GIAC Security Operations Certified Credential (GSOC)

Cyber Defense Certification Overview

Prove your ability to monitor, triage, and defend a security operations center using SIEM, endpoint, and threat intelligence tools, from alert to resolution.

Explore SEC450 Course Register for the Exam

Jump to:

Overview
Exam Objectives
Course Alignment
Who It's For
FAQs

What Is the GSOC Certification?

GSOC proves you can run the practical side of a security operations center: using incident management systems, threat intelligence platforms, and SIEMs to monitor and respond, analyzing and defending against the attacks enterprises see most often, and designing automation that makes the SOC more efficient.

By the numbers

2 hrs

Exam duration

Questions

67%

Min. passing score

What GSOC Covers

The objectives group into 5 practical domains that mirror how a SOC actually runs, from daily monitoring to longer-term process improvement.

Blue Team Operations & SOC Systems

Covers the mission and role of a SOC, plus the incident management systems, threat intel platforms, and SIEMs that run it.

Network & Protocol Analysis

Covers network traffic review, DNS defense, HTTP(S) analysis, and common protocol attacks against SMTP, SMB, DHCP, ICMP, FTP, and SSH.

Event Interpretation & Triage

Covers reading Windows and Linux event logs, extracting evidence from files, and prioritizing incidents with organizational context in mind.

Endpoint Defense & Detection Tuning

Covers common endpoint attacks and endpoint logging, plus how to design, test, and refine detection analytics.

Operational Improvement

Covers automating repetitive SOC tasks, orchestrating response, and training the team to run more efficiently.

Prepare With This Course

SEC450: AI-Enabled Security Operations: Hands-on Investigation, Detection, and Automation

Course Details

How SEC450 Prepares You for GSOC

SEC450 is built around the exam objectives that make up the GSOC certification:

Section 1, Building the AI-Enabled SOC: Mission, Intelligence, Tools, and Workflow builds skills tested under Blue Team Defense Concepts and SOC Management Systems.
Section 2, Network Evidence and Agentic Enrichment: Protocols, OPSEC, and Tool Use builds skills tested under Network Traffic Analysis, HTTP(S) Analysis and Attacks, and Protocol Attacks and Analysis.
Section 3, From Telemetry to Investigation: Triage, Structured Analysis, and Agentic Automation builds skills tested under Interpreting Events and Intrusion Triage and Analysis.
Section 4, From Phishing to Detection: Email, Malware Analysis, YARA-X, and Sigma builds skills tested under Endpoint Defense and Analytic Design and Tuning.
Section 5, Operating the AI-Enabled SOC: Risk, Judgment, and Sustainable Performance builds skills tested under Operational Improvement.

Across all 5 sections, 19 hands-on labs and a capstone MoneyMatrix Incident exercise give you the chance to apply each skill in a live simulated SOC environment before you sit the exam.

Read the full GSOC certification overview

SEC450 Course Author

John Hubbard

Consultant at Security Operations Center (SOC)

John is a Senior SANS Instructor and SOC consultant, author of SEC450 and LDR551. With deep SOC leadership experience, GIAC certifications, and hands-on labs, he equips cyber defenders with the skills to hunt, detect, and lead resilient operations.

Who Should Pursue GSOC

SOC Analysts and Intrusion Detection Analysts

Incident Handlers and Investigators

strengthening triage and evidence skills

Detection Engineers and Security Engineers

supporting SIEM, EDR/XDR, and SOC tooling

Security Architects and Technical Security Managers

Threat Intelligence Analysts

connecting CTI to SOC prioritization

SOC Leads and Managers, and Anyone starting a Blue Team Career

Frequently Asked Questions

GSOC proves you can run the practical side of a SOC, using incident management systems, threat intelligence platforms, and SIEMs to monitor and respond, analyzing and defending against the attacks enterprises see most often, and designing automation that makes the SOC more efficient.

The exam is a single proctored attempt: 2 hours, 75 questions, with a minimum passing score of 67%. GIAC periodically reviews and updates certification specifications, so confirm the exact format for your attempt in the Certification Information section of your GIAC account before test day.

GIAC certifications are renewed on a recurring cycle through continuing education credits and a maintenance fee. For the current renewal requirements, see GIAC’s renewal page.

GSOC fits SOC analysts, incident investigators, security engineers and architects, technical security managers, and SOC managers who want a stronger technical grounding. It is also a starting point for anyone moving into a blue team role.

SEC450: AI-Enabled Security Operations is built around the GSOC objectives, with 19 hands-on labs and a capstone incident investigation covering SOC tools, network and endpoint evidence, detection engineering with YARA-X and Sigma, and the AI-enabled workflows now part of SOC work.

Ready to earn your GSOC certification?

Add the GSOC exam attempt when you register for SEC450.

Already trained? Register for the exam directly through GIAC here.

SEC536: Adversarial AI - Penetration Testing AI Systems