Most threat hunting credentials test whether you know hunting concepts; the OffSec Threat Hunter (OSTH) exam tests whether you can find a threat actor's footprint in an enterprise SIEM within eight hours and then document it well enough for someone else to reproduce. OSTH is the certification attached to OffSec's TH-200 Foundational Threat Hunting course. This guide sets out what OffSec publishes about it: the exam structure and scoring, the report rules, purchase options, the three-year expiry and renewal routes. It adds a preparation plan, decision guidance on when OSTH is the right choice and where it sits on a defensive career path. It is written for SOC analysts moving into hunting, incident responders, detection engineers and managers building hunt capability. Facts are from offsec.com and OffSec's support portal, checked 27 October 2026; check current fees and exam rules on those pages before you buy.
Key takeaways
- It is a practical hunting sprint. The exam simulates an eight-hour hunt in an enterprise environment: you review a threat intelligence report, hunt for the actor's indicators of compromise, identify compromised systems and assess impact, including exfiltration or encryption.
- Scoring is points based. Seven exercise questions worth up to 10 points each (70 in total), with partial credit; you need at least 50 to pass.
- The report decides the result. A Hunt Narrative with SIEM screenshots and queries, and a Findings timeline, due within 24 hours of the exam; late submission is an automatic fail.
- It is open book but no AI. Notes, online resources and the OffSec platform are allowed; LLMs and AI chatbots are prohibited, and so is seeking help from others.
- It expires after three years. Renew by passing a qualifying OffSec exam, a recertification exam in the six months before expiry, or through OffSec's CPE programme.
Who the certification is for
OffSec positions TH-200 as a 200-level, foundational course (41 hours of content) on threat hunting concepts and skills, using CrowdStrike Falcon and Splunk to detect network and endpoint indicators of compromise and respond to threats. The course page does not define an audience; based on the content, the natural candidates are:
- SOC analysts (tier 2 and above) who want to move from alert triage to hypothesis-led hunting.
- Incident responders who need to scope a compromise across many hosts quickly.
- Detection engineers who turn hunt findings into durable detections.
- Threat intelligence analysts who want to operationalise reports into hunts.
Weaker fit: people new to security, who should build log and endpoint basics first, and penetration testers looking for an offensive credential (see the OSCP Certification Guide). For the broader landscape, see the Cybersecurity Certifications Guide and the Blue Team Certifications Guide.
Exam format and domains
Format
| Item | OSTH (OffSec, checked 27 October 2026) |
|---|---|
| Duration | 8 hours of hands-on hunting |
| Scenario | Threat intelligence report on an actor; hunt for its IoCs across an enterprise environment; identify compromised systems; assess impact (exfiltration or encryption) |
| Scoring | 7 exercise questions, up to 10 points each, 70 maximum; partial credit for correct answers and completeness of findings and documentation |
| Pass mark | 50 points |
| Proctoring | Proctored; all activity must be on the host running the proctoring application |
| Connection | Local Kali with the exam VPN pack, or in-browser Kali (KiB) or Windows (WiB); not two methods at once |
| Resources | Open book: notes, online resources, the OffSec Learning Platform; no LLMs or AI chatbots; no help from others |
| Report deadline | 24 hours after the exam ends; late submission is an automatic fail |
| Results | Within ten business days, shown on your Achievements page; certificate claimed through Accredible |
Report requirements
| Element | OffSec requirement | Practical implication |
|---|---|---|
| Hunt Narrative | Relevant SIEM screenshots and the queries used, detailed enough for a technically competent reader to reproduce the steps | Screenshot every query that returns evidence, and paste the query text as you go |
| Findings | A timeline of each detected attacker activity | Keep a running timeline with timestamps, host, user, evidence and query reference |
| Strictness | Missing screenshots or information can reduce or eliminate points; submission is final | An answer without evidence may score nothing |
| Format | PDF inside an unencrypted .7z archive named with your OSID (for example OSTH-OS-XXXXX-Exam-Report); all queries as text in the PDF; under 100MB; verify the upload by MD5 hash | Rehearse building and hashing the archive before exam day |
| Template | Word or OpenOffice/LibreOffice templates suggested; your own is acceptable if structured and professional | Prepare the skeleton in advance |
Skills the exam exercises
OffSec does not publish a weighted domain list on the pages checked. From the exam guide and course description, prepare for these skill areas (our grouping):
- Intelligence to hypothesis: reading an actor report and turning its tactics and IoCs into searches. Mapping behaviour to MITRE ATT&CK techniques helps structure the hunt.
- SIEM querying: Splunk is named on the course page. See the Splunk SPL for Threat Hunting Guide.
- Endpoint telemetry: CrowdStrike Falcon is named on the course page; expect process, network and file events from endpoints.
- Scoping and impact: following an intrusion from initial access to the systems touched, and deciding whether data left or was encrypted.
- Documentation: evidence-led writing under time pressure.
Where identity fits: scoping an intrusion usually means following accounts, not just hosts: which credentials were used, where they logged on and which service accounts were abused for lateral movement. Practise pivoting on user and service account names as well as hashes and IP addresses. See the Identity Threat Hunting Guide.
Prerequisites and experience
The pages checked state no formal prerequisite. As a 200-level course, TH-200 assumes working security knowledge. Realistic readiness (our judgement):
- Logs: comfortable reading Windows event logs, Sysmon-style process data and network logs.
- SIEM: able to write searches with filters, aggregations and time windows in at least one SIEM.
- Attack knowledge: able to recognise common techniques such as credential dumping, lateral movement and persistence in telemetry.
- Writing: able to produce a clear incident-style report.
Preparation plan
- Choose the purchase option (before you start): the bundle gives 90 days of course access and one attempt, Learn One gives a year and two attempts; pick based on how many weeks you can study.
- Work through TH-200 (weeks 1 to 6): complete each module and its labs, writing your own notes and query library as you go, since the exam is open book.
- Build a query library (alongside): for each technique you meet, save a working query with a one-line explanation. This becomes your fastest reference in the exam.
- Practise reports (weeks 5 to 7): after each lab, write a short Hunt Narrative and Findings timeline in your exam template, with screenshots and query text.
- Timed rehearsal (week 8): run a full eight-hour practice hunt, stopping at the end to write the report in the following hours. Note where time went.
- Test the environment (week before): check your proctoring setup, VPN or in-browser option, and rehearse creating the .7z archive and its MD5 hash.
- Exam day: read the intelligence report fully, list hypotheses, then hunt. Capture evidence at the moment you find it; do not plan to "screenshot later".
If you fail: you can retake with a remaining attempt, or buy a retake on bundle and Learn One products; cooling-off periods vary by product, so check OffSec's retake policy. If your report scored insufficient points, OffSec allows a feedback request within 10 business days.
Small vs large organisations: a small security team may get more from Learn One or the bundle for one hunter. Larger teams building a hunt function can use Learn Enterprise (custom terms) and standardise the report format OSTH teaches as the team's hunt report template.
Measuring readiness and value
- Coverage: every lab finished with a saved query and a written mini-report.
- Rehearsal score: in a timed practice hunt, at least five of seven objectives answered with evidence.
- Report time: a full report produced in well under 24 hours.
- Team value after passing: hunts run per quarter, new detections created from hunt findings, and time to scope an incident.
Cost, renewal and continuing education
| Option (OffSec, USD, checked 27 October 2026) | Price | Includes |
|---|---|---|
| Course and Cert Bundle | $1,749 one-time | 90 days of access to one 200 or 300-level course, labs, one exam attempt |
| Learn One | $2,749 (also shown at $2,199 a year) | One year of access to one 200 or 300-level course, labs, two exam attempts |
| Learn Unlimited | $6,099 a year | Learning Library access and unlimited exam attempts while the subscription is valid |
| Learn Enterprise | Custom quote | Team terms and volume discounts |
OffSec pricing changes; check current fees on the course page before buying.
Expiry and renewal
- Validity: OSTH expires three years after the exam is passed.
- Renew by exam: pass a qualifying OffSec exam in the same category at the same or a higher level.
- Renew by recertification exam: taken within the six months before expiry.
- Renew by CPE: follow OffSec's Continuing Professional Education programme as set out in its CPE handbook.
- If it expires: you must retake and pass the OSTH exam.
Common failure patterns
- Finding evidence but not recording it: missing screenshots or queries can cost the points for a correct answer.
- Hunting without the report in mind: the narrative must be reproducible, so record steps as you go.
- Chasing IoCs only: impact assessment (exfiltration or encryption) is part of the task.
- Late or malformed submission: late is an automatic fail; archive format, naming and size rules are strict.
- Using AI tools: LLMs and chatbots are prohibited and treated as third-party help.
- Letting it lapse: the three-year expiry means a full retake if you miss renewal.
Where it fits on the career path
| Stage | Typical credentials | Relationship to OSTH |
|---|---|---|
| SOC analyst | CySA+, OSDA | Alert handling and detection basics before hunting |
| Detection and monitoring | GIAC GCDA, GMON | Log and SIEM depth that hunting relies on |
| Threat hunter | OSTH | Practical hunt and report under time pressure |
| Incident response and forensics | GCIH, GCFA | Deeper investigation after a hunt confirms compromise |
- See the OSDA Certification Guide, the GIAC Detection and Monitoring Guide and the Incident Response and Forensics Certifications Compared Guide.
- For the role and the practice: the Threat Hunter Career Guide and the Threat Hunting Guide.
OffSec states that it does not release pass or fail rates or certificate holder counts.
Practitioner checklist
- Pick the purchase option that matches your study time and number of attempts needed.
- Build a personal query library and notes while working through TH-200.
- Prepare a report template with Hunt Narrative and Findings timeline sections.
- Rehearse a full eight-hour hunt followed by a report.
- Test proctoring, connection method, archive creation and MD5 verification beforehand.
- Capture screenshots and query text the moment you find evidence.
- Submit within 24 hours in the required format and naming.
- Diarise the three-year expiry and choose a renewal route early.
Standards and references
- OffSec: TH-200 Foundational Threat Hunting (OSTH)
- OffSec Support: OSTH Exam Guide
- OffSec Support: OSTH Exam FAQ
- OffSec Support: TH-200 Foundational Threat Hunting FAQ
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · Threat Hunting Guide · Threat Hunter Career Guide · OSDA Certification Guide · Identity Threat Hunting Guide