TryHackMe SOC Level 1

Jul 23, 2026

Today was pretty busy, but I started on the TryHackMe SOC Level 1 path today. I don’t have a subscription right now so I’m only doing the free rooms.

I did 3 rooms:

https://tryhackme.com/room/jrsecanalystintrouxo
https://tryhackme.com/room/socroleinblueteam
https://tryhackme.com/room/socl1alerttriage

The first two are very basic vocabulary and learning about different job titles/roles.

The SOC L1 Alert triage room is where things get interesting.

The room gives you a mock SIEM and walks you through events and alerts. It helps you answer some important questions like: What makes up an alert? How do you prioritize an alert? How do you triage an alert?

Finally it has you investigate 3 alerts to determine if they are False Positive or True Positive.

I successfully triaged each alert on the first try.

I would definitely recommend the room for someone wanting to get a feel for how to triage alerts and what SOC analysts do everyday.

Note: I am planning on adding some more notes and screenshots to this post later, so check back for updates.