Detection teams often fund the wrong GIAC credential because GMON and GCDA sound alike, yet one tests how monitoring is engineered across a network and its endpoints while the other tests how logs are collected, enriched and turned into alerts. GIAC Continuous Monitoring (GMON) and GIAC Certified Detection Analyst (GCDA) are both practitioner certifications for defenders. This guide compares what GIAC publishes about each: exam format, objectives, delivery, prices and renewal. It then gives a preparation plan, decision guidance on which to take first and where each sits on a SOC or detection engineering career path. It is written for SOC analysts and engineers, detection engineers, security architects who own telemetry, and managers allocating training budgets. Facts are as published on giac.org, checked 27 October 2026; GIAC can change exam versions and prices, so check current fees and your attempt details in your GIAC account.
Key takeaways
- GMON is the broader exam. 82 questions in 3 hours, passing score 74%, across 17 objectives from cyber defence principles and NIDS/NIPS to application control and threat-informed defence.
- GCDA is narrower and log-centred. 75 questions in 2 hours, passing score 76% for versions released on or after 27 April 2026, across 9 objectives on log collection, enrichment, SIEM, endpoint analytics and Azure and AWS logging.
- The aligned courses differ. GMON aligns with SANS SEC511 (Advanced Threat Detection and Monitoring); GCDA aligns with SANS SEC555.
- Costs are identical. Both are standard-price GIAC exams: $999 attempt, $899 retake, $399 practice exam (USD, excluding tax).
- Renewal is the same. Every four years, with 36 CPEs or a retake, and a $499 fee ($249 for further renewals within two years).
Who the certification is for
| GMON: GIAC Continuous Monitoring | GCDA: GIAC Certified Detection Analyst | |
|---|---|---|
| GIAC's stated audience | People implementing continuous diagnostics and mitigation, continuous security monitoring or network security monitoring; security architects; senior security engineers; technical security managers; SOC analysts, engineers and managers; CND analysts | Security analysts and architects; senior security engineers; technical security managers and security monitoring specialists; SOC analysts, engineers and managers; CND analysts; system administrators; cyber threat investigators; people implementing continuous security monitoring or working on hunt teams |
| Centre of gravity | Designing and running monitoring: sensors, perimeter devices, baselines, application control, attack frameworks | Working the data: log sources, enrichment, SIEM, alerting, cloud-native logging |
| Best fit | Engineers who own the monitoring architecture and the controls that feed it | Analysts and detection engineers who write and tune detections in a SIEM |
| Alignment badges on the page | DoD 8140, DORA, NIS2 | None shown on the page checked |
Choose GMON first if your job includes deciding where sensors sit, what gets baselined and how endpoints are hardened so that monitoring is meaningful. Choose GCDA first if your day is spent in a SIEM, onboarding log sources, writing correlation rules and handling alerts, or if you work heavily in Microsoft Sentinel, Defender, Azure or AWS logs. Many detection engineers eventually hold both, and the overlap is mostly in endpoint and SIEM concepts.
For certifications at every level, see the Cybersecurity Certifications Guide; for a defensive overview, the Blue Team Certifications Guide.
Exam format and domains
Format side by side
| Item (GIAC, checked 27 October 2026) | GMON | GCDA |
|---|---|---|
| Certification type | Practitioner | Practitioner |
| Exam | 1 proctored exam | 1 proctored exam |
| Questions | 82 | 75 |
| Time limit | 3 hours | 2 hours |
| Time per question | About 2 minutes 12 seconds | 96 seconds |
| Minimum passing score | 74% (versions released on or after 23 December 2015) | 76% (versions released on or after 27 April 2026) |
| Objectives | 17 | 9 |
| Delivery | Web-based, proctored remotely through ProctorU or on site at Pearson VUE; 120 days from activation to sit | |
| Aligned SANS course | SEC511 | SEC555 |
The GMON page also describes GIAC's CyberLive testing (performance-based tasks on virtual machines with real tools). Check your attempt details in your GIAC account to see whether your exam version includes CyberLive items. GCDA's new passing score applies to versions from 27 April 2026; anyone who started preparing with older material should check the current objectives, which include Defender, Sentinel and cloud logging.
GMON objectives (17)
| Group (ours) | GIAC objectives |
|---|---|
| Principles and architecture | Cyber Defense Principles; Security Architecture Overview (including the role of SOCs); Threat Informed Defense; Attack Techniques |
| Network monitoring | Network Security Monitoring Tools; NIDS/NIPS/NGFW; Perimeter Protection Devices; Proxies & SIEM; Network Data Encryption; Exploit Methodology and Analysis |
| Endpoint and configuration | Device Monitoring; HIDS/HIPS/Endpoint Firewalls; Configuration Monitoring; Patching & Secure Baseline Configurations; Software Inventories and Application Control |
| Identity and exposure | Account & Privilege Monitoring & Authentication; Discovery and Vulnerability Scanning |
GCDA objectives (9)
| GIAC objective | What GIAC lists under it | Practical skill to rehearse |
|---|---|---|
| Log Collection and Enrichment | Common log types and collection strategies | Onboard Windows, Linux, firewall and proxy logs; add asset and user context |
| Log Analysis and Alerting | Common aggregation and analysis approaches | Write, test and tune an alert; measure its false positive rate |
| SIEM Overview | Purpose and value of SIEM | Explain parsing, normalisation, correlation and retention trade-offs |
| Endpoint Analytics | Host-specific logs and their use | Use process creation, logon and service installation events in detections |
| Application and User Monitoring Analytics | Application and user baselines | Build a baseline and alert on deviation |
| Application Protocol Analytics | Common protocols in detection | Use DNS, HTTP and TLS metadata to spot anomalies |
| Asset and Network Analytics | Asset discovery and flow logs | Find unknown assets and unusual flows from flow data |
| Azure and AWS Logging Overview | Cloud-native logging in Azure and AWS | Know which control plane and data plane logs exist and how to collect them |
| Defender and Sentinel Overview | Azure-native tools for enriching logs and responding to alerts | Trace an alert from Defender into Sentinel and through a response |
Where identity fits: GMON has an explicit account and privilege monitoring objective, and GCDA's user monitoring and cloud logging objectives depend on sign-in and role assignment events. Service accounts, API keys and workload identities generate much of the activity in those logs and are often the least baselined. See the Detection Engineering for Non-Human Identities Guide and the Identity Threat Hunting Guide.
Prerequisites and experience
Neither page lists a formal prerequisite. Both assume working knowledge that GIAC's audience lists imply:
- For GMON: TCP/IP and common protocols, how firewalls, IDS/IPS and proxies work, Windows and Linux administration, and familiarity with an attack framework such as MITRE ATT&CK.
- For GCDA: hands-on time with at least one SIEM, an understanding of Windows event logs and Linux logs, and basic familiarity with Azure and AWS logging services.
- Useful background for both: a year or more in a SOC, monitoring or security engineering role; this is our judgement, not a GIAC rule.
Preparation plan
- Pick the order: use the decision guidance above. If unsure, map yourself against both objective lists; take first the one where you are already amber or green on more than half.
- Build a lab (week 1 to 2): a small SIEM or log stack, a Windows host with enhanced logging, a Linux host, a network sensor and, for GCDA, a free-tier Azure and AWS account with activity logging enabled.
- Work the objectives (weeks 2 to 7): for GMON, deploy and tune a sensor, baseline a host, and set up application control in audit mode. For GCDA, onboard each log type, enrich it, and write one detection per objective.
- Map to ATT&CK (alongside): for each detection or control you build, note the technique it addresses. This supports GMON's threat-informed defence objective and GCDA's alerting objectives. See the ATT&CK Detection Strategies and Analytics Guide.
- Index (alongside study): build your own sorted index of terms, event types, log sources and tools with page references.
- Practice exams (weeks 8 and 10): sit each under real time limits; GCDA leaves only 96 seconds a question, so practise answering without lookups.
- Book and sit: book a proctored slot early inside the 120-day window.
Small vs large organisations: in a small team one person often owns both the sensors and the SIEM, so GMON gives the broader return. In a large SOC with separate engineering and analysis functions, fund GMON for the platform and engineering staff and GCDA for analysts and detection engineers.
Measuring readiness and value
- Practice scores: clearly above the passing mark (74% GMON, 76% GCDA), not just at it.
- Pace: finishing practice exams with at least 15 minutes left.
- Lab output: at least one working detection or monitoring control per objective.
- Team value after passing: new log sources onboarded, detections added with ATT&CK mappings, and alert false positive rates tracked over the following quarter.
Cost, renewal and continuing education
| Item | GMON and GCDA (GIAC, USD excluding tax, checked 27 October 2026) |
|---|---|
| Certification attempt | $999 each |
| Exam retake | $899 |
| Attempt extension | $479 |
| Practice exam | $399 |
| Missed proctored appointment | $175 reseating fee, with a 7-day extension |
| Renewal | Every four years: 36 CPEs or retake the exam; $499, or $249 for each further renewal within two years of a full-price renewal |
Holding both lets you use the $249 rate on the second renewal if you align expiry dates. GIAC/SANS affiliated training CPEs (up to 36) can count towards up to five certifications, so one course can support both renewals; other CPE categories apply to up to three certifications, with caps from 12 to 36. Check current fees before booking.
Common failure patterns
- Taking GCDA without cloud logging experience: two of the nine objectives are Azure, AWS, Defender and Sentinel.
- Treating GMON as a network-only exam: five objectives are endpoint and configuration focused, including application control and secure baselines.
- Studying old GCDA material: the objectives and passing score changed for versions from 27 April 2026.
- Relying on lookups: GCDA's pace does not allow it.
- Not linking learning to the job: teams that fund the exam without a plan to use the skills see no change in detection coverage.
Where it fits on the career path
| Stage | Credentials | Notes |
|---|---|---|
| Entry | GSEC, Security+, CySA+ | Breadth and analyst basics |
| Monitoring and detection | GMON, GCDA | This page |
| Response and hunting | GCIH, GCFA, OffSec OSTH | Investigation and hunting depth |
| Architecture | GDSA | Designing defensible networks and endpoints |
- Before: the GIAC GSEC Guide or the CompTIA CySA+ Guide.
- After: the GIAC GCIH Guide, the OffSec Threat Hunter Certification Guide or the GIAC Defensible Security Architect Guide.
- Roles: the SOC Analyst Career Guide and the Detection Engineering Guide.
GIAC does not publish pass rates or salary figures on the pages checked.
Practitioner checklist
- Decide GMON or GCDA first from your actual job: engineering monitoring, or working the SIEM.
- Confirm the current exam version, passing score and CyberLive status in your GIAC account.
- Build a lab that covers every objective, including Azure and AWS logging for GCDA.
- Produce one working detection or control per objective and map it to ATT&CK.
- Build your own index with page references.
- Sit practice exams at real pace: 2 minutes 12 seconds a question for GMON, 96 seconds for GCDA.
- Book the proctored slot early inside the 120-day window.
- Align expiry dates if you plan to hold both, to use the $249 renewal rate.
Standards and references
- GIAC: GIAC Continuous Monitoring Certification (GMON)
- GIAC: GIAC Certified Detection Analyst (GCDA)
- GIAC: Certification Pricing
- GIAC: How to Renew
- GIAC: CPE Information
- GIAC: Certifications
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · SIEM Guide · Detection Engineering Guide · Blue Team Certifications Guide · SOC Analyst Career Guide