If you want a SOC analyst job and you're not sure where to put the next 200 hours of your study time, this is probably the answer. TryHackMe rebuilt the SOC Level 1 path in late 2025 and the new version is closer to what an actual Tier 1 SOC analyst does day-to-day than anything else at this price point.
This is the honest review from someone who's worked alongside SOC teams long enough to know which training maps to the job and which doesn't.
What the path actually covers
SOC Level 1 is structured around the workflow of a Tier 1 SOC analyst — the person who sits in front of a SIEM, triages alerts, and decides what's actually an incident versus noise.
The major modules:
- Cyber defense frameworks. MITRE ATT&CK, the Pyramid of Pain, threat intel basics. The conceptual scaffolding that everything else hangs on.
- Network analysis. Wireshark, tcpdump, Snort and Suricata IDS basics, network traffic forensics.
- Endpoint analysis. Event Viewer, Sysmon, log analysis on Windows and Linux directly on the host (not just through a SIEM). This module is one of the best on the platform — it forces you to investigate without falling back on a polished dashboard.
- SIEM fundamentals. Splunk and Elastic queries, dashboards, correlation rules, alert tuning. The Splunk content alone is worth the subscription cost if you're targeting SOC work.
- Digital forensics and incident response basics. Memory dumps, disk artifacts, the chain of evidence, how an actual IR engagement runs.
- Phishing analysis. Email header forensics, URL deobfuscation, attachment triage. Realistic — phishing is genuinely the largest single category of work in a real SOC.
- Threat intelligence. OSINT, IOC analysis, threat actor profiling, intel feeds.
- Investigation walkthroughs. Several capstone-style rooms that have you investigate a simulated incident end to end.
The 2025 revamp added more practical incident scenarios and cut some of the older theoretical content that didn't translate to job tasks.
Who this path is for
- People targeting SOC Tier 1 / Tier 2 jobs. This is the primary audience and the curriculum matches the work.
- IT support and sysadmins moving into security. The path assumes some IT foundation; you'll move faster than someone starting cold.
- Detection engineering aspirants. SOC L1 is the foundation; you'll layer on SOC L2 and detection engineering content afterward.
- Defenders preparing for SAL1 (the THM Security Analyst Level 1 certification).
Who it's not for
- People who haven't done Pre-Security or Cyber Security 101 first. SOC L1 assumes you know what TCP/IP, DNS, and a process is. If you don't, start there. Review here.
- Aspiring red teamers. SOC L1 is excellent for them eventually — defenders need to understand attackers and vice versa — but it's not the first stop.
- GRC-bound folks. SOC L1 is too technical for GRC roles. You'll find more value in NIST CSF and ISO 27001 study material.
How long it actually takes
THM lists SOC L1 at around 90 hours. Reality, depending on background:
- With solid IT foundations: 60-80 hours. About 10-13 weeks at 6 hours a week.
- Coming straight from Cyber Security 101: 100-130 hours. Plan on 4 months at 8 hours a week.
- Already working in IT/help desk: Can compress to 6-8 weeks if you're disciplined.
The Splunk module alone takes 15-25 hours to do properly and is worth every minute.
Compared to alternatives
vs. the IBM Cybersecurity Analyst Professional Certificate on Coursera: Coursera teaches you the concepts and the role expectations. THM teaches you the muscle memory. Coursera has the credential value; THM has the lab time. Best play is to do both — IBM for the structured introduction, THM for the hands-on. Full review: IBM Cybersecurity Analyst Review.
vs. paid Splunk training: Splunk's official Power User certification course is excellent but costs significantly more. THM's Splunk content covers about 70% of what you need for Splunk Power User, at a fraction of the price. If you want the cert, do THM first and then pay for the Splunk exam directly.
vs. Blue Team Labs Online (BTLO): BTLO is more challenge-based, less curriculum-based. Once you finish SOC L1, BTLO and CyberDefenders.org are good places to practice. They're complements, not replacements.
vs. just running a SIEM in a home lab: Running your own Elastic stack or Splunk Free instance teaches you a lot. It also takes a month of setup before you do any actual investigation. SOC L1 lets you skip the setup and get straight to the work. Eventually do both.
Pricing
You need the subscription for SOC L1 — there's not enough free content in this path to make standalone progress. Roughly $14 a month or cheaper annually. The path takes 2-4 months realistically, so budget $30-60 total subscription cost.
That's an absurd ROI for content of this quality. A single SANS course covering similar material is $8,000+.
The certification at the end (SAL1)
The Security Analyst Level 1 certification (SAL1) is THM's blue team cert. It's a hands-on practical exam — you investigate a simulated incident in a lab environment and submit findings.
Worth taking if:
- You're applying to SOC jobs and want a portfolio piece that proves practical skill.
- You're in the application phase and need something recent on the resume.
- You've finished SOC L1 and want a real-world test of what you learned.
Not worth taking if:
- You haven't done the path. The cert is built around the same skills, and you'll fail without preparation.
- You're targeting roles that hard-filter on Security+ or CySA+. THM certs don't substitute for vendor-recognized certs at strict gov shops.
For most non-government Tier 1 / Tier 2 SOC applications, SAL1 plus Security+ is a stronger combination than either alone.
Honest weaknesses
- No Sentinel content. Microsoft Sentinel is the SIEM at a huge percentage of enterprises and isn't meaningfully covered. If your target employer uses Sentinel, you'll need to supplement with Microsoft Learn (free) or SC-200 study material.
- Light on detection engineering. SOC L1 is analyst-focused. If you want to write detections rather than respond to them, you'll need to layer in Sigma rule writing and the broader detection engineering content separately.
- Some rooms still trade on guess-the-answer over genuine investigation. Newer modules are better; some legacy material lingers.
- The "you've completed SOC L1" feeling is sometimes overstated. You'll feel like you know SOC work. You'll learn how much you don't on your first real shift. That's not a flaw of the training — it's how all entry-level training works.
What to do after
- Move to SOC Level 2 if you want to stay in blue team and progress.
- Layer in detection engineering content from outside THM — Sigma HQ, Splunk detection blogs, Elastic detection rules repo on GitHub.
- Apply. This is the part everyone skips. SOC L1 plus a Security+ plus a real artifact (a writeup of an investigation, a custom detection rule) is enough to apply to MSSP and mid-market SOC openings.
- Pick up a red team path for context. SOC analysts who understand attackers are dramatically more effective than ones who don't. Jr Penetration Tester review here.
The verdict
SOC Level 1 in its 2026 form is the strongest single resource for someone targeting SOC analyst work. It's not the only thing you need — Security+ for keyword filters, a portfolio piece for the resume, the foundations for context — but for the actual job-relevant skill development, nothing in this price range comes close.
If you're committing to the blue team direction, this path plus the SAL1 cert is one of the highest-ROI moves you can make in 2026.