6 Real Problems I Solved While Building My SOC Homelab
Root Cause Analysis, Fixes and Lessons Learned During My SOC Homelab Deployment
How I Passed TryHackMe’s Security Analyst Level 1 (SAL1): A Practical Study Guide
A breakdown of the SAL1 exam, its SOC scenarios, tools, and how to prepare effectively using TryHackMe
Introduction
Hello everyone!
After publishing my previous article on TryHackMe’s SOC Level 1 learning path , which was very well received by readers interested in blue-team and SOC roles , I decided to write a follow-up focused on the Security Analyst Level 1 (SAL1) certification itself.
Surprisingly, there are still very few in-depth articles covering SAL1, despite the fact that it’s becoming increasingly relevant and recognized in the cybersecurity job market, especially for SOC and blue-team roles.
After taking and passing the exam, I wanted to share my first-hand experience, along with practical study tips and expectations for anyone considering it or wondering how to prepare effectively for SAL1 certification.
Table of Contents
- Introduction
- What Is TryHackMe’s SAL1?
- How Are Candidates Evaluated?
- How to Learn the Theory in SOC L1
- What to Expect in the Theory Exam
- How to Learn the Practical Skills in SOC L1
- What to Expect in the Practical Exam
- How to Prepare for the Practical Exam
- Conclusion
⚠️ This article is intentionally detailed. Feel free to jump directly to the sections that interest you most. Key takeaways are highlighted in bold for easy skimming.
What Is TryHackMe’s SAL1?
The Security Analyst Level 1 (SAL1) is a certification issued by TryHackMe that validates a candidate’s ability to operate as a junior SOC / security analyst in a real-world environment.
Unlike many purely theory-based certifications, SAL1 places strong emphasis on:
- Alert triage
- Log analysis
- Incident investigation
- Decision-making and reporting
In short, it evaluates how you think and act as an analyst, not just what you memorize.
How Are Candidates Evaluated?
The certification is earned by completing a structured exam that lasts a total of 5 hours, broken into three parts:
- 1 hour — Theory exam
Multiple-choice questions focused on SOC concepts and security fundamentals. - 2 hours — Practical exam (SOC scenario #1)
- Another 2 hours — Practical exam (SOC scenario #2)
Each practical exam simulates a real SOC investigation workflow.
Important logistics to know
- You have 24 hours total from the moment you start the exam to complete all three parts.
- The sections must be taken in order, but you can take breaks between them.
This flexible structure allows you to manage fatigue, which is crucial — especially during the investigation phases.
- Practical scenarios are randomized, meaning:
- Each candidate gets a different combination of investigations
- Sharing specifics is both impractical and against policy
Another review highlights on-exam logistics like identity verification and scoring nuances, which many first-timers overlook. blog.razrsec.uk
How to Learn the Theory in SOC L1
Follow the official SOC Level 1 learning path
If you’re preparing for SAL1, I strongly recommend completing the TryHackMe SOC Level 1 learning path, which is the official and most aligned preparation material for the certification.
TryHackMe’s SOC Level 1 path. All you need to learn is here.
This path has been recently revamped and is now far more focused on:
- Real SOC workflows
- Analyst responsibilities
- Decision-making under realistic constraints
The exam does not only test tool usage — it evaluates whether you understand why you’re doing something, just like in a real job.
Don’t skip the “prerequisites” sections
Before starting each room, check the suggested prerequisite rooms. Even if some titles sound basic, they often include:
- Subtle but important details
- Real-world context missing from higher-level rooms
If you’re completely new to cybersecurity, starting with the Pre-Security learning path is a smart move — it builds a solid foundation for everything that follows.
TryHackMe’s Pre Security and Cyber Security 101 foundational paths, packed with relevant, related material.
Take notes (yes, it helps)
Writing short notes — especially for:
- Detection logic
- Attack phases
- Log patterns
…can significantly reinforce your understanding and help during revision.
One recent SOC training guide recommends consistent weekly study instead of weekend cram sessions to solidify learning and mirror real SOC workflows. HackerDNA
What to Expect in the Theory Exam
For context, before taking SAL1 I had already passed: CompTIA Security+ and Blue Team Level 1 (BTL1).
Because of that, the theory exam felt familiar in structure and difficulty. If you already hold certifications like Security+, CySA+, or BTL1, you’ll notice known concepts and this part may be easier for you.
However, SAL1 still includes:
- SOC-specific workflows
- TryHackMe-specific topics
- Modern detection and response concepts
Also, keep in mind:
Even though the exam is multiple-choice, some questions include very similar answers.
You’ll need real understanding — not guessing — to choose the most accurate one.
Key takeaway
All theory covered in the exam comes directly from the SOC Level 1 path. If you complete it thoroughly and understand the content, you are already well prepared.
A good final step before the exam is to revisit rooms you feel less confident about.
How to Learn the Practical Skills in SOC L1
One common mistake among TryHackMe learners is getting overwhelmed by the number of tools to learn. My advice:
Slow down. Understand what you’re doing and why. Be patient.
While learning, keep in mind to master the main tools here, essential to your career and more often used in real-world jobs, namely:
- Splunk
- Elastic
- Wireshark
- Brim
Among them, Splunk deserves special attention, as it is the primary investigation tool during the exam.
Lesser-known tools still matter
Some tools may not appear directly in the exam, but they help you develop intuition and investigative thinking.
Understand the intent of each and what you are trying to achieve with them. Then pick up your favorites as your complementary professional tools.
For example, I really enjoyed using NetworkMinner, so even this one won’t appear in the exam, I may remember it for my future practical investigations. Its practice room also helped me by itself to broad my understanding of network investigations.
What to Expect in the Practical Exam
The practical exam uses TryHackMe’s SOC environment, which is one of the platform’s strongest features. It does an excellent job simulating a real SOC workflow.
TryHackMe’s SOC simulation. The dashboard screen.
You can expect to:
1. Work with a ticketing system
You’ll be required to:
- Take ownership of unassigned alerts
- Assess alert severity and relevance
- Perform investigations
- Decide whether the alert is a true or false positive
- Determine if escalation is required
- Write a clear and complete incident report
2. Use Splunk as your primary SIEM
Most investigations revolve around:
- Searching logs
- Correlating events
- Identifying malicious patterns
3. Use TryTestMe for enrichment
TryTestMe is available in a VM and works similarly to VirusTotal, allowing you to:
- Check IP addresses
- Analyze domains
- Investigate file hashes
This helps validate findings during investigations.
How to Prepare for the Practical Exam
To be fully ready:
Complete the SOC Level 1 path thoroughly
- Focus on rooms related to:
- SIEM usage
- Alert triage
- Incident escalation
- Reporting - Master Splunk, complete related rooms:
- Splunk Basics
- Incident Handling with Splunk
- Investigating with Splunk
- Exploring SPL - Recommended for practicing Splunk with realistic scenarios:
- Benign
- PS Eclipse
- Conti
Complete the two free SOC investigation rooms
- Read and understand TryHackMe’s investigation rooms documentation
- Get used to triaging alerts and applying alert prioritization
- Practice writing clear, concise reports, which include all expected information (remember the Five Ws)
⏱️ Time is tight during the exam , use it wisely.
TryHackMe’s two free SOC investigation rooms included in SOC Level 1. Essential to understand how the practical exam works.
According to one dedicated SAL1 exam review “The most critical preparation … is doing the free SOC Simulators,” — reinforcing the importance of hands-on simulation practice in this exam. happycamper84
Conclusion
I hope this article gives you a clear and realistic idea of what the SAL1 exam looks like and how to prepare for it effectively.
Key Takeaways:
- SAL1 is practical, not just theory
- Splunk and investigation/reporting skills are critical
- The official SOC L1 path aligns closely with exam content
Please remember to respect TryHackMe’s non-disclosure policies if you decide to share your own experience. As you’ve seen, it’s absolutely possible to help others without revealing exam content.
