Real DFIR tools for students and instructors

Teaching DFIR with real tools is harder than it should be

The endpoints that solve it

A 10-week course, one shared credit budget

# Week 3 lab: students classify a list of indicators and defend
# their verdict against multi-source evidence. ~10 indicators per
# student at 3 credits each = 30 credits per submission.
import os, requests

API_KEY = os.environ["DFIR_API_KEY"]  # shared classroom key
indicators = [
    {"type": "ip",     "value": "45.142.212.x"},
    {"type": "domain", "value": "login-paypa1.example"},
    {"type": "url",    "value": "https://bit.ly/fakelink-demo"},
]

r = requests.post(
    "https://api.dfir-lab.ch/v1/enrichment/lookup",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={"indicators": indicators},
    timeout=30,
)

# Students write up: which sources agreed? where did they disagree?
# what single piece of evidence would change the verdict?
for result in r.json()["results"]:
    print(result["indicator"], "->", result["verdict"])

1. 01
   Step 01

   Instructor signs up on the Academic tier

   Register from a .edu (or national academic) address. Academic eligibility is reviewed manually — a syllabus link or course page is usually enough.

2. 02
   Step 02

   Issue a shared lab key

   The Academic tier includes 2 API keys. Keep one for instructor prep, issue the second as the classroom key — rotated per term.

3. 03
   Step 03

   Design the weekly exercise

   Pick one endpoint per week. Week 1: /phishing-check in the browser. Week 3: /v1/enrichment/lookup in Python. Week 7: /v1/file/analyze on a sample from your teaching corpus.

4. 04
   Step 04

   Grade on reasoning, not verdict

   The /v1/ai/triage endpoint returns an explanation. Ask students to agree or disagree with it in writing — the grading target is the argument, not the label.

5. 05
   Step 05

   Reset every month

   Academic credits refresh monthly. Course runs longer? A second month of $9 or a one-time $9 top-up covers a whole semester.

Pricing that tracks your workload

1. 01

   Small seminar — 8 students, weekly 10-IOC lab

   8 × 4 × 10 × 3 = 960 credits/month — OR split across weeks: ~240 credits/week peak

   One Academic seat ($9/mo, 500 credits) covers 2 of 4 weeks; a second month or a 500-credit top-up ($35) covers the whole semester.
2. 02

   Standard class — 20 students, weekly 10-IOC lab

   20 × 4 × 10 × 3 = 2,400 credits/month — spread as ~600 credits/week

   Academic (500 credits) does not cover this alone — pair with a 2,000-credit top-up, or step up to Professional ($99, 2,500 credits) for the duration of the course.
3. 03

   Bootcamp cohort — 30 students, IOC + file + AI mix

   30 × 4 × (5 × 3 + 1 × 5 + 1 × 10) = 30 × 4 × 30 = 3,600 credits/month

   Fits Professional ($99/mo, 2,500 credits) plus a 1,000-credit top-up, or negotiate an Enterprise seat for a multi-cohort program.

Three ways to evaluate

Frequently asked

Q / 01

Who qualifies for the Academic tier?

Instructors and students at accredited universities, community colleges, and recognized cyber programs, using an institutional email address or with a verifiable affiliation (staff page, syllabus, program listing). If your situation is borderline, email us and explain — we would rather say yes than be gatekeepers.

Q / 02

Can students share a single API key?

The Academic tier includes 2 API keys. The common pattern is one instructor key and one shared classroom key rotated each term. A per-student key is not required — students authenticate by calling from a lab machine / notebook, not by owning individual accounts.

Q / 03

Is the Academic tier a trial?

No — it is a full, ongoing plan at $9/month. You keep paying $9 as long as the account is active and verified as academic. Convert to a paid tier if you leave academia.

Q / 04

Can I use this for my thesis / capstone?

Yes. Students writing a dissertation in DFIR or threat intelligence are explicitly welcome on the Academic tier. Cite the platform and endpoints used — that is all the attribution required.

Q / 05

What about samples? I cannot share live malware with students.

The /v1/file/analyze endpoint accepts hashes — so classroom exercises can pivot on a known sample hash (e.g. from VX-Underground, Malware Bazaar) without every student downloading live binaries. Safer for the students and for the campus network.

Q / 06

Do you have lab notebooks / assignments ready to use?

A starter pack of Jupyter notebooks lives in the docs. Contributions welcome — the instructor community pushes back sample assignments and we merge the good ones.