What Is GCDA?

What GCDA Actually Is

GCDA stands for GIAC Certified Detection Analyst. It is a certification aimed at people who build, tune, and operate the analytics that turn raw telemetry into actionable security alerts. If your day-to-day work involves writing detection logic, wrangling logs in a SIEM, or deciding which data sources deserve collection, this is the credential that maps most directly to that job.

The acronym is shared by other, unrelated credentials in the industry, so it is worth being precise: everything on this page concerns the GIAC detection credential and nothing else. If you are comparing naming conventions, our short explainers on what GCDA stands for and the meaning of GCDA cover the terminology in more detail.

What distinguishes this certification from broader security credentials is its focus. Rather than surveying all of cybersecurity, it concentrates on detection engineering and SIEM analytics: how logs are collected and enriched, how alerts are built and tuned, and how different data sources (endpoint, network, application, and cloud) feed a detection program.

Who Runs the Credential

The certification is governed by GIAC Certifications (formerly Global Information Assurance Certification) and administered by GIAC, LLC. GIAC publishes the exam objectives, sets the passing standard, and issues the credential. The terms you agree to when you purchase an attempt are set out in the GIAC Candidate Agreement, which was last updated 2025-02-18.

GIAC is separate from SANS Institute, the training organization whose courses are commonly paired with GIAC exams. That distinction matters in practice: the exam is defined by GIAC's published objectives, while the SANS course is one (optional) way to prepare for them.

The Exam at a Glance

The arithmetic is worth internalizing early. Two hours for 75 questions works out to well under two minutes per question on average, and you need to clear 76%. Because the exam is open book with paper references, your preparation should include building an index you can search quickly, a skill we cover in our GCDA study guide.

For a closer look at how the threshold works, see our breakdown of the GCDA passing score. Note that the 2026-04-27 date identifies which exam versions the 76% standard applies to; it does not signal a broader rewrite of the exam outline.

The Nine Exam Objectives, Explained

GIAC publishes nine exam objective headings for GCDA. GIAC does not publish official percentage weights for them, so no domain should be treated as "worth" a particular share of the exam. The sections below describe what each heading signals about the knowledge you will need. For a deeper domain-by-domain treatment, read our complete guide to all 9 GCDA content areas.

Foundations: SIEM, Collection, and Alerting

Telemetry by Source

Cloud and Platform Coverage

How SEC555 Relates to the Exam

The recommended preparation course is SANS SEC555: Detection Engineering and SIEM Analytics. It is a natural companion because its subject matter overlaps heavily with the GCDA objectives. But two points deserve emphasis:

• The nine GIAC objectives are authoritative. SEC555 is organized into five teaching sections, which are supplemental preparation groupings and not a one-to-one map onto the exam's nine headings.
• Course materials may use different labels. The current SEC555 web page and its linked brochure title some sections differently (Sections 3 and 5 are examples), so do not assume a course section name will match an exam objective name.

Course hours, labs, and capstones are separate from the 2-hour proctored exam. Training is optional: nothing in GIAC's process forces you to take the course before sitting the exam. For more on what to expect from the course route versus self-study, see our overview of GCDA training.

Who Should Pursue It

The objectives point to a fairly clear audience: practitioners whose work centers on detection. Typical fits include:

• SOC analysts who want to move from triaging alerts to building the logic behind them
• Detection engineers who write, test, and tune analytics
• SIEM administrators and engineers responsible for log onboarding and enrichment
• Threat hunters who rely on well-structured telemetry
• Cloud security staff who need to understand Azure and AWS logging in a detection context

Employers in security operations, managed detection and response, and enterprise security teams are the most likely audiences for the credential. To see how this plays out in actual job listings, our page on GCDA jobs is the place to start. If you are weighing the investment, the ROI analysis and salary guide take a more detailed look; we avoid quoting specific earnings here because the exam source does not publish any.

Fees, Registration, and Attempt Access

GIAC publishes the following prices, all exclusive of tax:

A standalone attempt gives you access for 120 days from activation, and extensions are available under GIAC's certification attempt delivery policy (updated 2025-05-20). The practical implication: do not activate your attempt until your preparation is well advanced, because the clock starts at activation, not purchase. For a fuller treatment of costs and how they add up across retakes and renewal, see our GCDA certification cost breakdown, and for scheduling details see GCDA exam dates.

On eligibility, there are no required prerequisites to begin the certification process. If you want the details on what is and is not required, read GCDA requirements.

Open-Book Rules and Proctoring

The GCDA exam is open book, but within strict limits. Under GIAC's proctoring rules:

• Paper references are allowed.
• Electronic references and internet access are prohibited.
• Materials containing exam or practice-exam question-and-answer content are prohibited.

The exam is delivered through Pearson VUE (onsite) or ProctorU (remote), depending on the modality GIAC assigns. Read the GIAC Proctored Exam Reference Guide before test day so that your reference materials and testing environment comply.

The open-book format changes how you should prepare. Because you can bring paper notes but cannot search them electronically, your index must be organized by the nine objective areas and by specific concepts, so you can find an answer in seconds. A one-page distillation also helps; our GCDA cheat sheet shows the kind of high-density summary worth building (and remember that anything you bring must be your own notes, not exam or practice Q&A content).

Validity and Renewal

A GCDA certification is valid for four years. To renew, you have two options:

1. Earn 36 approved CPE credits during the active four-year cycle, or
2. Pass a renewal exam.

Either path also requires payment of the renewal fee ($499 USD, excluding tax). Because detection technology and cloud logging evolve quickly, the CPE route doubles as a structured reason to keep learning rather than letting your skills lag the credential.

Sequencing Your Preparation by Domain

Since the exam objectives build on one another, the order in which you study them matters more than the specific number of weeks. One sensible sequence, using the exact objective names:

For a full week-by-week approach, practice-question strategy, and notes on how to calibrate readiness, see our complete GCDA study guide. To pressure-test yourself against realistic questions as you progress, our GCDA practice tests are built around the same nine objective areas. And if you are wondering how demanding the exam is overall, our difficulty guide gives a candid assessment; likewise, our page on the GCDA pass rate explains why no candidate pass rate can be cited from GIAC's published materials.

Frequently Asked Questions