OSDA case studies

The OffSec Defense Analyst (OSDA) is a hands-on, blue-team credential earned by passing the exam tied to the SOC-200: Security Operations and Defensive Analysis course. It is aimed at people moving into security operations, threat analysis, or incident response, as well as experienced defenders who want a practical SOC analyst credential. The course is a 200-level, challenge-based program covering SOC workflows, threat detection with SIEM platforms such as ELK and Splunk, vulnerability and risk management, Windows and Linux endpoint and network defense, and access control and privilege management around groups like Domain Admins and Enterprise Admins. The exam itself is a 24-hour proctored assessment run over a secure VPN, made up of 10 phases, each containing a series of attacker actions you must detect, analyze, and document. The OSDA case studies are 5 cases and about 3,648 words.