OSDA study guide
OSDA · Work through your exam, one topic at a time.
The OffSec Defense Analyst (OSDA) is a hands-on, blue-team credential earned by passing the exam tied to the SOC-200: Security Operations and Defensive Analysis course. It is aimed at people moving into security operations, threat analysis, or incident response, as well as experienced defenders who want a practical SOC analyst credential. The course is a 200-level, challenge-based program covering SOC workflows, threat detection with SIEM platforms such as ELK and Splunk, vulnerability and risk management, Windows and Linux endpoint and network defense, and access control and privilege management around groups like Domain Admins and Enterprise Admins. The exam itself is a 24-hour proctored assessment run over a secure VPN, made up of 10 phases, each containing a series of attacker actions you must detect, analyze, and document. The OSDA study guide has 5 sections and about 1,752 words.
01Foundations of SOC Operations
This domain covers how a security operations center actually runs: tiered roles, the alert-to-case lifecycle, escalation and shift handover, documentation standards, and the metrics leadership uses to judge the SOC. Tier 1 triages and disposes; Tier 2 investigates and contains; Tier 3 hunts, engineers detections, and runs major incidents.
358 words, about 2 min02Threat Detection and Analysis
This domain covers how detections are designed, tested, tuned, and how an analyst moves from a single event to a defensible conclusion using host and network evidence. Detection logic sits on a spectrum.
361 words, about 2 min03Vulnerability and Risk Management
This domain tests whether you can turn scanner output into a defensible remediation order and document the decisions you cannot fix. The CVSS base score measures technical severity in a vacuum.
356 words, about 2 min04Endpoint and Network Defense
This domain tests whether you can read host and network telemetry together and recognize adversary behavior that spans both. On endpoints, process ancestry matters more than process name.
321 words, about 2 min05Access Control and Privilege Management
This domain covers authentication, authorization, and the credential hygiene that determines how far an intruder travels after the first foothold. AAA means identification, authentication, authorization, and accounting.
356 words, about 2 min