Hello, you are using an old browser that's unsafe and no longer supported. Please consider updating your browser to a newer version, or downloading a modern browser.
A reference guide to EC-Council’s security operations center analyst certification as it stands in October 2026: the CSA v2 program, exam 312-39, the eight blueprint domains and their weights, the eight course modules and their labs, eligibility, cost, renewal, the jobs it is hired for, and how it compares to CND, CySA+ and Security+.
CSA is EC-Council’s certification for the analysts who work a security operations center’s alert queue. EC-Council writes it for current and aspiring Tier I and Tier II SOC analysts.
The current program is CSA v2, tested by exam 312-39 against EC-Council’s CSA v2 exam blueprint. Half the exam sits in two domains, Incident Detection and Triage and Incident Response, at 25% each. The rest covers SOC operations, threats and IoCs, log management, threat intelligence and hunting, forensics and malware analysis, and running a SOC in Azure, AWS and Google Cloud. EC-Council lists the first version, CSA v1, as retired with an expiry date of July 1, 2026.
One point of confusion to clear up: this CSA is issued by EC-Council, the body behind CEH and CND. It has nothing to do with the Cloud Security Alliance, which also goes by CSA and issues the CCSK. EC-Council says CSA maps to the NICE framework’s Protect and Defend category for Cyber Defense Analysis. It is not on EC-Council’s own lists of ANAB-accredited or DoD 8140 credentials, which matters if your job requires either.
Domains 1 and 2, 13% of the exam: how a SOC is run and measured, and the attacks, TTPs and IoCs it watches for.
Log Management, 15%: host, firewall, router, web server, database and email logs, then centralized logging.
Incident Detection and Triage plus Proactive Threat Detection, 37%: SIEM use cases, alert triage, threat intelligence and hunting.
Incident Response plus Forensics and Malware Analysis, 30%: the IR process, playbooks, EDR and XDR, then investigation.
SOC for Cloud Environments, 5%: SOC architecture and native tools in Azure, AWS and Google Cloud.
Four things that set CSA apart from the other analyst certifications a SOC manager might ask you to earn, including one limitation you should know about up front.
Plenty of security certifications mention a SIEM somewhere. CSA is organized around one. The blueprint follows an analyst’s shift: know the threat, collect and normalize the logs, detect and triage in the SIEM, hunt for what the rules missed, then hand off and respond. Incident Detection and Triage and Incident Response are 25% of the exam each, more than any other domain.
The official labs use Splunk, the ELK Stack, OSSIM, Wazuh, Velociraptor, YARA, Sophos Central XDR and Microsoft Sentinel. You write Splunk use cases and build dashboards during the course instead of reading about them.
Without official training, CSA asks for one year of network admin or security experience. CND and CEH ask for two, which makes CSA the easier of the three to qualify for on experience alone.
EC-Council’s DoD 8140 page maps six of its credentials to DCWF work roles: CEH, CEH Practical, CCISO, CND, CHFI and ECIH. CSA isn’t one of them, and it isn’t on EC-Council’s list of ANAB-accredited (ISO/IEC 17024) programs either.
What EC-Council does claim is a full mapping to the NICE framework’s Protect and Defend category for Cyber Defense Analysis. That describes the job well, but it won’t satisfy a DoD 8140 requirement. If your role needs one, check the DoD 8140 Approved Qualifications Matrix at the DoD Cyber Exchange and look at CySA+, CND or ECIH.
The certification, the exam and how to keep it current, as EC-Council lists them in October 2026.
EC-Council points CSA holders toward CND, ECIH, CHFI and CTIA. Which one comes next depends on the part of SOC work you want to go deeper on. These are three common follow-ons.
EC-Council’s Certified Incident Handler, exam 212-89, 100 questions over 3 hours. CSA teaches the SOC side of the handoff. ECIH is where you learn to run the whole response, from first alert to after-action review. Read the ECIH guide.
EC-Council’s Computer Hacking Forensic Investigator. Forensics and malware analysis is only 5% of the CSA exam. CHFI is for the analyst who found that part of the job the most interesting and wants it to be the whole job.
EC-Council’s Certified Network Defender, exam 312-38, 100 questions over 4 hours. A good next step if SOC work keeps pulling you into firewall, endpoint and cloud hardening. Unlike CSA, it is mapped by EC-Council to three DCWF work roles. Read the CND guide.
CSA sits one step above the fundamentals. It assumes you already know networking and basic security, teaches you to work a SOC, then opens onto incident response, forensics, offensive work and, later, leadership.
Build the baseline
Work the SOC
Two questions to answer before you commit: can you take the exam, and should you take CSA specifically. Here’s a straight answer to both.
You can apply to sit the exam without training.
Submit an exam eligibility application to EC-Council with proof of at least one year of work experience in network administration or security, name a supervisor who can verify it, and pay the non-refundable $100 application fee. Once EC-Council approves it, you buy the $450 voucher and schedule exam 312-39 through the EC-Council exam portal.
Official training or courseware waives the requirement.
Complete official EC-Council training (Training Camp’s CSA boot camp uses EC-Council’s authorized courseware and includes your voucher), or buy the official CSA v2 courseware from EC-Council or an authorized center. Either route makes you eligible to sit 312-39 without the experience check.
CSA is hired for security operations work, mostly in the first years of a security career. These six roles come from EC-Council’s own list of jobs the program trains for. There are no DCWF codes here because CSA isn’t on EC-Council’s DoD 8140 list.
Watches the SIEM queue, triages alerts, opens tickets and escalates what looks real. Incident Detection and Triage, a quarter of the exam, is this job written up as a blueprint domain.
Takes the escalations, works through the logs and endpoint data, and decides whether an alert is an incident. The Incident Response domain, also 25%, covers the containment, eradication and recovery work that follows.
Looks for attacker activity the detection rules missed. The Proactive Threat Detection domain covers threat intelligence, hunting frameworks, and hunting with PowerShell, YARA and tools like Velociraptor.
Contains and cleans up confirmed incidents and works with the SOC through playbooks, EDR, XDR and SOAR. EC-Council’s July 2025 program update names it among the roles CSA now trains for. ECIH is the deeper credential for this seat.
Reviews network traffic and device logs for signs of attack. EC-Council lists it among the roles CSA is built for, and the firewall, router and IDS/IPS log work in the Log Management domain is where the two overlap.
Runs the firewalls, servers and endpoints, and often the log pipeline into the SIEM as well. EC-Council names administrators in the CSA audience, and the course suits the admin who has been handed monitoring duty on top of the day job.
The three certifications candidates most often weigh against CSA: EC-Council’s network defense credential, CompTIA’s analyst exam, and the fundamentals exam most people hold first.
| CSA | CND | CompTIA CySA+ | CompTIA Security+ | |
|---|---|---|---|---|
| Issuer | EC-Council | EC-Council | CompTIA | CompTIA |
| Current Version | CSA v2, exam 312-39 | CND v3, exam 312-38 | CS0-004 | SY0-701 (SY0-801 launches November 17, 2026) |
| Exam Format | 100 multiple-choice over 3 hours | 100 multiple-choice over 4 hours | Up to 85 questions, multiple-choice and performance-based, 165 minutes | Up to 90 questions, multiple-choice and performance-based, 90 minutes |
| Passing Score | 70% | 60% to 85%, set per exam form | 750 on a 100 to 900 scale | 750 on a 100 to 900 scale |
| Focus | The SOC workflow: logs, SIEM detection and triage, threat hunting, incident response | Defending networks and endpoints, then detecting, responding and predicting | SOC analyst work: detection, vulnerability management, response, reporting | Broad security fundamentals across five domains |
| Prerequisites | Official training or courseware, or 1 yr network admin/security experience + $100 application | Official training, or 2 yrs infosec experience + $100 application | None required, about 4 yrs recommended | None required |
| Renewal | 120 ECE credits over 3 years + $80 annual fee | 120 ECE credits over 3 years + $80 annual fee | 60 CEUs over 3 years | 50 CEUs over 3 years |
| DoD 8140 | Not on EC-Council’s DoD 8140 list | Listed by EC-Council for DCWF 511, 521, 531, confirm on the current matrix | Approved for 10 DCWF work roles | Approved for multiple DCWF work roles |
| Good Fit For | Tier I and Tier II SOC analysts, admins moving onto SIEM duty | Network admins and engineers taking on defense | Full-time SOC analysts on a CompTIA path or in DoD roles | First security credential, career changers |
CND, CySA+ and Security+ facts are taken from the Training Camp guides for CND, CySA+ and Security+. CSA and CySA+ cover similar ground, and for many candidates the deciding factor is whether the job needs DoD 8140.
Certification Matchups: the published facts, strengths and weak spots of 33 certifications, side by side.
Our official EC-Council CSA boot camp covers the CSA v2 curriculum in three days, live online or in person, using EC-Council’s authorized courseware, with iLab hands-on labs, exam review sessions, your 312-39 exam voucher and a free retake included. You can sit the exam on site as class ends.
Day-to-day SOC work, reading logs, incident response and the certifications that sit next to CSA.
The job CSA is written for, hour by hour: the alert queue, the investigations that turn out to be nothing, the occasional real intrusion, and whether the career suits you. Worth reading before you pay for any SOC certification.
Log Management is 15% of the CSA exam and the base for everything after it. This piece covers the practical side of reading security logs that most certification prep skips.
Makes the case that CySA+ is the right next step for most people heading into security operations after Security+. A useful benchmark when you are weighing CySA+ against CSA.
What the ECIH 212-89 exam tests and how to study for it. If the Incident Response domain is the part of CSA you like most, ECIH is the credential that goes deeper.
The March 2026 Stryker wiper attack, and why malware built to destroy data rather than ransom it changes the incident response playbook. Good context for the response and malware analysis domains.
What a backdoor is, the different types, and why most of them go unnoticed. Background for the IoC and attack methodology material in the second CSA domain.
Where entry-level security jobs actually exist and which certifications to start with. Read it if you are still deciding whether a SOC seat is the right first job.
The CSA v2 exam blueprint organizes exam 312-39 into eight domains. The badge shows each domain’s share of the exam, and the color shows which stage of the SOC workflow it belongs to. Click any domain for what it covers.
The principles of security management and where security operations fit inside it. What a SOC is and does, the SOC workflow and the people, process and technology behind it, the different SOC models and their tradeoffs, SOC maturity models and how SOCs have evolved, and the KPIs, challenges and practices that keep one running.
Cyber threats and their impact, then the tactics, techniques and procedures behind network, host, application, social engineering, email and insider attacks. You need to recognize the indicators of compromise each one leaves and know the attack methodologies and frameworks. The course covers the MITRE D3FEND framework and the Diamond Model of Intrusion Analysis here.
Why log management matters and the approaches to it. Local logging on Windows, Linux and Mac hosts, on firewalls and routers, and on web servers, databases and email systems, then designing and implementing centralized logging. The course adds collection, transmission, storage, normalization, parsing and correlation.
Tied for the heaviest domain. SIEM architecture and why it matters, the types of SIEM solutions and their tradeoffs, deploying a SIEM, managing use cases and detecting incidents with them. Then using AI to generate SIEM rules, handling alert triage and analysis, managing dashboards and writing SOC reports.
Threat intelligence fundamentals, types and strategies, sources and threat intelligence platforms (TIPs), and what a threat intelligence-driven SOC gains from them, including intelligence use cases that improve incident response. The second half is threat hunting: why it matters, the frameworks behind it, and hunting with PowerShell, YARA and dedicated hunting tools.
The other 25% domain. The incident response process and its phases, then responding to network, application, email, insider and malware incidents. It closes with the role SOC playbooks play in a response and how EDR and XDR tools strengthen it.
The forensic investigation process applied to network, application, email and insider incidents, then malware analysis with both static and dynamic techniques. It carries little exam weight, but it is the domain that points toward a forensics or incident response career.
An introduction to running a SOC in the cloud. Azure SOC architecture with Microsoft Sentinel, AWS SOC architecture with AWS Security Hub, and Google Cloud SOC architecture with Security Command Center and Chronicle, plus the security tools each platform provides.
The official course runs as eight modules that follow the blueprint domains in order. Each row lists the hands-on labs EC-Council publishes for that module, and the badge shows the workflow stage.
No hands-on lab is listed for this module. It covers SOC capabilities and operations, the SOC workflow and components, SOC models, maturity models and generations, KPIs and metrics, and the challenges SOCs face.
Labs: run SQL injection, XSS, network scanning, DoS and brute-force attacks to see their TTPs and IoCs, then detect and analyze those IoCs in Wireshark. Topics include the APT lifecycle, ransomware, CSRF, insider attacks, MITRE D3FEND and the Diamond Model.
Labs: configure, monitor and analyze logs, then collect logs from different devices into one place with Splunk. Topics run from Windows, Linux and Mac logs through firewall, iptables, router, IIS, Apache and database logs to normalization, correlation and alerting.
Labs: build Splunk use cases for brute force, ransomware, SQL injection, XSS, scanning, HTTP floods, audit log tampering and malicious PowerShell. Refine triage with SIGMA rules, build dashboards in Splunk and ELK, write ELK use cases for Mimikatz credential dumping, and correlate brute-force patterns in ManageEngine Log360.
Labs: feed IoCs into the ELK Stack, pull OTX threat data into OSSIM, detect incidents on Windows Server with YARA, and hunt with PowerShell scripts, Hunt Manager in Velociraptor, Log360 UEBA and Sophos Central.
Labs: open incident tickets, contain and recover from data loss, eradicate SQL injection and XSS incidents, write incident reports in OSSIM, automate detection and response with Wazuh, and detect threats in Sophos Central XDR and connect it to Splunk. Topics include SOC playbooks, EDR, XDR and SOAR.
Labs: investigate a SQL injection incident and a compromised system with Velociraptor, check RAM for suspicious activity with Redline, run static analysis in PeStudio, examine a file in VirusTotal, and do dynamic analysis on Windows with Process Hacker.
Lab: implement Microsoft Sentinel in Azure. Topics cover Azure and AWS SOC architecture, AWS Security Hub, centralized logging with OpenSearch, and the Google Cloud SOC with Security Command Center and Chronicle.
Domains, weights and modules reflect EC-Council’s CSA v2 exam blueprint for exam 312-39 and the CSA v2 course outline, the version EC-Council administers as of October 2026. EC-Council lists CSA v1 as retired, with an expiry date of July 1, 2026. No v3 has been announced that we are aware of. Confirm on cert.eccouncil.org before you test.
The questions candidates ask most often when researching the EC-Council Certified SOC Analyst certification.
CSA is EC-Council’s certification for security operations center analysts, written for current and aspiring Tier I and Tier II staff. The current program is CSA v2, tested by exam 312-39 against an eight-domain blueprint that runs from SOC operations and log management through SIEM detection and triage, threat hunting, incident response, forensics and cloud SOC work. Incident Detection and Triage and Incident Response carry 25% of the exam each, so half the test is about working alerts and handling what they turn up.
EC-Council gives three routes to the exam. Complete official EC-Council training, or buy the official CSA courseware from EC-Council or an authorized center, and you’re eligible to sit 312-39. Without either, you apply with proof of at least one year of work experience in network administration or security and pay a non-refundable $100 eligibility application fee. EC-Council also expects candidates to understand networking concepts, the TCP/IP protocol suite and security technologies such as firewalls and IDS/IPS.
Exam 312-39 is 100 multiple-choice questions in 3 hours, and EC-Council lists the passing score as 70%. It’s delivered through the EC-Council exam portal (ECC Exam Center), and EC-Council sells a remotely proctored voucher, so you can test from home. There are no performance-based questions, which makes the lab work in training the place where the practical skills get built.
The CSA v2 blueprint has eight domains: Security Operations and Management 5%, Understanding Cyber Threats, IoCs, and Attack Methodology 8%, Log Management 15%, Incident Detection and Triage 25%, Proactive Threat Detection 12%, Incident Response 25%, Forensics Investigation and Malware Analysis 5%, and SOC for Cloud Environments 5%. Add log management to the two 25% domains and 65% of the exam is about collecting logs, detecting incidents and responding to them.
EC-Council’s store lists the remotely proctored CSA v2 exam voucher at $450 as of October 2026, valid for one year from its release date. Candidates who take the experience route also pay the non-refundable $100 eligibility application fee. The CSA v2 eCourseware on its own, which is another way to become eligible, lists at $250. Training Camp’s boot camp includes the $450 voucher and a free retake, so boot camp students don’t buy the voucher separately.
CSA is valid for three years and renews through EC-Council’s continuing education (ECE) program, the same one CEH and CND use. You need 120 ECE credits in each three-year cycle and an $80 annual continuing education fee, which EC-Council totals at $240 over the three years. Credits come from activities such as conferences, webinars, research papers, related reading and passing a newer version of the exam.
Both come from EC-Council and both are blue-team credentials, but they fit different desks. CND is for the people who build and harden the network: perimeter, endpoint, cloud and wireless defense, tested by exam 312-38, 100 questions over 4 hours, with two years of experience required if you skip training. CSA is for the analyst watching the SIEM: log management, alert triage, threat hunting and incident response, tested by exam 312-39, 100 questions over 3 hours, with one year required. CND is on EC-Council’s DoD 8140 list and CSA isn’t. If you harden systems, take CND. If you work the alert queue, CSA matches the job more closely.
No. EC-Council’s DoD 8140 page maps six of its credentials to DCWF work roles (CEH, CEH Practical, CCISO, CND, CHFI and ECIH), and CSA isn’t one of them. It also isn’t on EC-Council’s list of ANAB-accredited (ISO/IEC 17024) programs. EC-Council does map CSA to the NICE framework’s Protect and Defend category for Cyber Defense Analysis. If your position requires a DoD 8140 qualification, look at CySA+, CND or ECIH and confirm your work role on the current DoD 8140 Approved Qualifications Matrix at cyber.mil.
EC-Council lists SOC analyst at L1, L2 and L3, cybersecurity analyst, network security specialist, network defense analyst, network and security administrator and network security operator. Its July 2025 program update says CSA now trains for threat hunter, incident responder and forensics analyst roles as well. In practice CSA is aimed at the first years in a SOC: the Tier I seat that triages alerts and the Tier II seat that investigates what gets escalated.
They aim at the same analyst job from different directions. CySA+ (CS0-004) is up to 85 questions in 165 minutes, mixes multiple-choice with performance-based questions, needs 750 on a 100 to 900 scale to pass, and is approved under DoD 8140 for ten DCWF work roles. CSA is 100 multiple-choice questions in 3 hours with a 70% pass mark, and its official course is built around named tools such as Splunk, the ELK Stack, Wazuh and Microsoft Sentinel. Pick CySA+ if you need DoD 8140 or want a CompTIA path. Pick CSA if you want tool-specific SOC lab time attached to the certification.
No. Two unrelated organizations use the same three letters. The EC-Council Certified SOC Analyst (CSA) is a security operations certification tested by exam 312-39. The Cloud Security Alliance, also abbreviated CSA, is the nonprofit that publishes cloud security guidance and issues the CCSK (Certificate of Cloud Security Knowledge). When a job post or course listing says CSA, check whether it means SOC work or cloud security before you buy anything.
EC-Council builds the official course as a three-day program, and Training Camp’s boot camp follows that schedule, with the option to sit the exam on site when class ends. Three days works if you already know TCP/IP, firewalls and IDS/IPS and have spent some time in a SIEM. If Windows event logs and firewall logs are new to you, put in time on networking and log reading first, because the course assumes that background and moves quickly into Splunk and ELK use cases.
For Tier I and Tier II SOC analysts, and for administrators being moved onto SIEM duty, it’s a sensible pick. Half the exam is detection, triage and response, the experience bar is one year instead of the two CND and CEH ask for, and the official labs put you in Splunk, the ELK Stack, Wazuh, Velociraptor and Microsoft Sentinel. It’s a weaker fit if your employer needs DoD 8140 or ANAB accreditation, because CSA has neither on EC-Council’s own lists. In that case CySA+, CND or ECIH will do more for you on paper.
Tell us where you are, from weighing CSA against CySA+ or CND to working out funding or planning training for a SOC team, and we’ll help you map out the right path.