AVEVA

OSDA — SOC-200 Security Defense Analyst Preparation Training

Advanced 24 hours PLC, SCADA & HMI

Delivered from Hacky Security's own curriculum, by instructors who also work our SOC. Classroom, online live, or at your office.

At a glance

LevelAdvanced

DeliveryOnline live · 1-on-1 · Classroom

SyllabusDetailed outline below

PriceOn request

Enquire about this course

What the course covers

About this course map

OSDA is the defensive certification in OffSec's catalogue — the one that puts you on the other side of the glass. Everything the OSCP and OSEP candidate does to stay hidden, the OSDA analyst is trained to catch. The course behind it, SOC-200, is built for people working in or moving into a Security Operations Centre who want detection skill that is grounded in how attacks actually unfold, not in vendor dashboards.

What makes this course unusual is that it is taught by an offensive-security company. The detections you learn to write are aimed at the exact techniques their own red-team courses teach. You watch an attack chain from the defender's seat and learn to see the signal each stage leaves behind.

The exam is a 24-hour practical. You are given a live environment with attacker activity in it, and you have to detect, investigate and document what happened — the analyst's job under time pressure.

Module 01 — The attacker's methodology, from the defender's chair

You cannot detect what you do not understand. This module walks the attack lifecycle so every later detection has a reason.

•The stages of an intrusion, from initial access to objective

•What each stage looks like in logs and telemetry

•The MITRE ATT&CK framework as a shared map between attacker and defender

•Why detection engineering starts with knowing the offence

Module 02 — Windows and Active Directory as a source of signal

Most enterprise attacks live in Windows and AD. This is where the evidence is.

•Windows event logs: which IDs matter and what they actually record

•Sysmon: what it captures that the default logs miss, and how to configure it

•Authentication events and what abnormal ones look like

•Building a baseline so anomalies stand out

Module 03 — Detecting initial access

Catching the intrusion at its earliest, cheapest point.

•Phishing and malicious document execution in the logs

•Suspicious process ancestry: when Word spawns PowerShell

•Detecting the client-side execution techniques OSEP teaches

•Writing a detection rule that fires on the behaviour, not the filename

Module 04 — Detecting execution and persistence

Finding the attacker settling in.

•PowerShell and script-block logging: reading obfuscated commands

•Detecting living-off-the-land binary abuse

•Persistence mechanisms: scheduled tasks, services, registry run keys, and their log signatures

•Separating an administrator's normal activity from an attacker imitating one

Module 05 — Detecting privilege escalation and credential theft

The middle of the attack, where the damage compounds.

•Credential-dumping techniques and the telemetry they generate

•Detecting token manipulation and process access to LSASS

•Kerberos abuse: Kerberoasting, ticket attacks, and their log footprints

•Escalation attempts and the events that reveal them

Module 06 — Detecting lateral movement

Watching the attacker spread, which is where a good SOC stops the incident.

•Remote execution techniques and how each one logs

•SMB, WMI and remote service abuse in the events

•Correlating activity across hosts to see a movement path

•Distinguishing legitimate administration from lateral movement

Module 07 — Detection engineering

Turning understanding into rules that fire reliably and do not drown the analyst.

•Writing detections that survive the attacker's evasion attempts

•Tuning: the balance between missed attacks and false positives

•The cost of a noisy rule, and how alert fatigue turns detection off

•Testing a detection against the real technique

Module 08 — Investigation and response under time pressure

The analyst's actual job, and the exam.

•Triaging an alert: is this real, and how bad

•Reconstructing an attack timeline from scattered evidence

•Scoping the compromise: what was reached, what was taken

•Documenting the investigation so it stands up to a second reader — the exam deliverable

Sitting the official exam

Exam voucher sold separately. We buy it from the certification body on your behalf and send you the code — you book your own exam date. This course is Hacky Security's own preparation training; the certification itself is awarded by the certification body, not by us.

Similar courses

OffSec

OSCP — Offensive Security Certified Professional

OffSec

OSED — Windows User Mode Exploit Development

OffSec

OSEP — Evasion Techniques & Breaching Defenses

OffSec

OSWE — Web Expert: Advanced Web Application Attacks

Independent preparation training delivered from Hacky Security's own curriculum. Hacky Security is not affiliated with or endorsed by the certification body named above. Certification names and codes are the trademarks of their respective owners and are used only to describe what this course prepares you for.

OSDA — SOC-200 Security Defense Analyst Preparation Training

What the course covers

About this course map

Module 01 — The attacker's methodology, from the defender's chair

Module 02 — Windows and Active Directory as a source of signal

Module 03 — Detecting initial access

Module 04 — Detecting execution and persistence

Module 05 — Detecting privilege escalation and credential theft

Module 06 — Detecting lateral movement

Module 07 — Detection engineering

Module 08 — Investigation and response under time pressure

Sitting the official exam

Similar courses

Training

Products

Portals

Company