Protection and Defense · PD-WRL-002 · OPM code 212
Digital Forensics
From NICE Framework Components v2.2.0
Description
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0Responsible for analyzing digital evidence from computer security incidents to derive useful information in support of system and network vulnerability mitigation.
Tasks
From NICE Framework Components v2.2.0, open one for the AI skills Workforce Automation maps to it
Free · NICE Framework Components v2.2.0T0167 Perform file signature analysis
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0168 Perform data comparison against established database
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0172 Perform real-time forensic analysis (e.g., using Helix in conjunction with LiveView)
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0173 Perform timeline analysis
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0179 Perform static media analysis
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0182 Perform tier 1, 2, and 3 malware analysis
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT0397 Perform Windows registry analysis
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1020 Determine the operational and safety impacts of cybersecurity lapses
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1051 Set up a forensic workstation
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1084 Identify anomalous network activity
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1090 Determine best methods for identifying the perpetrator(s) of a network intrusion
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1102 Identify intrusions
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1103 Analyze intrusions
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1104 Document what is known about intrusions
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1118 Identify vulnerabilities
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1119 Recommend vulnerability remediation strategies
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1120 Create forensically sound duplicates of evidence
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1121 Decrypt seized data
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1159 Create technical summary of findings reports
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1175 Determine if digital media chain or custody processes meet Federal Rules of Evidence requirements
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1191 Determine relevance of recovered data
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1199 Identify digital evidence for analysis
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1253 Perform dynamic analysis on drives
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1260 Perform real-time cyber defense incident handling
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1282 Prepare digital media for imaging
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1301 Report forensic artifacts indicative of a particular operating system
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1322 Capture network traffic associated with malicious activities
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1323 Analyze network traffic associated with malicious activities
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1324 Process digital evidence
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1325 Document digital evidence
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1370 Collect intrusion artifacts
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1371 Mitigate potential cyber defense incidents
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1372 Advise law enforcement personnel as technical expert
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1381 Scan digital media for viruses
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1382 Mount a drive image
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1383 Utilize deployable forensics toolkit
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1387 Validate intrusion detection system alerts
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1407 Correlate threat assessment data
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1486 Process forensic images
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1487 Perform file and registry monitoring on running systems
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1488 Enter digital media information into tracking databases
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1489 Correlate incident data
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1490 Prepare cyber defense toolkits
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1510 Preserve digital evidence
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1607 Recover information from forensic data sources
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yetT1617 Prepare cyber defense reports
WFA · Part of the paid plan when accounts openWFA (Workforce Automation) analysis: AI skills mapped to this task
Not mapped yet
Knowledge
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0- K0635Knowledge of decryption
- K0636Knowledge of decryption tools and techniques
- K0637Knowledge of data repositories
- K0674Knowledge of computer networking protocols
- K0675Knowledge of risk management processes
- K0676Knowledge of cybersecurity laws and regulations
- K0677Knowledge of cybersecurity policies and procedures
- K0678Knowledge of privacy laws and regulations
- K0679Knowledge of privacy policies and procedures
- K0680Knowledge of cybersecurity principles and practices
- K0681Knowledge of privacy principles and practices
- K0682Knowledge of cybersecurity threats
- K0683Knowledge of cybersecurity vulnerabilities
- K0684Knowledge of cybersecurity threat characteristics
- K0696Knowledge of digital forensic data principles and practices
- K0697Knowledge of encryption algorithm capabilities and applications
- K0701Knowledge of data backup and recovery policies and procedures
- K0710Knowledge of enterprise cybersecurity architecture principles and practices
- K0724Knowledge of incident response principles and practices
- K0725Knowledge of incident response tools and techniques
- K0726Knowledge of incident handling tools and techniques
- K0744Knowledge of operating system (OS) systems and software
- K0751Knowledge of system threats
- K0752Knowledge of system vulnerabilities
- K0759Knowledge of client and server architecture
- K0760Knowledge of server diagnostic tools and techniques
- K0761Knowledge of Fault Detection and Diagnostics (FDD) tools and techniques
- K0770Knowledge of system administration principles and practices
- K0778Knowledge of enterprise information technology (IT) architecture principles and practices
- K0786Knowledge of physical computer components
- K0787Knowledge of computer peripherals
- K0791Knowledge of defense-in-depth principles and practices
- K0793Knowledge of file extensions
- K0794Knowledge of file system implementation principles and practices
- K0795Knowledge of digital evidence seizure policies and procedures
- K0796Knowledge of digital evidence preservation policies and procedures
- K0797Knowledge of ethical hacking tools and techniques
- K0800Knowledge of evidence admissibility laws and regulations
- K0802Knowledge of chain of custody policies and procedures
- K0804Knowledge of persistent data principles and practices
- K0806Knowledge of machine virtualization tools and techniques
- K0807Knowledge of web mail tools and techniques
- K0808Knowledge of system file characteristics
- K0809Knowledge of digital forensics data characteristics
- K0810Knowledge of deployable forensics principles and practices
- K0812Knowledge of digital communication systems and software
- K0817Knowledge of event correlation tools and techniques
- K0837Knowledge of hardening tools and techniques
- K0840Knowledge of hardware reverse engineering tools and techniques
- K0842Knowledge of software reverse engineering tools and techniques
- K0850Knowledge of data carving tools and techniques
- K0851Knowledge of reverse engineering principles and practices
- K0852Knowledge of anti-forensics tools and techniques
- K0853Knowledge of forensics lab design principles and practices
- K0854Knowledge of forensics lab design systems and software
- K0855Knowledge of debugging tools and techniques
- K0856Knowledge of filename extension abuse
- K0857Knowledge of malware analysis tools and techniques
- K0858Knowledge of virtual machine detection tools and techniques
- K0859Knowledge of encryption tools and techniques
- K0870Knowledge of enterprise architecture (EA) reference models and frameworks
- K0871Knowledge of enterprise architecture (EA) principles and practices
- K0892Knowledge of cyber defense laws and regulations
- K0914Knowledge of binary analysis tools and techniques
- K0915Knowledge of network architecture principles and practices
- K0916Knowledge of malware analysis principles and practices
- K0923Knowledge of operating system structures and internals
- K0939Knowledge of packet-level analysis tools and techniques
- K0959Knowledge of operational design principles and practices
- K0962Knowledge of targeting laws and regulations
- K0963Knowledge of exploitation laws and regulations
- K0977Knowledge of intelligence collection management tools and techniques
- K0979Knowledge of information searching tools and techniques
- K0980Knowledge of intelligence collection sources
- K0983Knowledge of computer networking principles and practices
- K1004Knowledge of reporting policies and procedures
- K1014Knowledge of network security principles and practices
- K1016Knowledge of code obfuscation tools and techniques
- K1055Knowledge of digital forensics principles and practices
- K1069Knowledge of virtual machine tools and technologies
- K1079Knowledge of web application security risks
- K1091Knowledge of media forensics
- K1092Knowledge of digital forensics tools and techniques
- K1115Knowledge of Chain of Custody (CoC) processes and procedures
- K1147Knowledge of data integrity principles and practices
- K1151Knowledge of digital evidence cataloging tools and techniques
- K1152Knowledge of digital evidence extraction tools and techniques
- K1153Knowledge of digital evidence handling principles and practices
- K1154Knowledge of digital evidence packaging tools and techniques
- K1155Knowledge of digital evidence preservation tools and techniques
- K1163Knowledge of forensic image processing tools and techniques
- K1175Knowledge of network monitoring tools and techniques
- K1193Knowledge of packet analysis tools and techniques
Skills
From NICE Framework Components v2.2.0
Free · NICE Framework Components v2.2.0- S0156Skill in performing packet-level analysis
- S0378Skill in decrypting information
- S0472Skill in developing virtual machines
- S0473Skill in maintaining virtual machines
- S0474Skill in finding system files
- S0475Skill in recognizing digital forensics data
- S0476Skill in identifying filename extension abuse
- S0491Skill in processing digital forensic data
- S0499Skill in performing intelligence collection analysis
- S0575Skill in developing network infrastructure contingency and recovery plans
- S0576Skill in testing network infrastructure contingency and recovery plans
- S0579Skill in preparing reports
- S0589Skill in preserving digital evidence integrity
- S0599Skill in performing memory dump analysis
- S0603Skill in identifying forensics data in diverse media
- S0604Skill in extracting forensics data in diverse media
- S0605Skill in storing digital evidence
- S0606Skill in manipulating operating system components
- S0607Skill in collecting digital evidence
- S0608Skill in processing digital evidence
- S0609Skill in transporting digital evidence
- S0611Skill in disassembling Personal Computers (PCs)
- S0612Skill in performing digital forensics analysis
- S0621Skill in performing binary analysis
- S0622Skill in implementing one-way hash functions
- S0623Skill in performing source code analysis
- S0624Skill in performing volatile data analysis
- S0625Skill in interpreting debugger results
- S0651Skill in performing malware analysis
- S0652Skill in performing bit-level analysis
- S0653Skill in creating digital evidence copies
- S0671Skill in implementing network infrastructure contingency and recovery plans
- S0678Skill in administering operating systems
- S0821Skill in collaborating with internal and external stakeholders
- S0854Skill in performing data analysis
- S0856Skill in performing digital evidence analysis
- S0857Skill in performing dynamic analysis
- S0860Skill in performing file system forensic analysis
- S0866Skill in performing log file analysis
- S0875Skill in performing network traffic packet analysis
- S0882Skill in performing static analysis
- S0884Skill in performing static malware analysis
Workforce Automation analysis, not part of the source
O*NET jobs this role maps to
WFA · Part of the paid plan when accounts openJobs from the ETO-CSET NICE/O*NET crosswalk (2024), with the share of each job’s detailed work activities (DWAs) that has a mapped AI skill. We haven’t mapped AI skills to this role’s own tasks yet; until then, these jobs show the coverage the role reaches through the occupations it maps to.
- Information Security Analysts 15-1212.00DWAs covered10 of 10
- Fraud Examiners, Investigators and Analysts 13-2099.04DWAs covered3 of 21
- Digital Forensics Analysts 15-1299.06DWAs covered1 of 20
- Forensic Science Technicians 19-4092.00DWAs covered0 of 20
Equivalents
O*NET jobs
Mapped to this role by the ETO-CSET NICE/O*NET crosswalk (2024); jobs from O*NET 30.3
Free · O*NET 30.3- Information Security Analysts 15-1212.00
- Fraud Examiners, Investigators and Analysts 13-2099.04
- Digital Forensics Analysts 15-1299.06
- Forensic Science Technicians 19-4092.00
DCWF work roles
From DoD DCWF Tool v5.3 (2026-09-25), linked by its NCWF ID or NICE's OPM code
Free · DoD DCWF Tool v5.3 (2026-09-25)- Cyber Defense Forensics Analyst 212 · Cybersecurity · linked by DCWF Tool NCWF ID