Fresh off taking the CPTS and completing the CBBH course. I knew HackTheBox had something special when it came to the development of cybersecurity related courses.

At the time of writing this article there have only been two people who have passed the CDSA exam, being one of these individuals I felt compelled to share my thoughts.

Background

In terms of cybersecurity experience I have been in the industry for around 3 years, I got my start as a SOC analyst for a small MSSP. In this particular role I learned about incident response, threat detection, and some vulnerability management.

Over the last couple months I have taken a wide variety of hands on security certifications from OSCP, PNPT, CRTO, to CPTS. As you probably can tell all of these certifications are more so related to offensive security. The reason why I spent so much time/resources on learning offensive security is that it truly helped me understand the attacker methodology and the "why" behind the usage of certain tooling and techniques. I recommend this to anyone trying to become a well rounded security professional. When HackTheBox released CDSA this really piqued my interest given my introduction to cybersecurity stemming from security operations.

Per HackTheBox

The HTB Certified Defensive Security Analyst (aka HTB CDSA) is a highly hands-on certification that assesses candidates on multiple domains, techniques, and concepts of defensive security. HTB Certified Defensive Security Analyst (HTB CDSA) certification holders will possess technical competency in the security analysis, SOC operations, and incident handling domains at an intermediate level.

The Coursework

Overall the CDSA coursework is very solid it gives a good intro to multiple cybersecurity disciplines such as threat hunting, incident response, and malware analysis. Some key modules which I found enjoyable were Introduction To Malware Analysis and Introduction To Digital Forensics.

Here is a quick overview of the course:

• SOC Processes & Methodologies

• SIEM Operations (ELK/Splunk)

• Tactical Analytics

• Log Analysis

• Threat Hunting

• Active Directory Attack Analysis

• Network Traffic Analysis (Incl. IDS/IPS)

• Malware Analysis

• DFIR Operations

Pros

• All modules can be done from the pwn box

• Common Active Directory Attacks are covered from the perspective of both an attacker and defender

• Exercises are challenging and force you to think outside the box

Cons

• Some parts of the course can get stale especially when diving into more complex topics which I believe should have been summarized.

• No videos, as this is more so a beginner oriented cert the inclusion of videos would be very helpful especially for those that are more visual learners.

Exam Experience

Upon entering the exam you are given 7 days to complete incident handling activities against the network mentioned in the letter of engagement. Within this 7 day period you are expected to devise a incident report similar to the one mentioned in the module Security Incident Reporting.

I had no issues using the VPN to connect to the exam environment, all tools are preinstalled on the system hosting the exam resources such as any SIEM/DFIR tooling that is needed.

I was able to juggle my 9 to 5 and take the exam during the afternoon, however; this probably isn't the most ideal situation since it does takeaway from exam time. Having a good background in incident response allowed me to do this but I definitely recommend at least having three full days where you can sit for this exam without any interruptions. With that being said it took me 5 out of the 7 days to complete the exam.

Tips and Tricks

• Ensure you have a good screenshotting tool (I recommend ShareX)

• Take notes as you go (I personally use Notion)

  • great example of sample reports can be found @ https://thedfirreport.com

• Write down all the SIEM queries you use (especially those in screenshots)

Probably the number one question I've seen while scrolling through the CDSA chat in the HackTheBox discord is "How do I know if I am ready to take the exam?", well like most exams I don't think there is a direct answer. Technically you are given two attempts to take this exam so you can use the first attempt as a trial attempt, however; if you want the best chance to pass this exam on the first try. Here is what I recommend, do the Splunk 2 room on TryHackMe. This room is an adaptation of the BOTS (Boss of The SOC) event hosted by Splunk which is a blue team capture the flag event centered around using various Splunk tooling to resolve security incidents. If you are able to do this room within a 7 day time window and devise an incident report. You are most likely ready to take the CDSA exam. If you get stuck on this room there are a ton of writeups out there that you can read to help you better understand the incident response workflow.

Closing Remarks

Given the current landscape of security certifications geared toward those looking to enter the realm of incident response here are the key certifications that come to mind.

• Security +

• CySA +

• Blue Team Level 1

• GIAC Certified Incident Handler

Out of these three technically the only one comparable to CDSA is BTL1, however; while looking through the BTL1 coursework it seems like it is not an all encompassing course as it does not go in-depth to certain topics such as Windows Attacks & Defense as well as there does not seem to be any coverage of malware analysis which I think are pivotal elements for someone looking to get into Security Operations.

GIAC Certified Incident Handler from SANS I'm sure is a great course although I haven't taken it. Given the price point and the fact that the exam itself is a 100+ question multiple choice exam it doesn't really interest me. If I were just starting out in cybersecurity I would stay away from this unless an employer/organization was sponsoring.

The other two certs being Security+ and CySA+ which are good for compliance/human resources but these do not teach any hands on technical skills an individual needs to become a SOC Analyst.

With that being said I think CDSA is the clear winner when it comes to an introductory blue team course it goes over a wide array of topics and gives an individual the skills they would need to perform the typical day to day of a SOC Analyst.

Direct link to the Course/Exam: https://academy.hackthebox.com/preview/certifications/htb-certified-defensive-security-analyst