13 · DFIR, SOC, and AI security

Depth: outline — expanded teaching material and exercises are still being written. See the content and coverage map.

Outcomes

Preserve evidence, form incident hypotheses, query telemetry, and evaluate AI systems for data leakage, prompt injection, model-supply-chain risk, and unsafe automation.

Lab: timeline before theory

Build a timeline from instructor-provided synthetic events. Keep original timestamps, timezone, source, parser version, and confidence. Start with:

sha256sum evidence/*
stat evidence/*

For an AI system, test only a local fixture: identify trust boundaries between instructions, retrieved text, tools, and outputs. A retrieved command is untrusted data. The evaluator must prove that tools are not called merely because a document requested them.

Evidence standard

Preservation, chain of custody, hypothesis, corroboration, and uncertainty are separate fields. A fluent model response is not corroboration.

Teach-back

Explain why preserved timestamps, parser provenance, corroboration, and uncertainty are required before an incident hypothesis becomes a finding.

Safety and scope

Use synthetic evidence and local AI fixtures. Preserve originals, avoid real personal data, and do not connect an evaluator to production tools or accounts.