OSIR study guide
OSIR · Work through your exam, one topic at a time.
OSIR stands for Open Source Incident Response, a vendor-neutral credential aimed at practitioners who detect, triage, contain, and document security incidents using freely available tooling and standard operating procedures. It suits SOC analysts moving beyond alert triage, junior incident responders, system and network administrators who own part of an incident response plan, and forensic or GRC staff who need a shared operational vocabulary. The OSIR study guide has 6 sections and about 2,087 words.
01Security Operations and Incident Response Fundamentals
This domain tests whether you can separate routine security operations from a real incident and apply a recognized response lifecycle. Expect questions that give you a log entry, a user report, or a policy snippet and ask what happens next, who owns the action, and how the case is prioritized.
369 words, about 2 min02Threat Detection and Monitoring
This domain tests detection engineering and monitoring judgment: which data sources to use, how to turn alerts into evidence, and how to decide whether an alert is a true positive. OSIR-style items often ask you to correlate identity, endpoint, and network telemetry rather than rely on a single signature.
364 words, about 2 min03Incident Handling and Response Procedures
This domain tests the mechanics of moving an incident from detection to recovery without destroying evidence or widening impact. Questions often ask you to choose a containment strategy, sequence response actions, or identify the incident commander's priority.
329 words, about 2 min04Digital Forensics and Evidence Collection
This domain tests whether you can collect and preserve digital evidence so it remains reliable and defensible. OSIR-style questions often ask you to order collection steps, choose the right acquisition method, or identify a chain-of-custody failure.
343 words, about 2 min05Network Security Monitoring and Analysis
This domain tests whether you can use network evidence to detect, scope, and explain an incident. Questions often give you flow records, packet captures, IDS alerts, or proxy logs and ask what the traffic proves and what to do next.
337 words, about 2 min06Reporting, Communication, and Compliance
This domain tests whether you can turn technical findings into accurate, timely, and legally aware communication. OSIR-style questions often ask who must be notified, what belongs in an incident report, and which deadline applies.
345 words, about 2 min