Skip to content
CertGPS

GIAC Certified Intrusion Analyst

Proves you can read network traffic at the header level and write detection rules, tested partly through hands-on CyberLive tasks

AdvancedGIAC

The exam

Exam cost
$999
Study time
4-6 months
Passing score
67%
Valid for
4 years

Before you book

  • None required by GIAC
  • Optional training: SANS SEC503, which lists no prerequisites
  • Helpful, per SANS: some network monitoring and threat hunting knowledge

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where it leads

  1. GIAC Certified Intrusion Analyst

    You are here

  2. GIAC Network Forensic Analyst

    Advanced

    Next step. Applies packet and flow skills to after-the-fact network forensics, NetFlow and proxies

Study guide

Last updated

GCIA Study Guide: GIAC Intrusion Analyst Exam, SEC503 and Packet Practice

The GIAC Certified Intrusion Analyst (GCIA) tests whether you can read network traffic at the level of individual header fields and tell an attack from noise. It suits analysts who monitor networks for a living. Plan for a long sitting: 106 questions in four hours, with hands-on CyberLive items at the end, where you work in live virtual machines after the multiple-choice section.

Who GCIA suits, and who should look elsewhere

GIAC writes GCIA for people responsible for intrusion detection: security operations center (SOC) analysts, network engineers and administrators, system analysts and hands-on security managers. We'd place it a couple of years into a monitoring role, once you've triaged enough intrusion detection system (IDS) alerts to want to know what the rule actually matched. It's also useful to threat hunters who work from packet captures and flow records rather than endpoint telemetry.

If you've never read a packet capture, start lower. GSEC, GIAC's security essentials exam, is the gentler first step. If your SOC lives inside one vendor's SIEM and you rarely see raw packets, that vendor's exam, such as Microsoft's SC-200, may match your daily work more closely. And if your job is responding to incidents more than spotting them, GCIH is the closer fit.

The GCIA exam in one table

GCIA
Format106 questions, including CyberLive hands-on items; GIAC doesn't publish how many
Time4 hours
Passing score67% (exam versions released on or after January 21, 2023)
Price$999 per attempt; $899 retake; $399 per practice test
DeliveryProctored online through ProctorU or at a Pearson VUE test center; 120 days from activation
Materials allowedPrinted books, notes and your own index; nothing electronic
PrerequisitesNone set by GIAC; SEC503 lists none either
ValidityFour years; renew with 36 CPEs and a $499 fee, or by retaking the current exam

Fifteen objectives, bottom of the stack first

GIAC lists 15 objectives without weights. Grouped, they look like this:

  • Protocols: concepts of TCP/IP and the link layer, IP headers, fragmentation, IPv6, TCP, UDP and ICMP, application protocols
  • Tools: tcpdump filters, Wireshark fundamentals, SiLK and other traffic analysis tools
  • Detection: IDS fundamentals and network architecture, intrusion detection system rules, advanced IDS concepts such as tuning and correlation
  • Analysis: packet engineering, network forensics and traffic analysis across full packet capture, NetFlow and logs

Seven of the 15 are about protocols, and only three name a tool. Expect to dissect IP and TCP headers and judge each value as normal or anomalous, recognize fragmentation-based attacks in a capture, and tell typical UDP and ICMP behavior from the odd. Two objectives ask you to produce something rather than recognize it: you must craft tcpdump filters that match given criteria, and create effective IDS rules for varied malicious activity. Practise writing Berkeley Packet Filter (BPF) expressions with bit masks, for example to match one TCP flag combination, until you can do it without a reference.

GIAC's summary names Snort and Zeek as the open-source IDS tools in scope. SEC503 teaches Snort and Suricata rules side by side and gives most of its fourth section to Zeek, including scripting, so learn Snort rule syntax well enough to read a Suricata rule too.

GIAC says CyberLive items are usually weighted more than multiple-choice questions, get extra time, and that candidates who miss most of them shouldn't expect to pass.

Studying for GCIA: packets before tools

SEC503, Network Monitoring and Threat Detection In-Depth, is the course GIAC pairs with GCIA. It runs six days in person or about 46 hours self-paced, with 37 labs, evening bootcamp sessions and a capstone built on data from a real incident. SANS lists most current sessions at $8,780 before tax, and adding the GIAC attempt brings two practice tests. Its first two sections, which SANS calls "Packets as a Second Language", cover seven of the objectives between them, and the course works through tcpdump, Wireshark, Snort, Suricata, Zeek, tshark, SiLK and Scapy.

If you study without the course, build the same habits on your own:

  • Chris Sanders' Practical Packet Analysis (3rd edition, No Starch Press) for Wireshark and header reading; it dates from 2017, so pair it with current Wireshark documentation
  • Captures and exercises from malware-traffic-analysis.net, worked first in Wireshark, then again with only tcpdump
  • The Suricata and Zeek documentation, writing at least one rule or script for every capture you analyze
  • CERT's SiLK toolkit on a sample flow dataset, since SiLK has an objective of its own

GIAC's survey puts typical study at about 55 hours beyond any class, and up to three times that for someone new to the material. A sensible split for GCIA is heavy at the start: four weeks on headers, fragmentation, TCP, UDP and ICMP; two on application protocols such as DNS and HTTP; two on rules, filters and Zeek; one on SiLK and flow analysis; and a final week on practice tests and your index.

Your printed index matters more on this exam than most, because 106 questions in four hours leaves a little over two minutes each and the CyberLive work comes last. Index protocol field offsets and rule keywords, not definitions. GIAC also says your first practice test is the most accurate gauge, so don't burn it in the first month.

After GCIA: renewal, GX-IA and other next steps

GCIA lasts four years. Renew it with 36 continuing professional education (CPE) credits and a $499 fee, cut to $249 for further GIAC renewals within two years of a full-price one. SEC503 alone is listed at 46 CPEs, and SANS courses and new GIAC certifications can supply all 36 you need. If you fail, you wait 30 days, a $899 retake adds 60 days to your deadline, and three failures end the attempt.

Next steps:

  • GNFA applies the same skills after the fact: NetFlow, open-source proxies, encryption and encoding, and protocol reverse engineering
  • GCIH adds incident handling and the attacker tools you'll see in captures
  • GIAC Experienced Intrusion Analyst (GX-IA), a four-hour exam of 25 CyberLive tasks, priced at $499 for holders of an active GCIA against $1,299 without one

Our view

GCIA is respected for its protocol depth, which ages slowly: field-level TCP knowledge doesn't go stale when a vendor changes its console. The usual complaint is the other side of that. Encrypted traffic, cloud workloads and endpoint detection now carry much of the work that packet analysis used to do, and none of the 15 objectives mentions encryption, though SEC503 covers how to handle encrypted payloads. We think it's still worth the money for SOC analysts, network defenders and threat hunters who touch raw traffic every week. If your monitoring happens almost entirely in an endpoint or SIEM console, spend the $999 elsewhere.

Sources