🎉 Almost one year ago, I launched the MYDFIR Forge.
To celebrate, I’m doing a giveaway tied to the FREE Wazuh SOC Analyst Challenge, and I’ll explain how to enter in tomorrow’s YouTube video (Friday, July 31).
A fun fact many of you may not know…
MYDFIR came from combining two things: my last name, Mah (which sounds like “my”), and my passion for DFIR (Digital Forensics & Incident Response).
The tagline “Do Things DFIRINTLY” also has two meanings.
The obvious one is that I wanted to build something different. Throughout my career, I saw too much ego, too many people unwilling to help others, and too much expensive training that didn’t provide enough value. MYDFIR was my way of changing that.
The second meaning is hidden in the spelling. DFIR is at the core of what we do, while INT is a nod to Cyber Threat Intelligence (CTI) another area I’m excited to continue exploring.
Thank you to everyone who’s been part of this journey over the past year. It means more than you know.
I’ll see you tomorrow for the introduction of the Wazuh SOC Analyst Challenge and the anniversary giveaway! 💛
Just did a live session with our members inside the free community! We went over an alert from our Forge SOC and tackled it together as a team. If you haven't already joined the free community I highly recommend it! But be warned, I may throw you into one of these alerts heheheh 👀👀
A member started the year with 4 goals: pass BTL1, pass SC-200, land real SOC work, keep leveling up as an analyst.
6 months later: both certs passed, MSSP SOC role landed, probation cleared with strong feedback, and he just accepted an offer for a more senior internal SOC role that starts next week.
In his words:
"The MyDFIR labs, SOC Simulator, and report writing practice have genuinely helped me build confidence and improve how I approach real alerts at work."
FYI I’ll be doing live bi weekly hangout sessions inside my free community every Saturday and i’ll be alternating the times to try and accommodate folks in different timezones. (Next one is on July 11th at 10-11am Eastern, then July 25th at 2-3pm Eastern). These sessions are a way for me to connect and learn more about you. We’ll also do some adhoc workshops as well in the future 💪.
Time really flies when you’re having fun doing what you love!
Thank you all for tuning in, supporting the channel, and being part of this journey. Whether you’ve been here since day one or just recently discovered the content, I truly appreciate every view, comment, and conversation.
Be on the lookout for more project videos and live streams on YouTube. I’ve got a lot of hands-on content in the works 🙌
I finally finished recording all the labs for the DFIR course.
Long nights, long hours, but I wanted to build the course I wish I had when I was trying to transition from SOC analyst to DFIR analyst/consultant. It covers Windows, Linux, Network, Memory, Azure/BEC, Reporting, and Timeline Creation.
If you've taken my SOC analyst course or the 90 Day SOC Accelerator, you've already built familiarity with investigating and navigating around a SIEM. This DFIR course picks up where that leaves off. It's built for the situations businesses actually face when they don't have a SIEM or an EDR deployed. In those cases, you need to understand what artifacts exist, where to look, how to find answers, identify gaps, and recommend how the company can reduce the risk of a similar compromise going forward.
Even if you don't end up going the DFIR route, these skills will still make you a better analyst. You'll get exposed to artifacts you may not have seen before, and if they ever show up in your logs, you'll actually understand what you're looking at.
Here's what the path looks like inside the Forge: Start with the 90 Day SOC Accelerator. After that, move into the DFIR course. By around month 10, you'll have worked through both. In between, you have access to weekly meetings, projects, CTFs, real investigation requests, and SOC alerts to tackle with Splunk and Microsoft XDR. All with human feedback. No AI feedback.
I'm biased, but if you can spend a year with me in the Forge, it will change your trajectory as an analyst. No more guessing what to learn next or which roadmap to follow. It's all laid out for you.
If you're in a position to commit, the annual plan is $899 and the price goes up on April 19th.
This is a snippet of the MFT (Master File Table) artifact data from a forensic investigation scenario. Been building this out as part of the DFIR course for the MYDFIR Forge. Total of 14 modules with a mix of Windows, Linux, network, memory and cloud (Azure) forensics including a capstone investigation. This is a big course and will include a lot of theory + labs!
Can't wait to release it.
I'll be providing more details in the free SOC community as we get closer to the release!
A lot of you have reached out saying you want to get into cybersecurity as a SOC analyst but can’t afford my paid community right now. I hear you. So I built a free community.
Inside you will find 4 modules that will give you a good starting point once completed and you’ll be surrounded with others that have similar goals.
It’s called the MYDFIR SOC Community and it’s completely free.
Quick note if you’ve heard that name before, the paid community has been renamed to MYDFIR Forge. Same content, same everything, just a new name.
MyDFIR
🎉 Almost one year ago, I launched the MYDFIR Forge.
To celebrate, I’m doing a giveaway tied to the FREE Wazuh SOC Analyst Challenge, and I’ll explain how to enter in tomorrow’s YouTube video (Friday, July 31).
A fun fact many of you may not know…
MYDFIR came from combining two things: my last name, Mah (which sounds like “my”), and my passion for DFIR (Digital Forensics & Incident Response).
The tagline “Do Things DFIRINTLY” also has two meanings.
The obvious one is that I wanted to build something different. Throughout my career, I saw too much ego, too many people unwilling to help others, and too much expensive training that didn’t provide enough value. MYDFIR was my way of changing that.
The second meaning is hidden in the spelling. DFIR is at the core of what we do, while INT is a nod to Cyber Threat Intelligence (CTI) another area I’m excited to continue exploring.
Thank you to everyone who’s been part of this journey over the past year. It means more than you know.
I’ll see you tomorrow for the introduction of the Wazuh SOC Analyst Challenge and the anniversary giveaway! 💛
6 days ago | [YT] | 76
View 5 replies
MyDFIR
Just did a live session with our members inside the free community! We went over an alert from our Forge SOC and tackled it together as a team. If you haven't already joined the free community I highly recommend it! But be warned, I may throw you into one of these alerts heheheh 👀👀
skool.com/mydfir-community/about
1 week ago | [YT] | 47
View 1 reply
MyDFIR
Another day another ransomware 😅 Never a dull moment inside the MYDFIR Forge!
I am curious, if you received this what are your next steps? How would you investigate? What would you look for?
Learn more about the Forge: skool.com/mydfir/about
3 weeks ago | [YT] | 52
View 3 replies
MyDFIR
Big Forge community win! 🎉
A member started the year with 4 goals: pass BTL1, pass SC-200, land real SOC work, keep leveling up as an analyst.
6 months later: both certs passed, MSSP SOC role landed, probation cleared with strong feedback, and he just accepted an offer for a more senior internal SOC role that starts next week.
In his words:
"The MyDFIR labs, SOC Simulator, and report writing practice have genuinely helped me build confidence and improve how I approach real alerts at work."
Want to train alongside analysts doing this work? Come hang in the free SOC community here: www.skool.com/mydfir-community/about
4 weeks ago | [YT] | 53
View 7 replies
MyDFIR
FYI I’ll be doing live bi weekly hangout sessions inside my free community every Saturday and i’ll be alternating the times to try and accommodate folks in different timezones. (Next one is on July 11th at 10-11am Eastern, then July 25th at 2-3pm Eastern). These sessions are a way for me to connect and learn more about you. We’ll also do some adhoc workshops as well in the future 💪.
Join us here: skool.com/mydfir-community/about
1 month ago | [YT] | 31
View 4 replies
MyDFIR
Wow, has it really been 3 years already?
Time really flies when you’re having fun doing what you love!
Thank you all for tuning in, supporting the channel, and being part of this journey. Whether you’ve been here since day one or just recently discovered the content, I truly appreciate every view, comment, and conversation.
Be on the lookout for more project videos and live streams on YouTube. I’ve got a lot of hands-on content in the works 🙌
1 month ago | [YT] | 91
View 10 replies
MyDFIR
Planning on doing live streams to hang out with yall! What time would work best?
2 months ago | [YT] | 51
View 7 replies
MyDFIR
I finally finished recording all the labs for the DFIR course.
Long nights, long hours, but I wanted to build the course I wish I had when I was trying to transition from SOC analyst to DFIR analyst/consultant. It covers Windows, Linux, Network, Memory, Azure/BEC, Reporting, and Timeline Creation.
If you've taken my SOC analyst course or the 90 Day SOC Accelerator, you've already built familiarity with investigating and navigating around a SIEM. This DFIR course picks up where that leaves off. It's built for the situations businesses actually face when they don't have a SIEM or an EDR deployed. In those cases, you need to understand what artifacts exist, where to look, how to find answers, identify gaps, and recommend how the company can reduce the risk of a similar compromise going forward.
Even if you don't end up going the DFIR route, these skills will still make you a better analyst. You'll get exposed to artifacts you may not have seen before, and if they ever show up in your logs, you'll actually understand what you're looking at.
Here's what the path looks like inside the Forge:
Start with the 90 Day SOC Accelerator. After that, move into the DFIR course. By around month 10, you'll have worked through both. In between, you have access to weekly meetings, projects, CTFs, real investigation requests, and SOC alerts to tackle with Splunk and Microsoft XDR. All with human feedback. No AI feedback.
I'm biased, but if you can spend a year with me in the Forge, it will change your trajectory as an analyst. No more guessing what to learn next or which roadmap to follow. It's all laid out for you.
If you're in a position to commit, the annual plan is $899 and the price goes up on April 19th.
3 months ago | [YT] | 90
View 16 replies
MyDFIR
Can you spot the suspicious activity?
This is a snippet of the MFT (Master File Table) artifact data from a forensic investigation scenario. Been building this out as part of the DFIR course for the MYDFIR Forge. Total of 14 modules with a mix of Windows, Linux, network, memory and cloud (Azure) forensics including a capstone investigation. This is a big course and will include a lot of theory + labs!
Can't wait to release it.
I'll be providing more details in the free SOC community as we get closer to the release!
www.skool.com/mydfir-community/about
3 months ago | [YT] | 137
View 27 replies
MyDFIR
A lot of you have reached out saying you want to get into cybersecurity as a SOC analyst but can’t afford my paid community right now. I hear you. So I built a free community.
Inside you will find 4 modules that will give you a good starting point once completed and you’ll be surrounded with others that have similar goals.
It’s called the MYDFIR SOC Community and it’s completely free.
Quick note if you’ve heard that name before, the paid community has been renamed to MYDFIR Forge. Same content, same everything, just a new name.
Join the free community here - skool.com/mydfir-community/about
4 months ago | [YT] | 113
View 27 replies
Load more