Sold by: SANS Institute
Deployed on AWS
Harness local Large Language Models for DFIR investigations without exposing sensitive data to third-party services. Learn to deploy self-hosted AI, build custom forensic agents, and analyze logs and artifacts using natural language queries.
Overview
Harness local Large Language Models for DFIR investigations without compromising sensitive forensic data. This one-day hands-on course teaches deployment of self-hosted AI while maintaining complete data control.
Organizations increasingly explore AI for investigative workflows but cannot risk exposing forensic data to third-party services. FOR563 bridges that gap by operationalizing LLMs in fully self-hosted environments.
Master four critical capabilities through technical labs:
- Configure and deploy local LLMs via GUI and programmatic methods
- Build custom AI agents for forensic and incident response use cases
- Analyze structured data - logs, text messages, databases - using natural language
- Fine-tune LLMs for specialized DFIR tasks using custom datasets
Examine practical challenges of using LLMs in DFIR: context limitations, model fine-tuning, and output verification. Apply concepts to logs, forensic artifacts, databases, and files containing proprietary or undocumented formats.
While emphasizing private implementations, all techniques extend to API-based or cloud-hosted LLMs when appropriate. Accelerate investigations, automate repetitive analysis, and tailor AI tools to specific forensic needs - all without external data exposure.
6 CPE credits across 1 intensive day.
Highlights
- Deploy private AI for investigations: Configure local LLMs, build custom DFIR agents, query forensic data with natural language, and fine-tune models for specialized tasks.
- 4 hands-on labs: GPU-enabled environment setup, local model deployment, structured data analysis, and custom agent development for forensic workflows.
- Built for DFIR professionals who need AI capabilities without exposing sensitive case data to external services. 1 day, 6 CPEs.
Details
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
FOR563 - Single User | Single user license for AI - FOR563: Applied AI for DFIR: Leveraging Local LLMs | $995.00 |
Dimensions summary
This listing offers one pricing option: a single-user license for the FOR563 course. You buy access for one person, so pricing scales by the number of individual licenses you purchase. There are no tiers, instance sizes, or usage add-ons to choose from. The course covers applied AI for digital forensics and incident response using local large language models. It runs about one day of instruction with hands-on labs. Each license is for individual use only and cannot be shared. To train multiple people, you purchase a separate license for each user.
Top-of-mind questions for buyers
One license covers one named individual. The course materials, labs, and test questions are for your personal use only. You cannot share, resell, or reuse them to teach others. To train more people, you buy a separate license for each person, since access does not transfer between users.
Self-paced access runs for a set calendar period after activation. Your access begins when you start the course. If you do not start it, access begins automatically 14 days after the course becomes available. You can extend access by purchasing an extension, but not beyond one year from activation.
The license covers the course and its hands-on labs. A certification exam is not included in the course purchase. You can add an exam attempt separately if you want objective proof of skills. The labs use local large language models for digital forensics and incident response practice.
www.sans.org+1
Helpful?
Vendor refund policy
Refunds available within 30 days if course not accessed.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Support
Vendor support
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Donovan is a platform built for government organizations to deploy AI and accelerate decision-making. Donovan uncovers insights, and expedite traditional workflows to achieve mission success.
Liquid LFM 7B is designed to handle complex tasks, offering an optimal balance between size and output quality.
Liquid LFM 40B is designed to handle complex tasks, offering an optimal balance between size and output quality.
Kriv AI deploys and tunes Amazon Bedrock Guardrails for regulated industries including healthcare, life sciences, and financial services. Provides denied-topics taxonomies, PHI/PII blocklists, content/word/sensitive-data filters using Amazon Comprehend Medical and Amazon Macie, grounding checks, and fairness filters (disparate-impact detection and protected-class proxy scanning). Implements jailbreak and prompt-injection defenses aligned with OWASP Top 10 for LLM Applications (2024/2025). Supports A/B testing vs baseline with precision, recall, F1, and FPR tracking, with compliance mapping to SOC 2 Type II, HIPAA §164.308/312/316, and NIST AI RMF. Integrates with Amazon Bedrock Agents, Claude Agent SDK, and MCP servers. EDP-eligible — counts toward your AWS Enterprise Discount Program commitment (up to 25%). Contact info@kriv.ai for private offer scoping. Pricing tiers: $35K / $65K / $95K + $15K Denied-Topic Suite. AWS Select + Databricks + Anthropic CPN (April 9, 2026).
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.