OSDA – Cert

Introduction

Why I’m Taking This Course

For the past few years, I’ve noticed that local companies have been increasingly promoting Offsec’s range of cybersecurity certifications.

I used to think Offsec only offered red team courses like the OSCP. Since my job isn’t focused on red teaming, it was hard to justify the training to my manager, so I always put the idea aside.

However, after checking the official Offsec website this year, I discovered they also offer several blue team courses. Three, in particular, caught my eye:

  • OSDA (Security Operations Center)
  • OSIR (Incident Response)
  • OSTH (Threat Hunting)

My current role primarily involves reverse-engineering malware and writing intelligence reports. But this year, I’ve been increasingly called upon to investigate security breaches at external companies. This requires me to go on-site to conduct live digital forensics.

In these scenarios, I have to work directly on the client’s computers, often needing to inspect tens or even hundreds of machines for malicious activity within a single day.

Although our company has EDR solutions that we can deploy for scanning, we still need to manually investigate each machine and report our findings to the client in a very short amount of time.

This presents a few challenges:

  • I need to rely on portable tools that don’t require installation on the client’s systems.
    • Sysinternals Suite
    • My own custom scripts

Because I can’t install anything on the client’s computers, any scripts I write must use languages native to Windows, like PowerShell or VBScript.

Looking beyond my current role, I’ve noticed that there are many SOC-related job openings in the market right now. While I’m not necessarily planning to pivot to a SOC position, it made me realize that I don’t have much hands-on experience with SIEM platforms.

After reviewing the course syllabus, this program seems to be a perfect match for my needs.

Signing Up for the Course

I chose the official three-month, self-paced online course, which included one exam attempt. My access started on July 4, 2025, but because I was quite busy in July, I didn’t actually remember to start the OSDA course until the beginning of August.

On top of that, I have an overseas business trip in October that I need to start preparing for in September.

This meant I really only had the month of August to study and schedule the exam, which made for a very tight schedule.

From Learning to the Exam

The OSDA course content is very comprehensive. However, after reading reviews and opinions from others online, the general consensus seemed to be that you don’t need to go through all the course material, as the exam isn’t closely related to the earlier content.

This isn’t entirely wrong, because the exam tests your ability to use a SIEM to investigate a compromised environment

However, I found the earlier modules to be extremely practical. The way the material is structured is very beneficial for real-world work and even gave me some ideas for new tools I could develop for my on-site digital forensics investigations.

In my opinion, even though the exam content is more closely related to certain core tools and platforms, I still found the earlier chapters extremely valuable because they helped me build a complete analytical framework.

That said, if you already have experience in red team operations or if you frequently read cyber threat intelligence reports and have a strong understanding of hacking techniques and common attack scenarios, then you might find the exam to be relatively straightforward.

How to Prepare for the Exam

If you’ve enrolled in the SOC-200 course for the OSDA certification and have enough time, the best approach is obviously to complete all the course material and labs.

However, if you’re short on time and want a faster path to passing the certification, here is my personal advice:

  1. Focus on grinding through the Challenge Labs provided in the course.
  2. Watch the OSA-SOC-200 course videos where the instructor explains how she solves the Challenge Labs.
  3. Join the official Offsec Discord server, complete the verification process to access the Challenge Lab channel, and then read through the entire chat history from the beginning.

Of these three steps, the third one was by far the most helpful for me. Reading through the community discussions was what really helped me form a clear idea of what to expect on the exam.

Personal Takeaways

How to Write the Report

This was the part that gave me the most trouble. I’ve also seen comments in other online reviews where people wished the course taught report writing.

Initially, I really wanted to use Markdown, since editing in Word can be cumbersome. I even found some GitHub repositories with tools to convert Markdown to the required report format.

However, in the end, I used the official Word template provided by Offsec for my report.

You can find the official report template here.

I opted to use the official template because I didn’t have much time left, and I wasn’t satisfied with the conversion tools I found on GitHub. Ultimately, I decided not to waste any more time on formatting.

The main difficulty in report writing is not knowing how much detail Offsec expects. The OSDA Exam Guide just says to be “as detailed as possible.”

I don’t know if my report was structured perfectly, but this experience has definitely given me more insight into report writing and broadened my perspective.

How to Conduct the Investigation

For me, the hardest part of this exam is: how do you know for sure that you’ve found all the traces of an attack?

I’ve read many online articles where people mention using an exhaustive approach—essentially, reviewing everything to make sure nothing is missed.

I took the same approach, as it feels like the safest bet.

The Exam Process

About 16 hours before my exam was scheduled to start, I received an email from Offsec stating there was an issue with the exam system. They asked if I wanted to reschedule. If I chose to proceed and failed, they would grant me a free retake.

I was grateful for the offer of a free retake and, of course, chose to proceed with the exam. Although having a second chance was great, my work schedule for the next month was completely packed.

The free retake had to be used within a month, and I didn’t think I could find enough time to prepare properly again. So, my goal was still to pass on the first attempt.

I was a bit worried about what “issues” the system might have, fearing a broken attack module would make it impossible to pass. Fortunately, everything went smoothly, and I passed on my first try.

Exam Start Time: 2025/09/05 13:00 (GMT+8), Friday

Exam Timeline:

  • 2025.09.05 — 12:45: Connected with the proctor to verify my environment and go over the rules.
  • 2025.09.05 — 13:00: Exam officially started.
  • 2025.09.05 — 15:50 ~ 16:00: Took a 10-minute bathroom break.
  • 2025.09.05 — 16:00 ~ 19:00: Continued the exam.
  • 2025.09.05 — 19:00 ~ 21:15: Went out for dinner, took a shower, and rested.
  • 2025.09.05 — 21:15 ~ 23:45: Finished all the exam tasks.
  • 2025.09.05 — 23:45 ~ 03:30 (next day, 09.06): Went back to review everything from the beginning, worrying I might have missed something.
  • 2025.09.06 — 03:30 ~ 10:00: Slept.
  • 2025.09.06 — 10:00 ~ 12:00: Final review of my findings.
  • 2025.09.06 — 12:00 ~ : Went out for lunch. By the time I returned, the exam lab time had ended (at 13:00).

Reporting Timeline:

  • 2025.09.06 — 13:00 ~ 16:00: Relaxed; didn’t want to start the report yet.
  • 2025.09.06 — 16:00 ~ 19:00: Started writing the report.
  • 2025.09.06 — 19:00 ~ 21:00: Went out for dinner and a shower.
  • 2025.09.06 — 21:00 ~ 05:00 (next day, 2025.09.07): Finished the report and submitted it to Offsec.

2025.09.08 04:00: Received the email that I had passed.

Tips from Other Blogs

Summary of Tips

Here is a summary of notes I gathered from other blogs:

  • Some say they passed with a 25-page report, while others wrote nearly 100 pages with over 100 screenshots.
  • Record the timestamp for every clue you find. This is crucial in case you miss a trace and have to reset the environment, which would otherwise force you to start your search from scratch.
  • The attack phases are sequential and logically connected. It’s best to complete them before taking a long break (like sleeping), as you might lose your train of thought.
  • Most people don’t use the official Word template, opting for Markdown instead. The course instructor also uses Obsidian (a Markdown-based notes app).
  • It’s a good idea to save the detection queries you use while practicing the Challenge Labs, as they can be helpful during the exam.
  • The Safari browser is not recommended. Chrome is the only officially recommended browser, though Firefox may also work [8].
  • It’s possible for an attack to generate no logs. If you tell the proctor that there are no logs, they may not respond. However, if you request that they investigate the lab environment, they will typically comply [8].
  • Consider writing the report in your native language first and then using a translation tool [8] [9]. DeepL is recommended [9].