SOC-200 & OSDA Exam Tips That Actually Work in 2026

OffSec's SOC-200 (and its associated OSDA certification) is the most realistic blue-team exam on the market. It throws you into a live SIEM with messy real-world telemetry and asks you to detect, triage, and document attacks against Windows, Linux, and Active Directory targets — across 24 hours. Here's the playbook our analysts use to pass on the first attempt.

What the OSDA actually tests

OSDA is fundamentally a detection-engineering exam wearing a SOC analyst costume. You will not be running scans against domain controllers — you will be hunting through pre-recorded telemetry to find what already happened. Every point comes from correctly identifying the technique, mapping it to MITRE ATT&CK, and writing a clear narrative explaining attacker intent.

• Endpoint telemetry: Sysmon Event IDs 1, 3, 7, 8, 10, 11, 13, 22 are the bread-and-butter
• Network telemetry: Zeek logs (conn, dns, http, ssl, files)
• Authentication: Windows Security Event IDs 4624, 4625, 4634, 4672, 4768, 4769
• Process artifacts: command lines, parent-child relationships, hashes
• Web logs and IIS / Apache access logs for initial access

Lab strategy that pays off

Most candidates rush the SOC-200 modules and never re-visit the labs. That is the single biggest reason for failure. The exam scenarios re-use the same atomic tradecraft from the labs — different chains, identical primitives. Treat the labs as flashcards.

1. First pass: complete every module exercise without copy-pasting queries
2. Second pass: write your own one-liner queries from scratch for each exercise
3. Third pass: rebuild a personal cheat-book of 30-40 SPL / KQL / Lucene queries
4. Fourth pass: time yourself — every detection should take under 20 minutes

The Splunk queries you must memorize

index=endpoint sourcetype="WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
| search ParentImage="*\\WINWORD.EXE" OR ParentImage="*\\EXCEL.EXE" OR ParentImage="*\\OUTLOOK.EXE"
| search Image="*\\powershell.exe" OR Image="*\\cmd.exe" OR Image="*\\wscript.exe" OR Image="*\\rundll32.exe"
| stats count by ParentImage, Image, CommandLine, User, Computer
| sort - count

index=wineventlog EventCode=4769
| search Ticket_Encryption_Type="0x17"
| stats count dc(Service_Name) as services_requested by Account_Name, Client_Address
| where services_requested > 5
| sort - services_requested

index=zeek sourcetype="zeek:conn"
| eval bucket=floor(_time/60)*60
| stats count dc(bucket) as buckets by id_orig_h, id_resp_h
| eval ratio=round(count/buckets, 2)
| where buckets > 30 AND ratio > 0.8
| sort - buckets

Exam day workflow

MITRE ATT&CK mapping discipline

OSDA reports lose marks when ATT&CK techniques are mapped wrong. Always pick the most specific sub-technique. T1059 alone is generic — T1059.001 (PowerShell) is what graders expect.

Top 5 reasons candidates fail

1. Skipping the report polish — the report is graded harder than the detections
2. Mapping techniques to top-level tactics instead of sub-techniques
3. Missing one of the four mandatory attack chains in the exam network
4. Spending too long chasing a single complex finding instead of moving on
5. Forgetting timestamps in UTC throughout the report