HTB Certified Defensive Security Analyst
Preparing the CDSA
The SOC analyst job under real conditions: investigating incidents from SIEMs, logs and network traffic, then writing a professional incident report.
Defensive · SOCIntermediateSOC Analyst path
The exam at a glance
Duration7 daysThe countdown never stops
Prerequisite15 modulesSOC Analyst path completed at 100%
PassingPoints + reportPoints threshold and a professional report
ReportIn EnglishSubmitted once, cannot be changed
Good to knowHTB's reference defensive certification. Much of the syllabus is covered by this site's defensive methodologies.
Rules shared by every exam (attempts, deadlines, AI, Pwnbox): shared rules.
Page updated on 13 November 2026. Exam conditions change: check them on the HTB Help Center before booking.
Review
Study notes, flashcards and quizzes. Mastered cards and your best score are saved in this browser.
Module tracking
The 15 modules of the SOC Analyst path, grouped by theme. Tick them off as you go: progress is saved in this browser.
Process and monitoring
- Incident Handling Process
- Security Monitoring & SIEM Fundamentals
- Security Incident Reporting
Logs and SIEM
- Windows Event Logs & Finding Evil
- Introduction to Threat Hunting & Hunting With Elastic
- Understanding Log Sources & Investigating with Splunk
- Windows Attacks & Defense
- Detecting Windows Attacks with Splunk
Network
- Intro to Network Traffic Analysis
- Intermediate Network Traffic Analysis
- Working with IDS/IPS
Analysis and forensics
- Introduction to Malware Analysis
- JavaScript Deobfuscation
- YARA & Sigma for SOC Analysts
- Introduction to Digital Forensics
What the exam assesses
- Run an investigation in Elastic and Splunk starting from an alert.
- Read Windows logs and spot common attacks against AD.
- Analyse network traffic and use IDS/IPS (Suricata, Snort, Zeek).
- Perform a first malware analysis and write YARA and Sigma rules.
- Collect and analyse forensic evidence.
- Write an incident report: timeline, impact, indicators, recommendations.
Study plan
An example to adapt to your pace. Always alternate modules and practice.
- Wk 1–2Incident response process, SIEM, Windows logs.
- Wk 3–4Threat hunting in Elastic, investigations in Splunk, Windows attacks.
- Wk 5–6Network analysis and IDS/IPS.
- Wk 7–8Malware, YARA and Sigma, forensics.
- Wk 9HTB Sherlocks labs and a full incident report.
Exam tips
Specific to the CDSA
- Build the timeline as you go: it is the backbone of the report.
- Keep a list of indicators (IPs, domains, hashes, accounts) and reuse it to search everywhere.
- HTB Sherlocks are the practice closest to the exam.
Valid for every HTB exam
- Split the time: keep at least a third of it for the report.
- A screenshot at every key step, timestamped notes.
- Stuck for two hours? Note the lead and move on.
- Use the official template or SysReptor's from your practice runs onwards.
Review on this site
Methodology
Writing the report
Open →
MethodologySOC and SIEM
Open →
Cheat sheetSIEM queries
Open →
MethodologyWindows logs and Sysmon
Open →
Cheat sheetWindows Event IDs
Open →
MethodologyNetwork Traffic Analysis
Open →
Cheat sheetNetwork filters
Open →
MethodologyThreat hunting
Open →
MethodologyIncident response
Open →
MethodologyIncident response playbooks
Open →
MethodologyForensics (DFIR)
Open →
Cheat sheetSysmon configuration
Open →
Cheat sheetZeek logs
Open →
Cheat sheetWindows artefacts
Open →
Cheat sheetLinux artefacts
Open →
Cheat sheetVolatility 3
Open →
Cheat sheetReference frameworks
Open →
Ready to book?
- SOC Analyst path completed at 100%
- Exam voucher available
- Personal notes organised and easy to search
- Report template ready, already used at least once
- At least one full practice run under real conditions
- 7 days blocked out in the calendar