Foundry 17

Nov 16 - Nov 19, 2020 : Online

International Participants

Interested international participants need to check their respective sponsored USG agency or DOE for participation

Registration Closed

Registration is closed for this event.


All times are in the US/Mountain (Denver) time zone!

Before the event

Friday, 13 November

Time Event
09:00 - 17:50 Laptop Configuration Help Text Chat
15:00 - 17:50 Laptop Configuration Help Video Chat

Monday, 16 November

Time Event
08:30 - 09:00 Opening Remarks on Video Chat
09:00 - 12:00 Class Day 1
12:00 - 13:30 Break
13:30 - 17:00 Class Day 1

Tuesday, 17 November

Time Event
08:30 - 12:00 Class Day 2
12:00 - 13:30 Break
13:30 - 17:00 Class Day 2

Wednesday, 18 November

Time Event
08:30 - 12:00 Collaborative Exercise
12:00 - 13:30 Break (recommended)
13:30 - 17:00 Collaborative Exercise

Thursday, 19 November

Time Event
08:30 - 12:00 Collaborative Exercise
12:00 - 13:30 Break (recommended)
13:30 - 16:50 Collaborative Exercise
16:50 - 17:00 Closing Remarks


All classes run for 2 days in parallel: each attendee may only choose one class.

Entry Point

An overview of everything. Start here if you're just getting into incident investigation!

Learn More

Host Forensics

Examine memory and disk forensic artifacts to find forensic artifacts.

Learn More

Incident Coordination

How to manage incident response teams and communicate clearly and effectively to vested parties.

Learn More

Malware Analysis

Examine malicious software to discover capabilities, methods, and more.

Learn More

Network Archaeology

Using Mathematics and Information Theory, write decoding software for malware network protocols.

Learn More

Operational Technology

Learn the peculiarities of computers that interact with the physical environment.

Learn More

Online Only

Cyber Fire Foundry 17 is no longer going to be held in person. Instead, DOE will be hosting Cyber Fire Foundry 17 virtually as an online-only event.

Connect to Cyber Fire Chat

The majority of Foundry communications, including class coordination and some instruction, will happen in the Cyber Fire Chat server. You will need a valid email address to create an account and sign in. Once you have created your account, you will be able to visit channels sent to you by your class instructor.

After creating an account

After you’ve set up your account, you can join the Help room to ask for help with getting to the right class channel, or any other issues you’re struggling with.

Connect to Town Square


Classes will start on Cyber Fire Chat. Your instructor should email you a link to your class channel, and staff will be standing by in the main chat area to help those with problems or questions.

Lectures and tutorials will take place using video teleconferencing. Your instructor will email a link to your class’s teleconference, and will also post the URL in your class channel.

Laptop Configuration

Need help finding your class’s chat channel?

Connect to Town Square

Collaborative Exercise

Each Collaborative Exercise category will have a chat channel dedicated to it. These channels will allow you to ask questions of Cyber Fire staff and interact with others working on the same Collaborative Exercise category.

If you would like to check if a question has already been answered, you can use the search function in the top right corner to look up keywords and jump to conversation segments related to your problem.

You can navigate between channels by clicking on different challenge names in the “Public Channels” section in the left side blue navigation panel.

For more detailed information, you can consult the Mattermost User Guide or Demo Video.

After Foundry, you will lose access to these channels, make sure to write down or otherwise save any information you would not like to be deleted.

Become a tool builder.

Cyber Fire Foundry guides you through creating custom solutions for investigating cybersecurity incidents.

Rather than teach recipes for yesterday’s problems, our veteran staff teaches you to create new custom solutions, so you can handle whatever arrives after you leave our event.

More about Foundry