Most entry-level SOC certifications test what you know about detection; the OffSec Defense Analyst (OSDA) tests whether you can actually reconstruct an intrusion from SIEM logs, under time pressure, and write it up well enough for someone else to repeat your analysis. This guide explains what OffSec publishes about the OSDA: the SOC-200 course that leads to it, the proctored 23 hour 45 minute exam built on an ELK SIEM, the ten attack phases and the 75 point pass mark, the report rules, retake cooling-off periods and how to buy an attempt. It is written for SOC analysts, detection engineers and incident responders deciding whether to attempt it, and for managers who fund SOC training. It describes the certification and the skills it measures, not attack techniques. Facts were checked on help.offsec.com on 26 October 2026; OffSec changes exam rules and pricing from time to time, so confirm details before booking.
Key takeaways
- It is a hands-on blue team exam. You get 23 hours and 45 minutes inside a network whose only point of access is an ELK SIEM, and you must detect, analyse and document attacker actions across ten phases.
- The pass mark is 75 out of 100. Each phase is worth up to 10 points, and your score depends on the report: OffSec says insufficient documentation can cut a phase to partial or zero points.
- The logs are pre-recorded. OffSec's exam guide says that since a change on 10 September the exam uses pre-recorded logs, so candidates no longer trigger the phases themselves; you analyse what has already happened.
- AI chatbots are banned. The exam guide prohibits LLMs and AI chatbots, naming OffSec KAI, ChatGPT, DeepSeek and Gemini, and forbids logging into or exploiting any machine in the exam network.
- Foundations are a stated prerequisite. OffSec lists its PEN-100 Linux, Windows and Networking Basics modules as prerequisites for SOC-200, which shows the level it expects before you start.
Who the certification is for
OffSec describes SOC-200 as a foundational course and says the OSDA demonstrates the ability to detect and assess security incidents. In practice it suits people who already know how systems work and want to prove they can investigate.
- Good fit: tier 1 and tier 2 SOC analysts who triage alerts but want to show they can follow an intrusion end to end. See the SOC Analyst Career Guide.
- Good fit: detection engineers who write SIEM rules and want evidence that they understand what attacker behaviour looks like in Windows and Linux logs. OffSec allows candidates to create or import detection rules in ELK during the exam. See the Detection Engineer Career Guide.
- Good fit: incident responders and threat hunters who need a structured way to reconstruct enumeration, brute force, lateral movement, privilege escalation and persistence from telemetry, which are the kinds of attacker actions OffSec lists for the exam phases.
- Useful for identity teams: brute force, credential misuse, lateral movement and persistence through accounts are central to the exam phases. Analysts who learn to trace them in logs are better placed to spot abuse of service accounts and other non-human identities. See the Threat Hunting Guide.
- Weaker fit: complete beginners with no Linux, Windows or networking background, and people who need a knowledge-based credential for HR filters. The CompTIA CySA+ Guide covers a more widely listed alternative.
Exam format and domains
What OffSec publishes about the exam
| Item | What OffSec states | Source page |
|---|---|---|
| Exam time | 23 hours and 45 minutes | OSDA Exam Guide |
| Report deadline | Upload the report within 24 hours after the exam ends | OSDA Exam Guide |
| Environment | A network containing an ELK SIEM machine; access only through the SIEM and its logs | OSDA Exam Guide |
| Structure | Ten phases, each containing attacker actions to detect, analyse and document | OSDA Exam Guide |
| Scoring | Up to 10 points per phase, maximum 100; at least 75 needed to pass | OSDA Exam Guide |
| Supervision | All OSDA exams are proctored | OSDA Exam Guide |
| Connection | Kali Linux over OpenVPN is the only supported set-up | OSDA Exam Guide |
| Machine reverts | 24 reverts, with one reset of that limit; reverting erases your changes | OSDA Exam Guide |
| Results | Pass or fail email within 10 business days of submission; no score or solutions provided | OSDA Exam Guide |
Rules that catch candidates out
- No AI assistance: LLMs and chatbots are prohibited. Tools that merely contain built-in AI features, such as a note-taking app, do not need to be disabled.
- No touching the targets: you may not log into or exploit any machine in the simulated network.
- No outside help: you may search OffSec's Discord for information but may not seek or receive help there.
- No exfiltration: you may not download applications, files or source code from the exam environment to your own machine.
The report
The report carries the score. OffSec requires a professional PDF with, for each phase, the evidence, your conclusions on attacker techniques and the compromise, the type of access the attacker gained, every SIEM screenshot and every query used, written so that a technically competent reader can replicate the analysis step by step. Queries must appear as text inside the PDF. The file is named OSDA-OS-XXXXX-Exam-Report.pdf (your OSID in place of XXXXX), placed in an unpassworded .7z archive of 200MB or less, and uploaded at upload.offsec.com, where you compare the MD5 hash shown with your local hash before submitting. Submissions are final, and if OffSec asks for clarification you must reply within 24 hours.
Skills the exam measures
OffSec's FAQ and exam guide read for this guide do not publish a domain weighting, so map preparation to the attacker actions the exam guide names and to ATT&CK tactics you will see in the logs.
| Attacker action named by OffSec | Related ATT&CK tactic | What the analyst must show |
|---|---|---|
| Enumeration | Discovery (TA0007) | Which host and account ran discovery, and what it learned |
| Brute force | Credential Access (TA0006); technique T1110 Brute Force | Source, target accounts, failure pattern and the first successful logon |
| Lateral movement | Lateral Movement (TA0008) | Which credentials moved where, by what remote service, and in what order |
| Privilege escalation | Privilege Escalation (TA0004) | The level of access before and after, and the evidence of the change |
| Persistence | Persistence (TA0003) | The mechanism left behind and the account or service it runs under |
Log fluency is the core skill: Windows Security event IDs such as 4624 and 4625 (successful and failed logon), 4688 (process creation), 4720 (account created) and 7045 (service installed), Sysmon process and network events, and Linux authentication logs. Being able to write and explain ELK queries quickly matters as much as recognising the attack.
Prerequisites and experience
OffSec does not require a prior certification to sit the exam, but its SOC-200 FAQ lists these prerequisites, all in the Fundamental Learning Paths included with Learn Fundamentals, Learn One and Learn Enterprise subscriptions:
- PEN-100 Linux Basics 1 and 2: command line, file system, processes and logs.
- PEN-100 Windows Basics 1 and 2: Windows internals, accounts and the event log.
- PEN-100 Networking Basics: TCP/IP, common services and ports.
Beyond that, candidates who do best tend to have some SIEM experience (any platform; the query language changes, the reasoning does not), a basic understanding of Active Directory authentication, and enough scripting to read what a PowerShell or Bash command line was trying to do. Writing skill matters: the exam is marked from the report.
Preparation plan
Buying options
| Option (OffSec's names) | What OffSec says it includes | Best for |
|---|---|---|
| Course and Cert Exam Bundle | SOC-200 course access and an exam attempt | Candidates with SIEM experience who can study intensively |
| Learn subscriptions (Learn Fundamentals, Learn One, Learn Enterprise) | Subscription access to learning content; the PEN-100 prerequisites sit in the Fundamental Learning Paths included with these | Candidates who need the foundations first, and employers training several analysts |
The pages read for this guide do not state prices. Check offsec.com for current pricing, regional pricing and employer licences, as prices change.
A 12 week plan
OffSec publishes 12 week and 24 week SOC-200 learning plans; read them alongside this outline, which is NHI Mgmt Group's own suggestion rather than OffSec's plan.
- Weeks 1 to 2, foundations: finish any PEN-100 gaps, then learn the ELK interface: index patterns, time filters, KQL and Lucene queries, saving searches.
- Weeks 3 to 6, course modules: work through SOC-200 topic by topic, completing each topic's challenge machines. For every attacker action, write down the log source, the event and the query that reveals it.
- Weeks 7 to 9, end to end investigations: run full scenarios from first alert to persistence, timing yourself. Build a timeline per scenario: host, account, action, evidence, query.
- Weeks 10 to 11, report practice: write at least two full mock reports using the required structure, with every query as text and screenshots labelled. Ask a colleague to replicate one from the report alone.
- Week 12, exam logistics: test Kali, OpenVPN and the proctoring software, read the proctoring FAQ, plan sleep and breaks across the 23 hours 45 minutes, and prepare your report template and file naming.
On exam day, document as you go. Candidates who analyse first and write later run short of time in the 24 hour reporting window and lose points on missing queries or screenshots.
Cost, renewal and continuing education
| Item | What OffSec states |
|---|---|
| Retake after first failure | Can be scheduled after a four week cooling-off period |
| Retake after second failure | Eight weeks |
| Retake after third or later failure | Twelve weeks |
| Retake validity | A new retake is valid for 120 days from purchase, or from the end of the cooling-off period if bought during it |
| Cancelled exams | No cooling-off period |
| Technical problems on OffSec's side | Time extension when possible, or a free retake; report to [email protected] with your OSID |
Renewal: the OSDA exam guide does not mention expiry. When NHI Mgmt Group checked OffSec's help centre for the OSCP Certification Guide in October 2026, OffSec's list of expiring certifications named OSCP+, OSAI+, OSCC-SEC, OSCC-SJD, OSTH and OSIR, and did not include OSDA. Confirm the current position with OffSec, because its maintenance rules have changed recently for other certifications.
Continuing education: even without a renewal requirement, detection skills date quickly as logging sources and attacker tradecraft change. Count OSDA study as CPE for other credentials you hold where their rules allow, and keep practising on current log sources such as cloud audit logs and identity provider sign-in logs, which the exam environment does not focus on.
Where it fits on the career path
| Stage | Typical credential | How OSDA relates |
|---|---|---|
| Entry to security | CompTIA Security+ or similar knowledge exam | OSDA usually comes after, once you have worked with logs. See the CompTIA Security+ Guide. |
| SOC analyst | CySA+ (knowledge) or OSDA (practical) | OSDA is the practical option; CySA+ is more often named in job adverts |
| Incident handler | GIAC GCIH | Overlapping detection and response skills; GCIH is broader on incident handling process. See the GIAC GCIH Guide. |
| Threat hunter or responder | OffSec OSTH or OSIR | Natural next steps in OffSec's defensive line |
| Detection engineer | Practical SIEM and rule-writing experience | OSDA shows the attacker-behaviour knowledge that good rules depend on. See the Sigma Rules Guide. |
For hiring managers, an OSDA shows that a candidate has completed a long, proctored investigation and produced a reproducible report: closer to the daily job than a multiple-choice exam. It does not show familiarity with your SIEM or with cloud and SaaS telemetry, so test those separately. For the wider landscape, see the Blue Team Certifications Guide and the Cybersecurity Certifications Guide.
Practitioner checklist
- Complete or test out of the PEN-100 Linux, Windows and Networking Basics before starting SOC-200.
- Choose between the course bundle and a Learn subscription based on how much foundation work you need.
- Build a personal reference of event IDs, log sources and ELK queries for each attacker action in the course.
- Write at least two full mock reports and have someone replicate one from the report alone.
- Test Kali, OpenVPN and the proctoring tool well before exam day.
- Do not use any AI chatbot or LLM during the exam, and do not attempt to access exam machines directly.
- Document every phase as you analyse it, including every query as text.
- Check the naming, archive format and MD5 hash before submitting the report.
- Confirm current price and expiry rules with OffSec on the day you buy.
Standards and references
- OffSec: OSDA Exam Guide
- OffSec: SOC-200 Foundational Security Operations and Defensive Analysis (OSDA) FAQ
- OffSec: Exam Retake Policy
- MITRE ATT&CK: Credential Access (TA0006)
- MITRE ATT&CK: Lateral Movement (TA0008)
- MITRE ATT&CK: T1110 Brute Force
Related NHI Mgmt Group resources: Blue Team Certifications Guide · SOC Analyst Career Guide · OSCP Certification Guide · Cybersecurity Certifications Guide · SIEM Guide