OSDA and SOC-200: SIEM log analysis and reporting guide

OSDA and SOC-200 develop practical analysis of attacker activity in a SIEM. Since September 2025 the exam uses pre-recorded logs for a stable environment. Candidates receive 23 hours and 45 minutes for ten phases, then 24 hours for reporting.

Required outcome

Phases contain actions such as enumeration, brute force, lateral movement, privilege escalation and persistence. Candidates must detect, understand and explain the attacker’s access.

An alert screenshot is insufficient. Reports need the query, time range, data source, evidence and conclusion. Separate logged fact from analytical hypothesis.

Investigation workflow

1. Establish timeline and data sources.
2. Identify the first anomaly.
3. Pivot through user, host, IP and process.
4. Correlate events into an attack technique.
5. Determine access gained and likely next step.
6. Preserve queries and contextual screenshots.

Build small queries before combining them. An over-broad query hides ordering and produces accidental matches.

Preparation

Practise Windows Event Logs, Sysmon, authentication, PowerShell, processes, networking and Active Directory. For each technique, record the necessary source and detection limitations.

OSDA complements offensive work by showing operator artefacts. Connect learning with purple teaming and the cyber threat intelligence lifecycle.

Timeline-led investigation

Establish the time range, hosts and identities around the first reliable signal. Build a timeline from high-value events: authentication, process creation, PowerShell, service changes, scheduled tasks and network connections. A single event rarely describes an incident; useful evidence emerges from correlating source, destination, user and order.

Expand the time window gradually. A broad opening query produces noise, while an excessively narrow one may hide preparation or persistence. Save every filter with the assumption it was intended to test. If the source does not record the required field, state that limitation instead of inventing the missing fact.

Query and evidence quality

A good query is readable, repeatable and constrained through specific fields. Begin with the raw event, verify field names and add aggregation only afterwards. In a report, include the query, time range, relevant records and interpretation. A chart screenshot without its query and context is incomplete evidence.

Separate observation from assessment. “Process A started process B at 10:14” is a telemetry fact. “The attacker moved laterally” is a conclusion that needs additional events and reasoning. This language improves report credibility and exposes telemetry gaps clearly.

An analyst preparation plan

Build a personal catalogue of small detections for authentication, execution, persistence, credential access and host-to-host movement. Record the required source, key fields, likely false positives and validation method for each. Then combine two or three detections into scenarios instead of creating one opaque query.

Readiness means moving from an alert to a timeline, identifying confirmed actions, describing impact and naming the additional evidence required to close uncertainty. That is what separates incident analysis from mechanical IOC searching.

Analytical report checklist

Every stage should include log source, exact time range, host, account, event identifier or field, and the query used. If events come from several time zones or systems, normalise them and state the selected zone. Otherwise, the sequence may only appear correct.

Separate initial access, execution, persistence, credential access, lateral movement and impact only where telemetry supports that classification. Label missing evidence as a visibility gap. Do not assign an ATT&CK technique from a similar process name alone; mapping should follow behaviour.

Finish with immediate containment actions and longer-term improvements to logging, retention, correlation and detection tuning. Each recommendation must answer a specific gap revealed by the investigation.

Try to rebuild the timeline from the report alone. If private SIEM tabs are still required, a query, time range or context is missing. Apply the same review to conclusions: each one should identify supporting evidence, confidence and the data required for complete confirmation.

---

Sources: OffSec OSDA Exam Guide, OSDA Exam FAQ.