OSDA

It is a 24-hour, proctored assessment conducted over a secure VPN, with an OffSec employee proctoring. The network includes a SIEM with endpoint integration, so you work against realistic telemetry rather than static questions. Plan your sleep and documentation time in advance; 24 hours is generous only if you stay organized.

The exam features 10 phases, each containing a series of attacker actions. For every action you must detect it, understand what happened, and document it. Treat each phase as a mini-investigation: establish what the attacker did, which logs or artifacts prove it, and how you would explain it to a responder.

No. OffSec states that, unlike the OSCP+, OSIR, and OSTH, the OffSec Defense Analyst (OSDA) certification does not expire. That makes it a one-time investment in validation, though you should still keep your practical detection skills current as tooling and attacker techniques change.

There are no formal prerequisites, but OffSec strongly encourages a solid foundation in TCP/IP networking, familiarity with Linux and Windows, and a basic understanding of cybersecurity concepts. Security+ level knowledge is a reasonable benchmark. Without networking and operating system fundamentals, log interpretation becomes guesswork rather than analysis.

OffSec describes the course as 300+ hours of content, with most learners finishing within three to six months depending on schedule and lab intensity. The 19 modules include videos, hands-on labs, and exercises, followed by more than a dozen Challenge Labs. Budget extra time for the Challenge Labs; they are where detection intuition is built.

The course centers on enterprise SIEM tooling, specifically ELK and Splunk, for collecting and correlating security information. You should be able to search, filter, and pivot across Windows and Linux event logs, and interpret artifacts rather than just read alerts. Familiarity with Invoke-Obfuscation is also mentioned for simulating adversarial behavior.

The five course domains are foundations of SOC operations, threat detection and analysis, vulnerability and risk management, endpoint and network defense, and access control and privilege management. Expect log-based detection, alert triage, malware analysis, and investigation of administrative group abuse such as Domain Admins and Enterprise Admins.

OffSec's published SOC-200 page does not state a retake policy for the OSDA exam, so confirm current terms with OffSec before booking. Note that the Learn One subscription is described as including two exam attempts, while the Course + Cert Bundle is described as including a single exam attempt. Choose your purchase accordingly.

Weak documentation and slow triage, not missed alerts. Candidates often find the activity but cannot show the evidence chain or explain impact concisely. Practice writing short, evidence-backed incident notes for every Challenge Lab action, including timestamps, log sources, and the attacker's next step. Also avoid over-investigating one phase at the expense of the others.

OffSec lists roles such as SOC Analyst, Incident Responder, Threat Hunter, Cybersecurity Technician, and Junior Security Analyst, plus system administrator or IT generalist roles with security responsibilities. It is positioned as an entry or advancement credential for defensive operations rather than a senior architecture certification.