Registration closes on 9 April, 2021
Interested international participants need to check their respective sponsored USG agency or DOE for participation

Network Archaeology
Using Mathematics and Information Theory, write decoding software for malware network protocols.

Host Forensics
Examine memory and disk forensic artifacts to find forensic artifacts.

Malware Analysis
Examine malicious software to discover capabilities, methods, and more.

Operational Technology
Learn the peculiarities of computers that interact with the physical environment.

Entry Point
An overview of everything. Start here if you're just getting into incident investigation!

Incident Coordination
How to manage incident response teams and communicate clearly and effectively to vested parties.
Schedule
Before Friday, April 9 2021
- Check the online information
Friday, April 9 2021
Time (US/Mountain) (UTC-06:00) | Event |
---|---|
09:00 - 17:50 | Laptop Configuration Help Text Chat |
15:00 - 17:50 | Laptop Configuration Help Video Chat |
Monday, April 12 2021
Time (US/Mountain) (UTC-06:00) |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
---|---|---|---|---|---|---|
08:30 | Opening Remarks | |||||
08:45 | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus |
10:00 | Break | |||||
10:30 | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus |
12:00 | Break | |||||
13:00 | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus |
14:30 | Break | |||||
15:00 | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus |
17:00 | End of Day |
Tuesday, April 13 2021
Time (US/Mountain) (UTC-06:00) |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
08:30 | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus |
---|---|---|---|---|---|---|
10:00 | Break | |||||
10:30 | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus |
12:00 | Break | |||||
13:00 | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus |
14:30 | Break | |||||
15:00 | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus |
17:00 | End of Day |
Wednesday, April 14 2021
Time (US/Mountain) (UTC-06:00) |
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
---|---|---|---|---|---|---|
08:30 | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus |
10:00 | Break | |||||
10:30 | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus |
12:00 | Break | |||||
13:00 | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus |
14:30 | Break | |||||
15:00 | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus | Syllabus |
17:00 | End of Day |
Thursday, April 15 2021
Time (US/Mountain) (UTC-06:00) | Event |
---|---|
08:30 | Collaborative Exercise begins |
12:00 | Break (recommended) |
13:30 | Collaborative Exercise continues |
17:00 | Staff support ends |
Friday, April 16 2021
Time (US/Mountain) (UTC-06:00) | Event |
---|---|
08:30 | Collaborative Exercise continues |
08:30 | Staff support resumes |
11:30 | Collaborative Exercise ends |
11:30 | Closing remarks |
11:15 | Questions and Answers |
12:00 | Event ends |
Online Only
DOE will be hosting Cyber Fire Foundry virtually as an online-only event.
As the event approaches, this page will contain links to complete activities.
Connect to Cyber Fire Chat
The majority of Foundry communications, including class coordination and some instruction, will happen in the Cyber Fire Chat server. You will need a valid email address to create an account and sign in. Once you have created your account, you will be able to visit channels sent to you by your class instructor.
After creating an account
After you’ve set up your account, you can join the Help room to ask for help with getting to the right class channel, or any other issues you’re struggling with.
Classes
Classes will start on Cyber Fire Chat. Your instructor should email you a link to your class channel, and staff will be standing by in the main chat area to help those with problems or questions.
Lectures and tutorials will take place using video teleconferencing. Your instructor will email a link to your class’s teleconference, and will also post the URL in your class channel.
Collaborative Exercise
Each Collaborative Exercise category will have a chat channel dedicated to it. These channels will allow you to ask questions of Cyber Fire staff and interact with others working on the same Collaborative Exercise category.
If you would like to check if a question has already been answered, you can use the search function in the top right corner to look up keywords and jump to conversation segments related to your problem.
You can navigate between channels by clicking on different challenge names in the “Public Channels” section in the left side blue navigation panel.
For more detailed information, you can consult the Mattermost User Guide or Demo Video.
After Foundry, you will lose access to these channels, make sure to write down or otherwise save any information you would not like to be deleted.

Become a tool builder.
Cyber Fire Foundry guides you through creating custom solutions for investigating cybersecurity incidents.
Rather than teach recipes for yesterday’s problems, our veteran staff teaches you to create new custom solutions, so you can handle whatever arrives after you leave our event.