Threat Hunting & DFIR Certification
- CCDL2 (formerly CCD)
Investigate nation-state attacks from detection to resolution. Hunt threats, analyze disk and memory evidence, and build detailed attack timelines through real-world investigations.
Key Features
Real-World Readiness
Investigate realistic, multi-stage incidents that mirror actual SOC environments and APT campaigns.
Battle-Tested Credential
Trusted by defenders at Microsoft, Kaspersky, PwC, and Accenture who use these skills to protect their organizations every day.
Industry Aligned
Mapped to leading cybersecurity workforce frameworks used worldwide. Vendor-neutral, hands-on certification with a 48-hour practical exam.
Comprehensive Coverage
Assesses threat hunting and disk, network, and memory forensics across enterprise environments.
Trusted by Defenders Across Leading Organizations
Who It's For
Experienced SOC/Security Analysts
Analysts with 1+ years of experience ready to go beyond alert triage into full incident investigation and response.
Threat Hunters
Professionals who want to proactively uncover threats that evade automated detection across enterprise environments.
DFIR Professionals
DFIR professionals building skills in disk forensics, memory forensics, and end-to-end investigation workflows.
Team Managers & SOC Leads
Organizations seeking a standardized credential to validate analysts who can independently handle sophisticated attacks.
What CCDL2 Validates
Demonstrated through a 48-hour hands-on, practical exam:
Hunt Threats Proactively
Use Elastic SIEM to detect, investigate, and hunt for threats across enterprise environments.
Investigate Disk Evidence
Perform disk forensics to trace attacker activities, recover artifacts, and reconstruct attack timelines.
Analyze Volatile Memory
Conduct memory forensics to uncover malicious processes, injected code, and persistence mechanisms.
Collect & Preserve Evidence
Acquire, handle, and analyze digital evidence following forensic best practices and chain-of-custody procedures.
Build Incident Timelines
Investigate real-world intrusions end-to-end: from initial compromise through lateral movement to data exfiltration.
Think Like an Analyst
Show sound investigative reasoning across multi-stage investigations.
Exam Domains
The CCDL2 exam assesses your ability across five domains.
1. Network Forensics
Analyze PCAPs, NetFlow, and network logs to trace reconnaissance, lateral movement, command and control, and exfiltration.
2. Forensics Evidence Collection
Acquire memory and disk evidence, create triage images, and mount forensic images for investigation.
3. Disk Forensics
Investigate Windows artifacts, file activity, USB devices, installed applications, and program execution.
4. Memory Forensics
Use Volatility to examine processes, network connections, persistence, and file artifacts in memory.
5. Threat Hunting
Hunt across endpoints and networks with Elastic SIEM, KQL, and full-scope investigation scenarios.
How to prepare. You can prepare for CCDL2 in any way you choose: work experience, self-study, or third-party training. CyberDefenders offers an optional CCDL2 training course, sold separately (view course syllabus). The course is not required to earn the credential.
Which industry frameworks does CCDL2 align to?
Employers use these frameworks to define and hire for security roles. See which roles CCDL2 aligns to in each one.
Get Certified
Take the exam directly, or pair it with optional training.
Need employer funding?
Use our customizable employer funding letter to request funding or reimbursement for your CCDL2 certification.
Download Employer Funding Letter
FAQ
Common questions about CCDL2.
Need More Information? Visit our Help Center for detailed articles about the CCDL2 certification, exam preparation, and more.
Stop Escalating. Start Investigating.
Prove you can investigate sophisticated attacks across enterprise environments.