What the course covers
About this course map
OSDA is the defensive certification in OffSec's catalogue — the one that puts you on the other side of the glass. Everything the OSCP and OSEP candidate does to stay hidden, the OSDA analyst is trained to catch. The course behind it, SOC-200, is built for people working in or moving into a Security Operations Centre who want detection skill that is grounded in how attacks actually unfold, not in vendor dashboards.
What makes this course unusual is that it is taught by an offensive-security company. The detections you learn to write are aimed at the exact techniques their own red-team courses teach. You watch an attack chain from the defender's seat and learn to see the signal each stage leaves behind.
The exam is a 24-hour practical. You are given a live environment with attacker activity in it, and you have to detect, investigate and document what happened — the analyst's job under time pressure.
Module 01 — The attacker's methodology, from the defender's chair
You cannot detect what you do not understand. This module walks the attack lifecycle so every later detection has a reason.
Module 02 — Windows and Active Directory as a source of signal
Most enterprise attacks live in Windows and AD. This is where the evidence is.
Module 03 — Detecting initial access
Catching the intrusion at its earliest, cheapest point.
Module 04 — Detecting execution and persistence
Finding the attacker settling in.
Module 05 — Detecting privilege escalation and credential theft
The middle of the attack, where the damage compounds.
Module 06 — Detecting lateral movement
Watching the attacker spread, which is where a good SOC stops the incident.
Module 07 — Detection engineering
Turning understanding into rules that fire reliably and do not drown the analyst.
Module 08 — Investigation and response under time pressure
The analyst's actual job, and the exam.
Exam & certification
- 1Train with us instructor-led preparation, labs and practice questions.
- 2Sit the official examExam voucher sold separately. We buy it from the certification body on your behalf and send you the code — you book your own exam date.
- 3Get certifiedThe certification is awarded by OffSec when you pass their exam.
What you receive
- OffSec certification — issued by OffSec after you pass, and verifiable with them.
- Hacky Security certificate of completion — for the training itself, with a unique ID.
- Checkable by employers — anyone can confirm our certificate on the Verify page.
This course is Hacky Security’s own preparation training. The certification itself is awarded by OffSec, not by us.
Similar courses
Independent preparation training delivered from Hacky Security's own curriculum. Hacky Security is not affiliated with or endorsed by the certification body named above. Certification names and codes are the trademarks of their respective owners and are used only to describe what this course prepares you for.
