CDSA Study Guide & Cheat Sheet PackComplete HTB Certified Defensive Security Analyst Exam Prep - by Farouq Hassan (CDSA Certified)TITLE CDSA Complete Exam Prep — Study Guide + 8 Cheat Sheets | HackTheBox CDSAI passed the CDSA exam. Then I built the guide I wish existed before I sat it.PRODUCT DESCRIPTIONWhat's insidePDF 1 - CDSA Complete Study Guide (81 pages) Structured across all 15 HackTheBox Academy CDSA modules. Every section is written the way an analyst thinks during an actual investigation - not a copy-paste of theory, but a working reference you'll use during prep and keep open during lab sessions.Covers: Incident Handling Process (IR lifecycle, containment strategy, evidence acquisition order) Elastic SIEM - KQL, EQL sequences, field pivoting, investigation workflow Splunk SPL - core commands, AD attack detection queries (DCSync, DCShadow, Kerberoasting, Pass-the-Hash, AS-REPRoasting, beaconing) Windows Event IDs - every critical Security + Sysmon event ID with detection context Network Traffic Analysis - Wireshark filters, tcpdump, Zeek log anatomy, C2 beaconing detection IDS/IPS - Snort/Suricata rule syntax, PCRE, threshold tuning Malware Analysis - PE structure, suspicious imports, process injection chain, dynamic analysis tools JavaScript Deobfuscation - techniques and step-by-step deob workflow YARA & Sigma - full rule templates, modifiers, conversion commands Digital Forensics & Windows Forensics - NTFS artefacts, MAC(b) timestamps, Eric Zimmerman tools Volatility 3 - every plugin explained + full memory investigation workflow Active Directory Attacks & Detection - Kerberos attack matrix, LSASS dumping detection, BloodHound indicators Incident Reporting - executive summary + technical analysis structure, IoC tables, ATT&CK mapping Each module includes Exam Tip callouts - the specific things that show up heavily during the actual exam (based on my own sitting).PDF 2 — Cheat Sheet Pack (8 one-pagers, print-ready)One page per topic. Designed to be pinned next to your lab during prep. SPL Quick Reference - every core command + all AD attack SPL detections in one place Windows Event IDs - Security log + Sysmon, with significance column Volatility 3 Commands - full plugin list + step-by-step investigation workflow YARA Syntax - template, modifiers, PE module, running commands Sigma Rules - template, field modifiers, logsource combos, backend conversion Forensics Artefacts - execution, NTFS, browser/user artefacts, EZ tool commands Incident Report Template - exec summary + technical analysis writing guide with timeline format Network Analysis - Wireshark filters, tcpdump, Zeek logs, Snort/Suricata, C2 indicators Who this is for You're preparing for the HTB CDSA exam and want a structured reference, not just raw module notes You've done the Academy modules but need a consolidation pass before exam day You're an early-career SOC analyst building a working reference library You want to understand how AD attacks are detected at the log level (Event IDs, SPL, KQL) Who this is NOT for If you haven't touched the CDSA Academy modules yet, start there first - this is a supplement, not a replacement for the labs If you want a video course (I'm building that - follow to get notified) Why this is differentMost "study guides" in this space are either too shallow (just theory bullet points) or just recreate the module text. This pack was built after I passed the exam - so every Exam Tip callout reflects what actually matters during the assessment, not what looks important from the outside.The cheat sheets are formatted to be useful in a real investigation, not just exam day. I still reference the Event ID sheet and Volatility workflow during my own lab work.PRICINGEarly Bird: $37 (first 10 buyers - limited) Regular Price: $67FAQIs this a video course? No - this is a PDF study guide + printable cheat sheet pack. A full video course is in production. Buy this now and you'll get a discount code for the video course when it launches.Do I need to have started the CDSA path already? Yes. This guide assumes you've worked through (or are working through) the HackTheBox Academy CDSA modules. It's designed as a consolidation and reference tool, not a starting point.What format are the files? Two PDFs. The study guide is formatted for on-screen reading. The cheat sheets are A4/letter, formatted for printing and pinning next to your lab.Will this be updated? Yes - buyers get lifetime updates. If the exam path changes significantly, I'll update and re-send.Can I share it? Personal use only. Please don't redistribute - it's how I fund the video course.Are there refunds? Due to the digital nature of the product, no refunds are offered. If you have questions about whether this is the right fit, DM me on LinkedIn before buying - I'll give you an honest answer.