up to 3 months from the purchase date to activate any lab. There is no requirement to start immediately.
Yes, but revisiting the same lab requires using another activation. Each activation grants access for the chosen duration (2, 7, or 14 days). After the access period ends, the lab environment is removed.
We’ve launched a new DFIR Labs portal that allows you to manage your labs directly—no more relying on emails for access. Through the portal, you can view your purchased labs, activate them when ready, and track your remaining activations.
Access the portal here:
DFIR Labs Portal
If you’d like a quick walkthrough of the portal features, feel free to reach out—we’re happy to help!
Yes. We offer DFIR Labs Case Packs for Businesses, designed to support organizations that want to provide hands-on intrusion investigation training for their teams. These packs allow businesses to purchase labs in bulk at discounted rates, with flexible options depending on the number of activations required.
Bulk purchasing is ideal for:
For more details on business options and pricing, visit:
DFIR Labs Business Options
Yes. We offer DFIR Labs Case Packs for Education (EDU) at already discounted rates to support academic programs, universities, and training institutions. These packs are designed to give students real-world, hands-on experience investigating intrusion scenarios while keeping costs accessible for educational programs.
The EDU case packs are perfect for:
For details on EDU case packs and available options, visit:
DFIR Labs Case Packs for EDU
Yes. Case packs for both businesses and educational institutions are designed with multi-user use in mind. Each lab remains isolated per user, and activations can be distributed across team members or students as needed. Each activation still follows the standard DFIR Labs access terms (2, 7, or 14 days per activation).
If you need help selecting the right pack for your team or program, feel free to contact us for recommendations.
It means you are free to apply your activations on any case at any time within the coupon’s validity period (1 year). However, the standard access durations (2, 7, or 14 days) still apply after activation.
No, each DFIR Lab license is for one individual user only. Lab environments are isolated, and sharing a session between multiple users is not allowed.
Currently, there is no centralized manager dashboard for progress tracking. However, many labs include hints, instructional content, and links to public reports to support your investigation process. A progress-tracking feature is in development.
Yes. Especially for easier cases, hints and feedback are available throughout the lab to help guide your investigation and learning.
Not yet. We are looking to collaborate with educators to bring video walkthroughs to life. This is an area we're actively developing to enhance the learning experience.
CTF Day events feature multiple DFIR Labs cases that you can solve within a set timeframe. You will investigate real-world inspired intrusions using provided telemetry data and detection tools. These events are designed to be educational and competitive, offering both beginners and experienced analysts a chance to sharpen their skills.
No, DFIR Labs CTF events are open to a range of skill levels. While some familiarity with intrusion analysis and security tools is helpful, many of the cases include hints and guidance to support learning along the way.
Yes, DFIR Labs CTF events often include prizes for the top performers. The exact prize details may vary by event, so be sure to check the specific event page for up-to-date information.
You can view a list of previous CTF winners on the DFIR Labs CTF Winners page. This page celebrates top performers and highlights their achievements in past competitions.
The leaderboard tracks participant scores across DFIR Labs cases and events. Points are typically awarded based on the difficulty of the case, completion time, and accuracy of the investigation.
No, you can gain points and appear on the leaderboard by participating in individual DFIR Labs cases, not just during CTF events.
Participants often highlight the real intrusion scenarios, the quality of the telemetry and data, and the hands-on learning approach as key benefits of DFIR Labs. Many users appreciate how the labs help them build or reinforce practical investigation skills. You can read testimonials here
Yes. DFIR Labs cases range from beginner-friendly investigations with hints and instructional content to advanced scenarios that challenge even seasoned analysts. This makes the labs a great fit for continuous learning, no matter your experience level.
Yes. Bulk discounts are available for purchases of five or more labs. For details, visit the business options page:
DFIR Labs Business Options
If you have other questions or need assistance, feel free to reach out to us via our Contact Page.
Our team is here to help with any questions you may have.
Contact Us