XDR Analyst study guide
XDR Analyst · Work through your exam, one topic at a time.
The XDR Analyst credential is a vendor-neutral, independent-study certification aimed at security operations staff who investigate and respond to threats using extended detection and response platforms. It suits SOC analysts, Tier 1 and Tier 2 responders, detection engineers, and IT security generalists moving into detection and response work. The XDR Analyst study guide has 6 sections and about 2,055 words.
01XDR Fundamentals and Platform Components
This domain covers architecture: how an XDR platform ingests endpoint, network, identity, email, cloud and SaaS telemetry, normalizes it, correlates across sources, and drives response. Expect questions that ask you to distinguish a true cross-source detection platform from a rebranded EDR console, and to identify what breaks when a source is missing.
346 words, about 2 min02Endpoint Security and Endpoint Detection and Response
EDR value comes from depth of collection: process creation with full command line and parent lineage, module and image loads, file writes, registry modifications, network connections tied to a process, script block logging, AMSI content, and DNS queries. On Windows, kernel callbacks and ETW provide visibility that survives user-mode evasion; user-mode API hooking alone can be unhooked.
338 words, about 2 min03Network and Cloud Telemetry Analysis
Flow records (NetFlow, IPFIX, VPC Flow Logs) carry metadata only: five-tuple, byte and packet counts, timestamps. They are excellent for beaconing, data-volume anomalies and lateral movement, but they cannot show payload content.
338 words, about 2 min04Identity and Email Threat Analysis
Sign-in logs give result, source IP and ASN, device compliance, MFA outcome, conditional access result and token issuance. Core attack patterns: password spray (many accounts, few passwords, slow to dodge lockout), MFA push fatigue, adversary-in-the-middle phishing that steals session tokens so MFA is satisfied by replay, OAuth consent phishing that needs no password at all, and token theft from an endpoint.
346 words, about 2 min05Threat Intelligence, Hunting, and Analytics
Strategic intel describes adversary intent, operational intel describes campaigns and TTPs, tactical intel maps to ATT&CK techniques, and technical intel supplies IOCs such as hashes, domains and IPs. Assess every feed on confidence, freshness, source reliability and sharing constraints (TLP).
343 words, about 2 min06Incident Triage, Response, and Automation
Prioritize by severity multiplied by confidence, asset criticality and potential blast radius - not arrival order. A repeatable sequence: validate the alert, scope how many hosts and accounts are affected, classify against ATT&CK, contain, eradicate, recover, then document.
344 words, about 2 min