Training
DoD Cyber Workforce Framework work roles
The DoD Cyber Workforce Framework (DCWF) describes cyber work as work roles, each with a definition and a list of tasks. This page shows which of those roles and tasks each Range case has you carry out, and which tasks of the same roles the cases do not cover.
This page shows which DCWF tasks each case exercises in practice. It is not a DoD 8140 qualification and does not award qualification credit.
A case is listed against a task when it has you do the analysis that task describes, on the recorded data in the case. It does not mean the case covers everything the task or the role involves.
The work roles
DCWF 511 · NICE PD-WRL-001 · Cybersecurity
Cyber Defense Analyst
Uses data collected from a variety of cyber defense tools (e.g., IDS alerts, firewalls, network traffic logs.) to analyze events that occur within their environments for the purposes of mitigating threats.
DCWF 531 · NICE PD-WRL-003 · Cybersecurity
Cyber Defense Incident Responder
Investigates, analyzes, and responds to cyber incidents within the network environment or enclave.
How the cases are mapped
Each case lists the skills it exercises on its own page. Each skill points to the DCWF tasks below, so a case claims a task only through a skill it lists. A case that lists no skills claims nothing yet.
Every case that lists skills claims tasks of a Cyber Defense Analyst (511). The Tier 2 incident response cases also claim tasks of a Cyber Defense Incident Responder (531).
The tasks the cases exercise
| Task | DCWF task statement | Through the skill | Cases |
|---|---|---|---|
| 511 / 823 | Receive and analyze network alerts from various sources within the enterprise and determine possible causes of such alerts. | Alert triage | 4 |
| 511 / 956 | Provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities.Claimed for identifying possible attacks and distinguishing them from benign activity only, not alerting. | Alert triage | 4 |
| 511 / 958 | Use cyber defense tools for continual monitoring and analysis of system activity to identify malicious activity.Claimed for analyzing recorded system activity with cyber defense tools only, not continual monitoring. | SIEM search, Log analysis | 15 |
| 511 / 959 | Analyze identified malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information.Claimed for determining the effects on systems and information (which hosts, accounts and data were affected) only, not the weaknesses or methods exploited. | Investigation scoping | 10 |
| 511 / 750 | Perform event correlation using information gathered from a variety of sources within the enterprise to gain situational awareness and determine the effectiveness of an observed attack.Claimed for ordering recorded events into a sequence only, not for correlating sources or judging an attack's effectiveness. | Timeline reconstruction | 3 |
| 511 / 723 | Document and escalate incidents (including event’s history, status, and potential impact for further action) that may cause ongoing and immediate impact to the environment.Claimed for documenting an incident's history, status and impact only, not escalating it. | Evidence and reporting | 8 |
| 531 / 738 | Perform analysis of log files from a variety of sources (e.g., individual host logs, network traffic logs, firewall logs, and intrusion detection system [IDS] logs) to identify possible threats to network security. | Log analysis | 2 |
| 531 / 743 | Perform cyber defense incident triage, to include determining scope, urgency, and potential impact; identifying the specific vulnerability; and making recommendations that enable expeditious remediation.Claimed for determining scope and potential impact only, not for making remediation recommendations. | Investigation scoping | 3 |
By case
| Case | Tier | Work roles and tasks |
|---|---|---|
| Cuckoo | 1 |
|
| Dragnet | 1 |
|
| First Light | 1 |
|
| Ghostwriter | 1 |
|
| Impact | 1 | None claimed yet: this case lists no skills. |
| Magpie | 1 |
|
| Signet | 1 |
|
| Swift | 1 |
|
| Tollgate | 1 |
|
| Trailhead | 1 |
|
| Understudy | 1 |
|
| Watchtower | 1 |
|
| Operation Locust | 2 |
|
| Operation Nightjar | 2 |
|
| Operation Ptarmigan | 2 |
|
| Operation Silverfish | 2 |
|
| Low Tide | 3 |
|
What the cases do not cover
Every case is an investigation of recorded telemetry in a SIEM. Nothing in a case is collected from, contained on or removed from a live system.
- 531 / 755: Perform initial, forensically sound collection of images and inspect to discern possible mitigation/remediation on enterprise systems.
- 531 / 762: Perform real-time cyber defense incident handling (e.g., forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation) tasks to support deployable Incident Response Teams (IRTs).
- 511 / 1110: Isolate and remove malware.
- 531 / 1030: Collect intrusion artifacts (e.g., source code, malware, trojans) and use discovered data to enable mitigation of potential cyber defense incidents within the enterprise.
You work a case alone, so no task that consists of coordinating with other people is claimed.
- 511 / 472: Coordinate with enterprise-wide cyber defense staff to validate network alerts.
- 531 / 470: Coordinate and provide expert technical support to enterprise-wide cyber defense technicians to resolve cyber defense incidents.
- 531 / 741A: Coordinate incident response functions.
- 531 / 2179: Coordinate with intelligence analysts to correlate threat assessment data.
Source
Work role ids, names, definitions and task statements are quoted from the DCWF Work Role Tool v5.1 (as of 25 July 2025), maintained by the DoD CIO, as published on the DoD Cyber Exchange. About the framework: DoD CIO, DoD Cyber Workforce Framework (dowcio.war.gov). Task numbers are the DCWF's own, shown as role / task.