GCDA Training

What GCDA Training Actually Covers

GIAC Certified Detection Analyst is a practitioner credential built around one question: can you turn raw telemetry into reliable detections? Training for it is therefore different from preparing for a policy-heavy or definitions-heavy security exam. You are learning to collect logs, enrich them, normalize them, query them, and write alerting logic that a security operations team can trust.

If you are new to the credential itself, start with what GCDA certification is and then come back here to plan how to prepare. The short version: GIAC Certifications, administered by GIAC, LLC, publishes nine exam objectives that span SIEM fundamentals, log collection, analytics across applications, protocols, assets, networks, and endpoints, plus cloud logging and the Defender and Sentinel ecosystem.

The recommended training path is the SANS course SEC555: Detection Engineering and SIEM Analytics. SANS publishes a syllabus brochure for it, and the course is organized into five teaching sections. Those five sections are supplemental preparation groupings, not a one-to-one match for the exam. The nine GIAC objectives remain the authoritative statement of what can be tested.

Training Is Optional, Preparation Is Not

GIAC does not require any prerequisite credential, course attendance, or years of experience to begin the certification process. That is covered in more detail in our GCDA requirements guide. The practical consequence is that you can buy an exam attempt directly without ever taking a class.

Whether you should depends on your background. Consider which of these profiles fits you:

• SOC analyst with daily SIEM use: You may already write queries and tune alerts. Self-study against the nine objectives, with extra attention to areas your employer does not use, such as a cloud platform you have never touched.
• Systems or network administrator moving toward detection: You understand the data sources but may lack experience turning them into analytics. Structured training pays off most here.
• Newer security professional: You will likely benefit from the full course, because the exam assumes you can reason about log pipelines, enrichment, and alert logic end to end.

For a candid look at the difficulty side of this decision, see how hard the GCDA exam is. The short answer is that the exam rewards applied familiarity far more than memorization.

Mapping SEC555 to the Nine GIAC Objectives

The cleanest way to use any training course is to map its content onto the objectives you will be tested on. Below, the nine GIAC objectives are grouped by theme so you can see where hands-on work should concentrate. This grouping is a study aid of ours, not an official GIAC weighting. GIAC publishes no percentage weights for these objectives, so treat them as equally important until you have evidence otherwise.

For a domain-by-domain breakdown of what each objective can ask, read our complete guide to all nine GCDA content areas.

The Hands-On Skills You Need to Build

Detection engineering is a craft. Reading about it is not enough, so any training plan should be lab-heavy. The skills below recur across the nine objectives.

Because the exam is an applied one, build a small lab if you can: a SIEM you can feed with sample logs, a few log sources you control, and the habit of writing a query, checking the result, and refining it. The goal is to make query logic and field names feel familiar before exam day.

Cloud Logging and the Microsoft Stack

Two of the nine objectives are vendor-ecosystem overviews: Azure and AWS Logging Overview and Defender and Sentinel Overview. Candidates who live entirely in on-premises environments often underestimate these.

For cloud logging, focus on conceptual fluency rather than console memorization:

• What kinds of activity each cloud provider records, and at which layer (control plane versus workload)
• Which logs are on by default and which must be explicitly enabled
• How cloud logs reach a SIEM, and where gaps or delays can appear
• How identity and API activity feature in cloud detection

For Defender and Sentinel, aim to understand how Microsoft's detection products and its cloud-native SIEM relate to one another, what data flows between them, and how analytics and alerting are organized. Since these are overview-level objectives, breadth beats depth: you should be able to say what each component is for and how it connects to the rest of a detection pipeline.

Training for an Open-Book, Proctored Exam

The GCDA exam is a single web-based proctored exam with 75 questions and a 2-hour limit. It is delivered through GIAC's testing providers: Pearson VUE onsite or ProctorU remote, depending on the modality GIAC assigns. The exam is open book, but only with paper references. Electronic references and internet access are prohibited, and so are materials containing exam or practice Q&A. Always confirm details in the GIAC Proctored Exam Reference Guide and your own account.

That format shapes how you should train:

1. Build a paper reference deliberately. If you take SEC555, your course materials are the natural base. Add an index so you can find a topic in seconds, not minutes.
2. Train for lookup speed. With 75 questions in 120 minutes, you have under two minutes per question on average. A book you cannot navigate quickly is nearly useless.
3. Know what you do not need to look up. Core concepts should be reflex. Use the book for specifics, not for first-time learning.
4. Keep banned material out. Do not bring anything containing practice questions or answers. Review the reference guide so nothing in your materials violates the rules.

Our GCDA study guide walks through reference-building in more detail, and the GCDA cheat sheet is a useful model for what a condensed review page should contain. Note that the proctoring rules apply to what you bring into the exam, so build your index from your own notes and course material.

A Domain-Ordered Training Sequence

Generic scheduling advice is less useful than ordering your study by how the objectives depend on one another. The sequence below is a suggestion, and it fits a candidate who has several weeks of part-time study. Adjust the length to your own experience.

If your job already covers some of these areas, compress those weeks and spend the saved time on whichever objectives feel least familiar. The point is to avoid learning endpoint analytics before you understand how endpoint logs reach the SIEM.

Training Cost, Exam Fees, and Attempt Timing

Budget in two layers: training (optional) and the exam (required). Here are the GIAC figures from the published pricing, which exclude tax:

SANS SEC555 course pricing is set separately by SANS and is not included in the figures above, so check the SANS course page for current options. For the full picture, including how the pieces add up, see our GCDA certification cost breakdown.

On timing, a standalone attempt is accessible for 120 days from activation, and extensions are available under GIAC's certification attempt delivery policy. That window should shape how you schedule training: activate your attempt when you are close to ready, not on the day you begin studying. For scheduling specifics, read our guide to GCDA exam dates and scheduling.

On the score itself: the minimum passing score is 76%, applicable to exam versions released on or after 2026-04-27. That date identifies when the passing score applies, not a new outline edition. See the GCDA passing score guide for how to interpret it. Also note that GIAC publishes a passing score, not a candidate pass rate, which is why our pass rate article focuses on what can and cannot be known.

After Training: Practice, Renewal, and Career Use

Validate readiness before you sit

Finishing a course is not the same as being exam-ready. Check yourself against each of the nine objectives and ask whether you could explain it to a colleague without notes. Then rehearse under conditions that match the real exam: 75 questions, 2 hours, only your paper references. Our GCDA practice test platform is built for exactly that rehearsal, and the main practice site lets you target the objectives where you scored lowest.

Plan for renewal from day one

The certification is valid for 4 years. Renewal requires 36 approved CPE credits earned during the active cycle, or a passing renewal exam, plus the renewal fee. Because CPE credits accumulate over time, it is worth logging relevant activity early rather than scrambling in year four. The details are in GIAC's renewal how-to guide.

Where the skills get used

Detection engineering and SIEM analytics skills map to roles on security operations teams, detection engineering groups, threat hunting functions, and managed security providers. If you are weighing the credential's value, our articles on GCDA jobs, GCDA salary, and whether the certification is worth it cover the career side in depth. No earnings figures appear here, because the publicly available certification information does not establish any, and we do not guess.

Frequently Asked Questions