SOC Analyst Certification - CCDL1
The industry's most practical blue team certification for aspiring SOC Analysts. Prove you can detect, investigate, and respond to cyber attacks through real-world investigations.
Key Features
Real-World Readiness
Assessed through realistic, scenario-based incident investigations.
Job-Ready Skills
Developed with Mandiant & PwC SOC Managers to validate the skills they hire for.
Industry Aligned
Mapped to leading cybersecurity workforce frameworks used worldwide.
Current & Relevant
Exam objectives reviewed regularly to reflect today's SOC, including cloud and SIEM.
Trusted by Defenders Across Leading Organizations
Who is it for?
CCDL1 validates the practical skills to perform as a Tier 1 SOC analyst. It's designed for:
Students
In CS, IT, or cybersecurity preparing to land their first SOC role.
IT Professionals
Developers, sysadmins, help desk, and more breaking into defensive security.
Associate SOC Analysts
Building core investigation, detection, and response skills.
Prerequisites
Recommended experience:
- Windows and Linux fundamentals
- Basic command-line usage
- General networking knowledge
What CCDL1 Validates
Demonstrated through a hands-on, practical exam:
Operate in a SOC
Perform end-to-end SOC workflows including detection, triage, escalation, and reporting
Perform SIEM Investigations
Demonstrate use of SIEM tools like Microsoft Sentinel to detect, investigate, and visualize threats.
Investigate Security Alerts
Correlate multi-source logs to detect, validate, and prioritize real cyber incidents.
Conduct Digital Forensics
Acquire, preserve, and analyze digital evidence to trace attacker activities.
Respond to Incidents
Contain, eradicate, and recover from security breaches through structured IR processes.
Think Like an Analyst
Show sound investigative reasoning, not just correct answers.
Exam Domains
The CCDL1 exam assesses your ability across six domains.
1. Phishing Analysis
Identify and analyze phishing, spoofing, and business email compromise (BEC) attacks.
2. Network & Endpoint Security
Detect intrusions in network traffic, and identify malware, exploitation, and lateral movement on endpoints and Active Directory.
3. SIEM & Log Analysis
Correlate logs in Splunk, write SPL searches, and build alerts and dashboards to detect and hunt threats.
4. Digital Forensics
Acquire evidence and analyze Windows, registry, file system, and memory artifacts to reconstruct an incident timeline.
5. Cloud Threat Detection
Analyze Azure logs with KQL to investigate suspicious sign-ins, application abuse, and exposed storage.
6. Incident Handling
Take an alert from triage through to a complete, documented handover.
How to prepare. You can prepare for CCDL1 in any way you choose: work experience, self-study, or third-party training. CyberDefenders offers an optional CCDL1 training course, sold separately (view course syllabus). The course is not required to earn the credential.
Which industry frameworks does CCDL1 align to?
Employers use these frameworks to define and hire for security roles. See which roles CCDL1 aligns to in each one.
Get Certified
Take the exam directly, or pair it with optional training.
Need employer funding?
Use our customizable employer funding letter to request funding or reimbursement for your CCDL1 certification.
Download Employer Funding Letter
FAQ
Common questions about CCDL1.
Need More Information? Visit our Help Center for detailed articles about the CCDL1 certification, exam preparation, and more.
Prove the SOC skills employers hire for
Earn a hands-on credential that shows you can do the job.