TRANSITS Extended Modules: Overview

The TRANSITS Extended modules are optional building blocks for specific TRANSITS Extended courses. All modules have hands-on exercises. Currently we can offer:

• N: Netflow Analysis (network forensics) – covers how to analyse traffic flow data captured in routers and switches. The nfsen and nfdump software can provide detailed anomaly detection and enable further forensic investigations to be undertaken. Duration: 6 hours.
• C: Computer Forensics Introduction – covers how to collect evidence when network and systems are compromised. Data recovery from both disk and memory is also covered. Duration: 12 hours.
• H: Human Communications Primer – communication skills are key in an incident management environment. This module gives deeper insight in how to better communicate with constituents, management and peers. Duration: 3 hours.

Additional modules are expected to follow in the course of 2026 - if you can bring a new module to the table yourself, please be in touch.

We have combined the above 3 modules in a specific three-day training course labeled TRANSITS Extended NCH (traditionally known as TRANSITS II).

The course is open to more experienced staff currently working for incident management entities, be they CSIRT (CERT), SOC, ISAC or PSIRT. Participation is welcome from educational, commercial, governmental, NREN, law enforcement, research, NGOs, sectoral, military organisations ... from the whole field of society and economy.

Specific prerequisites for a TRANSITS Extended course depend on the modules chosen to constitute that specific course - and will be communicated timely.

The trainers are among the most experienced members of the European incident management community. Therefore, TRANSITS Extended courses are an excellent opportunity for incident management personnel to improve and hone their skills as well as to expand their network.

NOTE: those who are (fairly) new to incident management are advised to first participate in TRANSITS I and gain some work experience, before embarking on any TRANSITS extended courses.

Applicants to TRANSITS Extended courses are subject to a vetting procedure and are usually required to provide references. This is to ensure that individuals fulfill the course prerequisites and have a legitimate interest in cybersecurity. Application forms should therefore be completed as fully as possible.

Participants are typically incident management employees with at least 1-2 years of experience, although qualified persons from other backgrounds are welcome to contact the organisers to discuss their suitability for the course. They are expected to have a good working knowledge of incident management techniques, and must be committed to using their skills to improve the security of computers and networks. Familiarity with Internet protocols, addresses and port numbers is assumed, and experience with Linux (using the command line) is an advantage.

Those will be announced here and in the event calendar.

In January 2026 we plan to organise a TRANSITS Extended NCH - traditionally called TRANSITS II - training course in Amsterdam, The Netherlands - in cooperation with SURFcert and the University of Amsterdam. This course is three full days in duration and involves 15 – 20 participants at a time.

TF-CSIRT will organise at least one TRANSITS Extended training course per year - some of the Modules are likely to be given on the training days of future TF-CSIRT meetings.

NOTE: the following fee is only for the traditional 3-day TRANSITS II training, as one is foreseen for January 2026. This fee include three lunches, one joint dinner, coffee breaks, and course materials.

• Non commercial organisations: €1,100 (plus VAT, if applicable)
• Commercial companies: €1,450 (plus VAT, if applicable)

Please note – unlike TRANSITS I courses, hotel accommodation is not included in the fee and students are expected to book and pay their own accommodation.