TryHackMe SOC Level 1 Path 2026: Cost, Time & All 14 Modules

Is TryHackMe SOC Level 1 Free? What It Costs

No, SOC Level 1 is not free. The full path needs TryHackMe Premium. Free accounts get only limited access to learning paths and free rooms, so you can sample a few introductory rooms, but most of the 65 labs are locked.

• Premium monthly: about $17-18 a month, depending on region (TryHackMe is currently testing higher US prices).
• Premium annual: about $126-134 a year, roughly $10.50-11.20 a month.
• Students: an extra 20% off the annual plan after verification.
• MAX is not required: Premium already includes full access to beginner paths like SOC Level 1, plus the certificate of completion.

At 5-10 hours a week you will spend two to three months on the path, so the annual plan only wins if you keep studying afterwards. Our TryHackMe pricing guide runs the numbers for both plans.

What's in the SOC Level 1 Path: All 14 Modules

The rebuilt path moves from how a SOC works, to the tools, to each type of telemetry, and finishes with investigations that pull everything together.

1. Blue Team Introduction What a SOC does and where the junior analyst fits in. Rooms include Junior Security Analyst Intro, SOC Role in Blue Team, Humans as Attack Vectors and Systems as Attack Vectors.
2. SOC Team Internals Alert triage workflow, reporting, workbooks and the metrics a SOC is judged on: SOC L1 Alert Triage, SOC L1 Alert Reporting, SOC Workbooks and Lookups, SOC Metrics and Objectives, plus a SOC Simulator introduction to phishing.
3. Core SOC Solutions EDR, SIEM, Splunk basics, Elastic Stack basics and SOAR.
4. Cyber Defence Frameworks Pyramid of Pain, Cyber Kill Chain, Unified Kill Chain and MITRE, then the Summit and Eviction exercises.
5. Phishing Analysis Headers, senders, links and attachments of suspicious emails.
6. Network Traffic Analysis Three Wireshark rooms plus NetworkMiner.
7. Network Security Monitoring Intrusion detection with tools such as Snort.
8. Web Security Monitoring Spotting web attacks in server and proxy logs.
9. Windows Security Monitoring Which Windows events matter and how to read them.
10. Linux Security Monitoring The same for Linux hosts.
11. Malware Concepts for SOC Malware behaviour at the level an analyst needs for triage, not reverse engineering.
12. Threat Analysis Tools Threat intelligence lookups to enrich an alert.
13. SIEM Triage for SOC Triaging alerts end to end in Splunk and Elastic.
14. Capstone Challenges Full investigations such as Tempest and the Boogeyman series.

Phishing and traffic analysis are where many learners first get stuck, because both reward patience with raw data more than tool knowledge.

How Long Does SOC Level 1 Take?

TryHackMe estimates 65 hours 29 minutes for the 65 labs. That figure is realistic if you already know basic networking and have used Windows and Linux. If ports, protocols and the command line are new to you, budget more, or do the Pre Security path first.

• 5 hours a week: about 3 months
• 10 hours a week: about 6-7 weeks
• Full time: two to three weeks, though the material sticks better when spread out

The capstone investigations and the Wireshark rooms usually take longer than their estimates, the framework rooms less.

New Path vs Legacy Path: What Changed

The previous version still exists as SOC Level 1 (legacy), and if you started it, your progress lives there. The main differences:

• Organised by task, not by tool: the new path adds SOC Team Internals (triage, reporting, metrics) and separate monitoring modules for web, Windows and Linux.
• No forensics module: the legacy path had a full digital forensics and incident response block (Autopsy, Redline, KAPE, Volatility, Velociraptor). The new path leaves deep forensics to more advanced training.
• More challenge rooms: new practice rooms such as the TShark challenges, Monday Monitor, Friday Overtime and Retracted.
• Triage-first capstones: the final module is about working investigations the way an L1 analyst would.

If you see a guide listing Volatility or KAPE as SOC Level 1 content, it is describing the legacy path. For a first SOC job, the new focus is the right one: interviewers ask how you triage an alert far more often than how you parse a memory image.

SOC Level 1 Path vs SAL1 Certification

The path teaches, the exam checks. TryHackMe recommends Cyber Security 101 and SOC Level 1 before SAL1, plus a few of the free SOC Simulator scenarios, because the exam's two 2-hour simulations feel very different from guided rooms. Premium subscribers get a discount on the exam. Our TryHackMe certifications guide covers SAL1's format and whether it is worth the money.

How to Get the Most From the Path

• Build a playbook as you go: for each alert type, note the query you ran, what you checked and why you closed or escalated.
• Write every investigation up: who, what, when, where, the indicators, and your recommendation, in five or six lines.
• Redo the SIEM rooms without the hints: Splunk and Elastic queries are the skill that transfers most directly to the job.
• Add outside data: Splunk's free Boss of the SOC datasets and the MITRE ATT&CK matrix give you more to practise on.

In practice, the notes matter more than the certificate. When an interviewer asks "walk me through how you would handle a phishing report", the candidates who kept a playbook answer in concrete steps; the ones who clicked through the rooms answer in generalities.

Will SOC Level 1 Get You Hired?

Not on its own. A certificate of completion shows commitment and relevant practice, and hiring managers who know TryHackMe see it as a good sign. It is not a certification, though, and it will not pass HR filters that ask for Security+, CySA+ or similar.

Treat it as the skills half of your application. Pair it with one recognised certification (Security+ is the common first one, SAL1 the practical one), a few write-ups of investigations you did, and a resume that describes what you can do rather than which rooms you finished. Our SOC analyst career guide covers the rest of the job search.