OSIR
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
OSIR stands for Open Source Incident Response, a vendor-neutral credential aimed at practitioners who detect, triage, contain, and document security incidents using freely available tooling and standard operating procedures. It suits SOC analysts moving beyond alert triage, junior incident responders, system and network administrators who own part of an incident response plan, and forensic or GRC staff who need a shared operational vocabulary. The exam is built around six weighted domains: security operations and incident response fundamentals (20%), threat detection and monitoring (20%), incident handling and response procedures (20%), digital forensics and evidence collection (15%), network security monitoring and analysis (15%), and reporting, communication, and compliance (10%). Questions test judgement as much as recall, so expect scenario stems that ask what to do next, which evidence to preserve first, or how to phrase an escalation. Because the body of knowledge is open source, preparation should center on hands-on work: build a lab with a SIEM, an IDS, and packet capture; run tabletop exercises through the full incident lifecycle; and practise writing a timeline and an executive summary from raw logs. Layer in the published exam objectives and any official study guidance from the certifying body, and rehearse the domains you weight lowest, since those are where most candidates lose easy points. The certifying organization publishes current administrative details on its own site.
What you'll study
About OSIR preparation
What is the exam format?
Expect a multiple-choice, computer-delivered exam covering the six published domains, with scenario-based items rather than pure definitions. The certifying body publishes the authoritative format, including item types and whether any practical component exists, on its official site. Confirm there before you schedule, because formats change between versions.
How hard is OSIR?
Candidates with real SOC or incident response exposure usually find the detection and handling domains comfortable, while forensics and compliance questions expose gaps. The difficulty is not obscure trivia but sequencing: knowing what to do first, what to preserve, and who to notify. Hands-on lab time narrows the gap faster than reading alone.
What happens if I fail, and can I retake it?
Retake rules, waiting periods, and any fee for a second attempt are set by the certifying organization, not by this page. Check its official policy page before booking so you know how many attempts are allowed and how long you must wait. Plan your first attempt as if a retake is expensive.
How long should I study, and how do I order the domains?
Start with fundamentals and threat detection, since handling and forensics assume that vocabulary. Then work through incident handling, network monitoring, and evidence collection as one connected lifecycle, finishing with reporting and compliance. Most candidates need several weeks of part-time study with at least one full lab scenario; the official body publishes any recommended preparation hours.
Why do candidates fail?
The common failure modes are memorizing tool names without understanding the workflow, skipping forensics because it feels technical, and ignoring reporting and compliance as soft material. Another is never practising under time pressure. Scenario questions reward people who have actually walked an incident from detection to closure and can explain the order of operations.
Do I need to know specific tools?
The exam is vendor-neutral and open source in spirit, so focus on categories and capabilities: log aggregation, network detection, packet analysis, disk and memory acquisition, and timeline reconstruction. Knowing one tool in each category well, and understanding its limits, beats shallow familiarity with many products.
How much does it cost and how long is the appointment?
Fees, appointment length, and any regional pricing are published by the certifying organization and change over time, so this page does not quote them. Check the official registration page for the current figure, plus accommodation and rescheduling rules, before you commit to a date.
How is the exam scored, and what is the passing mark?
Scoring method and the passing threshold are set by the certifying body and published in its candidate handbook. Do not rely on secondhand numbers. Review the handbook for whether results are scaled, how domain performance is reported, and how quickly results are released after your appointment.
How long is the certification valid?
Validity periods and recertification requirements are defined by the certifying organization and can change between exam versions. Consult its official recertification page for the current cycle, continuing education expectations, and any renewal fee, and diarize the expiry date as soon as you pass.