OSDA: OffSec Defense Analyst

What OSDA is and who runs it

OSDA — the OffSec Defense Analyst certification, course code SOC-200, “Security Operations and Defensive Analysis” — is OffSec’s first blue-team certification. Where most OffSec certs teach attacking, OSDA teaches detecting and documenting attacks. You learn to read logs at scale, understand how Windows and Linux artifacts are generated, and hunt attacker techniques — enumeration, brute forcing, lateral movement, privilege escalation, persistence — primarily through an ELK (Elastic) SIEM, with exposure to Splunk. It is a detection-and-analysis cert, not an incident-response, forensics, or pentest cert, and OffSec runs it as the defensive counterpart to its long line of offensive certifications.

Cost and what’s included

Like OffSec’s other 200/300-level courses, OSDA starts at $1,749 for the Course + Cert Bundle: 90 days of access to SOC-200, its hands-on labs, and one exam attempt. Learn One at $2,749/year gives a full year of course and lab access plus two exam attempts. Both are self-paced, and the certification does not expire. The course includes guided labs inside each module plus a set of end-of-course challenge labs that closely simulate the exam. Verify current pricing before buying.

Time: the exam and the report

The exam is proctored and described as “24-hour,” but the exam guide gives the exact time: 23 hours and 45 minutes of hands-on analysis, followed by a separate 24 hours to submit your report. The exam is divided into ten phases, each a set of attacker actions you must detect, understand, and document using the provided ELK SIEM — you cannot log into or exploit the machines; your only access is the logs and events. OffSec has also moved to pre-recorded logs for a more stable environment. Results come by email within ten business days.

How hard it is, honestly

Scoring is more forgiving than OffSec’s offensive exams: the ten phases are worth up to 10 points each, partial credit is awarded, and you need 75 of 100 to pass. Reviewers describe it as demanding but fair for its level. The real difficulty is thoroughness — uncovering every technique in each phase and documenting it clearly enough to reproduce. If you can complete the challenge labs comfortably, you are close to ready.

Is it worth it — and for whom

OSDA is a strong fit for aspiring or junior SOC analysts, threat hunters, and IT people pivoting into defensive security, and it is genuinely useful for red teamers who want to see how their activity looks from the blue side. It is foundational, so seasoned defenders may find parts basic. Its main differentiator is that it is hands-on and practical — you actually hunt through a live SIEM rather than answer multiple-choice questions — which sets it apart from many entry-level blue-team certs.

How to prepare

Come in with solid TCP/IP, comfort on both Windows and Linux, and Security+ level fundamentals. Read each module, attempt the in-line exercises, then review the recordings for anything you missed. The challenge labs are where the real skill is built — prioritize them and treat them like mini-exams. Build a repeatable methodology: map hostnames to IPs, keep an IOC list, add fields as columns in Kibana, and pivot on process and parent-process IDs to reconstruct the attack chain. Document as you go, including your exact queries, so your report nearly writes itself.

SourcesOffSec SOC-200 course & pricingOSDA Exam Guide