HTB CDSA study guide
HTB CDSA · Work through your exam, one topic at a time.
The HTB Certified Defensive Security Analyst (CDSA) is a hands-on credential aimed at people who investigate and contain intrusions rather than launch them: SOC analysts, blue-team engineers, incident responders, and forensic examiners who want evidence that they can work a live environment under pressure. The exam is delivered as a practical engagement in real infrastructure, and candidates document their findings in a written report, so it tests both technical execution and the communication skills a defensive role demands daily. The HTB CDSA study guide has 7 sections and about 1,964 words.
01Incident Response and Threat Hunting
The Incident Response and Threat Hunting domain tests whether you can run a structured investigation: scope an intrusion, preserve evidence in the right order, and hunt for adversary behavior that no alert has caught yet. Expect scenario questions where you must choose the next action, justify an evidence-collection order, or turn an intelligence report into a hunt plan.
293 words, about 1 min02SIEM and Log Analysis
The SIEM and Log Analysis domain tests your ability to turn raw telemetry into defensible conclusions: parsing and normalizing logs, writing searches that answer a question, correlating events across sources, and triaging alerts without drowning in false positives. Know your sources and fields: Windows Security and Sysmon channels, Linux auditd/syslog, firewall and proxy logs, EDR telemetry, cloud audit logs.
309 words, about 2 min03Network Traffic Analysis and Intrusion Detection
Network Traffic Analysis and Intrusion Detection tests packet- and flow-level investigation: reading PCAPs, querying Zeek logs, interpreting IDS alerts, and recognizing command-and-control or exfiltration patterns even when traffic is encrypted. Separate flow data from full content.
302 words, about 2 min04EDR and Host-Based Analysis
EDR and Host-Based Analysis tests endpoint investigation: reconstructing process execution, identifying persistence, and using host telemetry to confirm or refute a network alert. Build process trees, not process lists.
264 words, about 1 min05Digital Forensics and Malware Analysis
Digital Forensics and Malware Analysis tests evidence acquisition, artifact interpretation, and safe malware triage - enough to answer what happened on a host and what a sample does. Acquire with a write blocker, verify SHA-256 before and after, and document the tool and version.
272 words, about 1 min06Active Directory and Windows Security Monitoring
Active Directory and Windows Security Monitoring tests whether you can read domain-controller and endpoint telemetry to detect credential theft, privilege escalation, and lateral movement. Kerberos events: 4768 TGT request, 4769 service ticket request, 4771 pre-auth failure.
261 words, about 1 min07Reporting and Communication
Reporting and Communication tests whether you can convert technical findings into a report a client can act on: an executive summary, a defensible timeline, evidence references, and prioritized remediation. Write for two audiences.
263 words, about 1 min