macOS DFIR Fundamentals — GIAC Enterprise Incident Response

The official GIAC documentation our macOS DFIR Fundamentals practice questions are cited to. Review the primary sources, then practise.

Official references for this objective

Sans — FOR608: Enterprise-Class Incident Response & Threat Hunting | SANS Institute

Profiling users and system configurations Review common persistence methods Log analysis for macOS