GNFA — GIAC Network Forensic Analyst
The primary network-focused forensics certification, covering deep packet inspection, protocol analysis, and network artifact reconstruction. Teaches analysts to work from network evidence rather than host artifacts — an increasingly critical skill as attackers operate in fileless and memory-resident ways that leave minimal host evidence. DoD 8140 approved and valued in SOC, IR, and hunt teams. Pairs extremely well with GCFA for a comprehensive investigation capability. One of the more practically applicable GIAC certs despite the MCQ format because network analysis genuinely requires pattern recognition over rote memorization.
| Issuer | GIAC / SANS Institute |
|---|
| Level | intermediate |
|---|
| Domains | Digital Forensics & Incident Response, Network Security |
|---|
| Practical weight | 25% |
|---|
| Cost (USD) | 999 |
|---|
| Renewal | 4 years |
|---|
| DoD 8140 | Yes |
|---|
| Skills | network_traffic_analysis, pcap_analysis, protocol_decoding, c2_traffic_identification, network_artifact_reconstruction, full_packet_capture_analysis, dns_forensics |
|---|
Official certification page
Browse all 426 cybersecurity certifications on EBCertMap