Skip to content
CertGPS

Certified Defensive Security Analyst

Proves you can investigate intrusions across several lab networks for seven days, then write an incident report an instructor grades

IntermediateHack The Box

The exam

Exam cost
$210
Study time
3-6 months
Passing score
Unpublished points threshold plus a commercial-grade report
Valid for
No expiration

Before you book

  • Required: 100% completion of the HTB Academy SOC Analyst job-role path (15 modules)
  • Required: an exam voucher ($210, or included with the Silver Annual plan)
  • Recommended: web, operating system and networking basics, plus intermediate knowledge of penetration testing concepts

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

Study guide

Last updated

HTB CDSA Study Guide: The SOC Analyst Path, a 7-Day Investigation, One Report

HTB Certified Defensive Security Analyst (CDSA) is Hack The Box's practical test for security operations center (SOC) analysts and incident handlers. You get seven days inside several lab networks to work out what an attacker did, and then you write an incident report that an instructor marks. You can't sit it until you've completed all 15 modules of HTB Academy's SOC Analyst path.

Who it's for

HTB lists entry-level security analysts, SOC analysts, incident handlers and forensic analysts as the audience, plus penetration testers and IT administrators who want the defensive view. It rates holders at an intermediate level. The best fit is a tier 1 analyst who triages alerts all day and wants proof of investigation skills that alert queues rarely build, or an administrator moving into a SOC who learns better from labs than from slides.

It's a poor fit if your employer or a government contract wants a CompTIA credential by name; CySA+ answers that need. BTL1 is the lighter practical option: one day, 20 questions, no written report. On the offensive side, CPTS is the same exam model on a 28-module path.

The exam at a glance

HTB CDSA
FormatPractical security analysis, SOC operations and incident handling across several lab networks, with flags to submit and a written incident report
Time7 days of lab access; the report is due within the same 7 days
Passing standardA minimum points total (not published) and a report judged commercial-grade by an HTB instructor
Price$210 voucher (€180, £150), two attempts, valid one year from purchase; Silver Annual ($550 for new subscriptions from October 12, 2026) includes a CJCA voucher and one specialist voucher
DeliveryOnline over VPN, from Pwnbox or your own virtual machine
Prerequisite100% of the 15-module SOC Analyst job-role path
ResultsWithin 20 business days
ValidityNo expiration date

The 15 modules, read as a syllabus

HTB publishes nine knowledge areas and no weights: SOC processes, SIEM operations in Elastic and Splunk, tactical analytics, log analysis, threat hunting, Active Directory attack analysis, network traffic analysis including intrusion detection, malware analysis, and digital forensics and incident response. The modules show where the time goes.

  • Windows detection carries the most: Windows Event Logs & Finding Evil, Windows Attacks & Defense, and Detecting Windows Attacks with Splunk.
  • Two SIEM stacks: Introduction to Threat Hunting & Hunting With Elastic, plus Understanding Log Sources & Investigating with Splunk.
  • Network evidence across three modules: Intro to Network Traffic Analysis, Intermediate Network Traffic Analysis, and Working with IDS/IPS.
  • Malware triage: Introduction to Malware Analysis, JavaScript Deobfuscation, and YARA & Sigma for SOC Analysts.
  • The bookends: Incident Handling Process, Security Monitoring & SIEM Fundamentals, Introduction to Digital Forensics, and Security Incident Reporting.

The path teaches two SIEMs, so a Splunk-only analyst has Elastic queries to learn. HTB's list of prerequisites for success also includes "intermediate knowledge around web and infrastructure penetration testing concepts", an unusual line for a blue team exam that makes sense once you see how much of the path is about recognizing Active Directory attacks in logs.

Preparing for seven days of evidence

Do the path in order and don't skip the skills assessments, which have no published answers and are the nearest thing to exam questions you'll get. HTB's own estimate for the path is 24 days. Treat that as a floor and set your exam date from your real pace through the first four modules.

Build three habits along the way. First, keep a query notebook: every Splunk search and Elastic query that found something, with the event IDs it relied on. Second, write a short incident timeline after each module's assessment, because the exam report is built around one. Third, after the path, practise on Hack The Box Sherlocks, the investigation labs on the main HTB platform, which cover DFIR, SOC, malware and threat hunting scenarios.

Report writing deserves its own week. The Security Incident Reporting module sets the standard, HTB issues a template when you start the exam, and SysReptor hosts official HTB templates for CDSA if you want to practise in the same layout. A rough split for part-timers: 65% path, 20% Sherlocks and repeated assessments, 15% report drafts.

In the exam, write as you investigate. Seven days is shorter than CPTS's ten, the lab and report share the deadline, and a missed upload costs you the voucher and the free retake.

After the result

CDSA doesn't expire and carries no fees or continuing education. You claim the certificate from the exam history tab and receive a Credly badge. A failed first attempt comes with instructor feedback, and you have 14 days from receiving it to start the free retake, which is another seven days.

Where to go next:

  • BTL2 for malware analysis, threat hunting and a 72-hour report-based exam.
  • GCIH if your employer funds SANS training and wants a GIAC credential.
  • SC-200 if your SOC runs on Microsoft Sentinel and Defender.

Our view

CDSA tests what a SOC analyst is hired to do: follow an intrusion through logs and packets and explain it in writing. The seven-day report-graded format is harder to game than any question bank, and $210 for two attempts is cheap. On the other hand, you must buy and finish the path even if you've worked in a SOC for years, HTB doesn't publish the pass threshold, and we'd expect an HR screen to recognise CySA+ or a GIAC certification more readily than a Hack The Box name. If you want to build investigation skills, it's one of the better uses of a few hundred dollars in defensive training.

Sources