soc-level-1-path

[quasi bough]

Somebody will reach out to you asap , please be patient 🙂

[dusky maple]

No. Unfortunately I'm still stuck. I've tried to input the information in many different variations and it doesn't really give me an answer except - "this rule has been enabled" or "this rule has already been enabled". But, nothing really happens after that. I am using the IP address from the sample, and Im using the receiving IP addresses given in the sample as well to create a Firewall Rule. However, I'm not achieving anything by doing that.

[lost olive]

Alright, in that case, when I get back home, you think we can hop on VC together?

[dusky maple]

Yeah sure.

[lost olive]

Alright.

[dusky maple]

Think I'll just keep trying to figure this out. I kinda feel like Im getting closer to an answer, but I'll be in touch if I need anymore help. Thanks.

[hazy kettle]

Gave +1 Rep to @lost olive (current: #686 - 8)

[lost olive]

I can definitely tell you that it wants you to deny the outgoing traffic.

[lost olive]

I'm back home now, we can hop on vc if you're able to

[wary siren]

I'm enjoying the content and training material in the SOC lvl 1 path. The only thing that's consistently frustrating is forcing the Split View for learning.

Is there a reason why it's done this way vs letting us use rdp or ssh into the machine?

Also, I've only worked through the Network Security Section, so maybe this is not the case in later sections.

[edgy anchor]

Do you have two monitors by chance, they have an option to make the attack box/machine ip full screen which will open another browser that you can drag n drop.

[quasi bough]

Usually there is an option to use rdp. Which room are you in ?

[wary siren]

Mostly Network Courses right now, Zeek and Brim

[wary siren]

Sorta yes, I'm running Linux VM so it's only on one monitor, but could to two if I use windows

[dapper flame]

@quasi bough

[quasi bough]

He will be removed , thanks 🙂

[hazy kettle]

Gave +1 Rep to @dapper flame (current: #967 - 5)

[dapper flame]

Thanks to you

[carmine comet]

I have this issue in kape room where by i can't search targets and modules in gui kape application i am using browser vm any who can help me pass this obstacles

[serene surge]

Evening all - anyone studying for SAL1

[quasi bough]

Try to ask somebody in #cyber-and-careers channel 🙂

[urban stump]

anyone can support with SOC Level1 > Network Security and Traffic Analysis > Snort Challenge - The basics ?

anyone on? trynna get top3 in my league xD

[storm cove]

task 6 what's the problem here. Don't seem to see it

[sinful vigil]

Youre on the Rigth Track. The Hash and the Report you opend matches

Ofc if you still have the Problem)

[pseudo oxide]

Is there anybody else in the snort room?

[dark shadow]

I am stuck at threat intell tool room Task 7 where i dont see the downloadable file to check on virus tool

[quasi bough]

What is the exact question you're stuck on ?

[dark shadow]

Hi KGB, somehow managed to get the answer... actually in task 8 it says you need to download the file outside VM but no option to do the same so i was looking out for that . But i managed with SHA value

[quasi bough]

Yeah , that is equivalent of uploading a file if you're referring to VirusTotal search 🙂

[oak haven]

anyone in this path?

I'm at snort rn

[oak haven]

Here

[paper pewter]

snort is hell

i'm building my own SIEM stack with Wazuh, suricata, sigma, maybe zeek and something more proactive for immediate response later on top.

snort was just too filthy for me. i can always sniff with something more humane.

so yeah - best way to learn is to build a stack at your home lab. taught me a lot.

[oak haven]

Makes sense. I have the same review for snort but got my hands on that later on

[paper pewter]

you can simplify so many things in cybersec. so much stuff is unnecessarily complicated.

"In software development, the rule of least power argues the correct programming language to use is the one that is simplest while also solving the targeted software problem."

https://en.wikipedia.org/wiki/Occam's_razor

[oak haven]

100% true

[vagrant sinew]

I'm stuck on Sample5 in the https://tryhackme.com/module/cyber-defence-frameworks, Step for the Summit. Any guidance is much appreciated!

[sinful vigil]

Have a look at the Time Frames in the log. And then go From there and Remember that the Threat has evolved

lmk if you need further help afterwards

[humble tendon]

Hi there! I have an issue in Yara room, more specifically working with Valhalla. This question: "Do the same for file 2. What is the name of the first Yara rule to detect file 2?"

When I copy SHA-256 to Valhalla I can see that the first YARA rule name is: "WebshellRepo_convert". Am I missing something or is there a bug? When typing the answer in, I am getting autofilled some extra underscores.

Oh, now I got it...However, I think the question is a bit missleading or maybe it is bcs of my English? 😅

[quasi bough]

What's the hash that you're using ?

[humble tendon]

Oh, let me see if I still can get it somehow

[quasi bough]

You need to verify first , follow instructions from the link below to learn how to do so 🙂

[fathom swan]

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Jun 13, 2025, 9:58 AM

[humble tendon]

That's the hash: 53fe44b4753874f079a936325d1fdc9b1691956a29c3aaf8643cdbd49f5984bf

It think, what I got confused is, that the question is asking for the first YARA rule, which in this case is WebshellRepo_convert, but then I found out that it is actually asking for the rule1, if that makes sense.

[humble tendon]

Should be verified now

[quasi bough]

Can you provide a screenshot from YARA run please 🙂 ?

[quasi bough]

Look at the dates 🙂

[humble tendon]

ahh, right

[quasi bough]

Last two have the same date so try both

[humble tendon]

It makes sense now, haven't noticed the date there

thanks for the help

[quasi bough]

Anytime 🙂

[dusty kiln]

hello guys, anyone on this SOC path?

pre security > cyber security 101 > SOC LVL1 > SOC LVL 2 ???

[humble tendon]

Hi there! In the OpenCTI room in the Investigation Scenario, where I should investigate CaddyWiper malware. I should find answer to this question: How many malware relations are linked to this Attack technique?

Am I missing something here? (see screenshot)

Is the question asked for CaddyWiper or for Native API? The input should be 3 digit, so maybe the Native API, but 149 nor 135 works

Oh, got it...it is asking for the malware relations for Native API...which is a different number

[hasty gazelle]

Correct. Focus on Arsenal, then Attack patterns instead of 'Attack technique' in OPENCTI.

[humble tendon]

Quick question. I need to find out the number of attack pattern techniques associated with the APT. The group is called Tropic Trooper (https://mitre-attack.github.io/attack-navigator//#layerURL=https%3A%2F%2Fattack.mitre.org%2Fgroups%2FG0081%2FG0081-enterprise-layer.json) I know that used techniques are highlighted, but is there a way to quickly get a number of used techniques or do I need to count them just by eye? 😮

[torpid glacier]

I am almost done with cybersecurity 101 and on this path

[dusty kiln]

ohh thats nice, might slide into your dms, lets connect

[torpid glacier]

👍

[topaz viper]

Completed investigating with Splunk, which room should i do next?

[quasi bough]

Follow along with that path 🙂
https://tryhackme.com/path/outline/soclevel1

[wheat scroll]

Hi everyone! 👋

I’m Shashank, based in the UK 🇬🇧 and currently starting my journey into cybersecurity, with a strong interest in becoming a SOC Analyst (blue team side 🔵).

I’m here to connect, learn, share progress, and get advice from others further along the path. If you’ve got tips for getting into a SOC role or want to study together, feel free to reach out!

Looking forward to learning with you all!

[pale wigeon]

I am a little confused by 'Windows Event Logs' Room, Task 4 'Get-WinEvent'.(https://tryhackme.com/room/windowseventlogs) Question 3 states: "Execute the command from Example 8. Instead of the string Policy search for PowerShell. What is the name of the 3rd log provider?" I don't see any "Example 8". What is this in reference to? In only see Examples 1 - 3 in the Task Room. Where or What is "Example 8" Also Question 4 references an "Example 9". Again have no idea what this is referencing since I only see three examples on the task page

[pale wigeon]

Oh nevermind... I think this is coming from the examples in the https://learn.microsoft.com/ docs, not the examples in the THM task room itself..

[quasi bough]

Welcome Shashank 🙂 👋

[quasi bough]

Everything ok now ?

[pale wigeon]

Yup. I figured it out. Thanks!

[hazy kettle]

Gave +1 Rep to @quasi bough (current: #1 - 5272)

[topaz lark]

Hi..

Hello everyone..I started in this sector until recently..I need a study partner..more like learning partner..i am doing THM Soc path and also doing ISC2 CC so it would help if anyone is starting like me..and would love to study together..

[rich glade]

soc-lavel-1-path have any lab practise

[quasi bough]

It has a few

[hexed nexus]

Hey, i have also completed my basic foundation, now i have started SOC l1 path, i am up for a partner dude.

[quasi bough]

I'm going over soc1 also these days 🙂

[hexed nexus]

you are god for me rn bro. you are the best helper here.

[hexed nexus]

i saw your linkedin post btw it was dope. the THM profile one.

[quasi bough]

Well thanks for those words 🙂

[hazy kettle]

Gave +1 Rep to @hexed nexus (current: #1927 - 2)

[desert prairie]

Hey guys, I'm in the SysMon room in the SOC Level 1 > Endpoint Security Monitoring Pathway. For Task 4, Q2...

This command in powershell

Get-WinEvent -Path C:\Users\THM-Analyst\Desktop\Scenarios\Practice\Filtering.evtx -FilterXPath '*/System/EventID=3' | Measure-Object

Returns 73,591, the correct answer for the question.
But going through event viewer and filtering for event id 3 returns 74,970.
Anyone know why this is?
Also I'm not sure if I should've sent this to Room-Help.

[wintry cradle]

hey, i just started doing soc path 1, i would like to have someone with me who i can study along with.

hey everyone, i have a question from the first part. why did the malicious person left a message when i blocked his ip address on the firewall, i dont know if this is something which usually happens or is it just for us to complete the lab and give answer for the question like a Capture the flag

[quasi bough]

That's just for example purposes for this lab 🙂

[wintry cradle]

thank you, i thought when we block an IP address in firewall. we usually get message from the blocked person like that😅

[wintry cradle]

hey anyone know the correct order for the last task in the cyber kill chain

[quasi bough]

What do you think it is ?

[wintry cradle]

yeah i figured it out, thank you.

[wintry cradle]

hey guys, does everyone have tryhackme premium with them.

[visual lagoon]

i personally don't yet am new to the site so i rather see before spending money to learn more why do you ask?? am curious

[wintry cradle]

i was doing SOC-level 1 and after the cyber kill chain, it asks to get premium for getting access to rest of the modules in the path.

i am also new to tryhackme, so i don't know how this works, am i supposed to get premium before continuing or is there any way to access the rest of the modules without getting premium

[quasi bough]

You need to be a premium user to access that room

[humble tendon]

Hi guys! Quick question. I am working on the "Writing IDS Rules (Torrent Metafile)" room. Question: "What is the name of the torrent application?". When I read snort.log, I can see in the log the application name is "x-bittorrent". However, it gave me a wrong answer, when I am submitting it. Am I missing something?

Ahh, ok. Found out what the answer should be. A bit missleading, but whatever :/

[quasi bough]

That is a part of Content Type header , look under Host header instead

[humble tendon]

What do you mean? I thought application/x-bittorent should be enough? I just didn't know I should exclude something out of it

[quasi bough]

That's a content type , it's not a name of the torrent client

[humble tendon]

Right, but question is asking for a torrent application, so why not looking at application/x-....?

[quasi bough]

Because that's a content type not an acutal name of that application . Good place to look for name can be Host header, POST body , Referer header ,...

[humble tendon]

ok, thanks! :))

[hazy kettle]

Gave +1 Rep to @quasi bough (current: #1 - 5422)

[humble tendon]

This should be specify in the local.rules file, right? Depending on what I want to look for i.e. host header, post body, etc.?

[reef pelican]

Hey in Pyramid Of Pain modulus what should I do in the Domian Names section ?
Cuz I faced this issue but did not understand the question tbh ):

Ah I think I got it maybe using virus total to see the directed website okay

yep it worked xd (:

I guess I'm a type of person who ask in dis to know what is this HAHHAH

[quasi bough]

Add + at the of url to see the real one 🙂

[mossy gate]

Well, was doing well and really enjoying the SOC1 path...untill i done Friday overtime.... I found that so difficult. I feel like it is way above my current capabilities. Is there anything else i should be looking into for more practice on these types of rooms? It hit me out of the blue this one!

First time i guess i felt way out of my current depth!

Know there is plenty more of those moments to come ...

[humble tendon]

Hi there, anyone here can help me with this error message?
I am trying to run the zeek with given pcap file and run with the signature file

[humble tendon]

I've tried to restart the VM too, but no difference

[loud fable]

Copy the URL to your web browser, paste it there and load it. Copy the link it opened and paste in the answer section

[loud fable]

Don't give up man, we keep pushing regardless. Anyways, let's get used to doing difficult things as these are the things that will build us to become better defenders

[rancid rain]

Hi everyone,

I’m currently working through the Splunk 201 section in the TryHackMe SOC Level 1 room, and I’ve hit a bit of a challenge. The jump in difficulty from the previous Splunk material feels pretty steep — the queries are more complex, and there’s a lot of new information to take in.

I’ve been taking handwritten notes, which worked fine up to this point, but now it’s getting harder to keep everything organized and retain what I’m learning. I’m starting to feel a bit overwhelmed and not as confident moving forward.

[somber chasm]

I currently have a SOC job, and I find alot of these tasks difficult. You are not alone, but dont give up.

[mossy gate]

Thanks @somber chasm . By no means giving up

[hazy kettle]

Gave +1 Rep to @somber chasm (current: #2995 - 1)

[marble laurel]

Hello everyone just joined the platform and l need study partners for my SOC1 path. Currently on the Network Security and Traffic analysis module(Snort room)

[humble tendon]

Ah nevermind, I did not edit the sig file...all good now 🙂

[humble tendon]

Hey, I'd love to have a study partner as well 🙂 I am currently a bit ahead of you doing Zeek. However, I can help you with snort if needed? 🙂

[humble tendon]

Anyone here can guide me here with this question: "Investigate the dns.log file. Filter all unique DNS queries. What is the number of unique domain queries?" In the Anomalous DNS exervise in the Zeek Exercises
I know I need to zeek-cut the query parameter from the log, I am also piping sort -nr and uniq, but I am getting a huge number as result...the answer should be 1 digit only

Here's my command: cat dns.log | zeek-cut query | sort -nr | uniq | wc -l

[marble laurel]

Thank you for your response. l am so glad to have someone to help me. l am currently on Snort Challenge - The Basics and it seems like every answer l type in there is wrong. l am a bit lost, please help.

[hazy kettle]

Gave +1 Rep to @humble tendon (current: #3000 - 1)

[humble tendon]

what is it you don't know?

[marble laurel]

What is the destination address of packet 63?

when i use the destination ip in the log file it says the answer is wrong

[humble tendon]

are you using -n parameter in your snort command?

[marble laurel]

yes please

[humble tendon]

It's the IDS rules (http) room, right?

[marble laurel]

yes

[humble tendon]

Let me have a look 🙂

hmm, ok it worked for me. How does your local.rules file look like?

[marble laurel]

alert TCP any 80 <> any any (msg: “Task 2”; sid: 1000001; rev: 1;) and alert TCP any any <> any 80 (msg: “Task 2”; sid: 1000002; rev: 1;)

[humble tendon]

try using one liner: alert tcp any 80 <> any 80 ...

also what is the output you're getting when you are trying to display the 63rd alert from the log file?

bsaically, I thin the local rule you have is fine, but there might be a issue having it as 2 lines/2 different rules, so I'd try doing them in one line as I proposed and see if that changes anything

[humble tendon]

did it help?

[opaque sail]

Can anyone help me with the same issue as this one above?

I get the destination IP but the answer is incorrect

[humble tendon]

Can you show me the output of the log file you're getting?

[opaque sail]

That is also the problem is that I do not see the logfile being created

[humble tendon]

what is the command you're using to run read the file with local rules?

[opaque sail]

If I just do "sudo snort -c local.rules -r mx-3.pcap -n 63" I see the 63rd packet but the ip is not what the answer is accepting

I have tried appending "-l ." but it does not create a log file

[humble tendon]

try doing: sudo snort -c local.rules -A full -l . -r mx-3.pcap

[opaque sail]

I have run that as well but a log file does not get created

[humble tendon]

what do you see when you ls?

[humble tendon]

to read the 63rd log, you don't need to run sudo snort -c local.rules again, u just need to do sudo snort -r <log_file> as you just want to read the log file and of course use -n 63

[opaque sail]

This is after I run the command

[humble tendon]

try cat-ing 63 log from alert

[opaque sail]

It is a 0 bytes file

I have tried

[humble tendon]

are you sure your local.rules is correct?

[humble tendon]

looks good to me

[opaque sail]

The first issue i am trying to figure out why the log file is not being created

[humble tendon]

what happens when you run this command: sudo snort -c local.rules -A full -l . -r mx-3.pcap

don't you get a output with how many things it created?

you should get 164 alerts, right? From the previous question

[humble tendon]

you're missing . in the command, no?

[opaque sail]

I was able to get that answer from here

[humble tendon]

before -r, I think that's why you didn't get log file generated

[hexed glen]

Hello everyone!

I got stuck at Snort Task 5. tcpreplay failed for some reason. What am i missing?

[opaque sail]

That is a terminal window sizing issue. i have the "." after -l with a space

[humble tendon]

hm, then I have no idea why you're not getting log file created :/ maybe someone more experience could answer this eventually

[opaque sail]

I appreciate your help!!

[marble laurel]

so please try using this rule instead alert TCP any any <> any 80 (msg: “Task 2”; sid: 1000002; rev: 1;) and run snort using this command sudo snort -c local.rules -A full -l . -r mx-3.pcap. When it is done do ls to see if you will find any logfile created.

[marble laurel]

l followed you advice using the one liner alert and it worked just that my was a bit different alert TCP any any <> any 80 (msg: “Task 2”; sid: 1000002; rev: 1;). Thank you for all your help

[humble tendon]

Glad, I could help a bit and also glad you were able to get it working yourself as well! 🙂

[opaque sail]

Still dont see the log file

After a few restarts of the machine I was able to see the log file. Thank you @marble laurel @humble tendon !!

[hazy kettle]

Gave +1 Rep to @marble laurel (current: #3002 - 1)

[forest zealot]

Have you solve this? I got stuck here too.

[forest zealot]

I need help on this please 🙏

[spare flicker]

Any tips on getting into cybersecurity? I’m currently thinking of either taking the google cybersecurity or IBM cybersecurity analyst courses and after finishing one of them I want to try to get my CompTIA sec+ certification. Any tips on what course would help more?

[humble tendon]

Maybe you can get a better answer to your question in #cyber-and-careers as this is more focused on a specific path 🙂

[dense forge]

Is this a bug?

I k ow I entered more info than this, and it’s also telling me it’s incorrect and correct at the same time

[naive totem]

Hi, I would like to at least get a job as a soc analyst level 1. But I don't know which tools to learn or certs to focus on. Really would appreciate anyone to enlighten me on this. Much love from Vietnam 😘

[quasi bough]

For a career / certification advice ask guys in #cyber-and-careers channel 🙂 . This channel isn't active as much 🙂

[naive totem]

Thanks. Will do so

[midnight dust]

are you guys like beginners

[hasty gazelle]

How do you do to not give up on Task 2 'Snort Challenge - The Basics https://tryhackme.com/room/snortchallenges1 ? It is annoying now. It is supposed to be the "Basics". Please, @fast prairie and @quasi bough what do you know about this task that you can share with us without revealing the actual answer?

[hasty gazelle]

I got correct the first two items 1. Rule to detect all TCP packets from or to port 80, and 2. Destination address of packet 63.

[quasi bough]

Can you provide some screenshots ? What is your rule ?

[hasty gazelle]

Hi. This is my rule ' alert tcp any 80 <> any 80 (msg: "TCP packets to or from port 80 detected"; sid: 100001; rev:1;) ' I do not have the screenshots because I terminated the machine. I am ready to go to bed. It is already midnight here. Thanks for reaching out.

[hazy kettle]

Gave +1 Rep to @quasi bough (current: #1 - 5641)

[calm comet]

Shoutout to the people behind the Wireshark Traffic Analysis room, the documentation is put together so well

[grim orchid]

can i have the link of that room? i wanna try it

[quasi bough]

Here you go 🙂
https://tryhackme.com/room/wiresharktrafficanalysis

[quasi bough]

Can you provide some shots please of what happens when you run Snort ?

[hexed glen]

Still working on it too.

[hexed glen]

With tcpreplay just reset the VM I waited 24 hours and worked.

But still can't reproduce as the task does in examples.

[obsidian junco]

how do i post image in this chat

literally no options/ cant even drag/drop

[quasi bough]

You need to verify first , follow instructions from the link below to learn how to do so 🙂

[fathom swan]

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Jul 23, 2025, 12:48 AM

[obsidian junco]

thank you

[hazy kettle]

Gave +1 Rep to @quasi bough (current: #1 - 5653)

[obsidian junco]

This is the 4th time im restarting the machine...no VM window opens...its just stuck counting down timer...What do i click to open my VM Window to complete this assignment??

[quasi bough]

It shouldn't open in split view , click on the link provided in the task to access the machine

[weary dew]

Hello @quasi bough
Been a while. Can see you are a Mod now. Well deserved🙂

[quasi bough]

Thanks 🙂

[hazy kettle]

Gave +1 Rep to @weary dew (current: #3036 - 1)

[quasi bough]

Visit MITRE page for technique from question 2
https://attack.mitre.org/techniques/T1078/004/

[hazy kettle]

Gave +1 Rep to @quasi bough (current: #1 - 5659)

[hasty gazelle]

Hi @quasi bough . Thanks for reaching out. I managed to solve item 3 of Task 2 for 'Snort Challenge - The Basics' by using the Hexadecimal number. It gave me a hint that can be useful for others, the ACK number is the same for both packet 63 and packet 64. I hope it is not a spoiler.

[hazy kettle]

Gave +1 Rep to @quasi bough (current: #1 - 5663)

[hard dome]

I can't press the start machine button?

Does anyone have a solution?

[quasi bough]

It was an issue on thm side should be working fine now

[hard dome]

Thank you

[hazy kettle]

Gave +1 Rep to @quasi bough (current: #1 - 5685)

[hasty gazelle]

Hi everybody. I am still stuck in room 'Snort Challenge - The Basics', this time with Task 3. None of the two digits number I get match the answer for the question about 'failed FTP login attempts'. I am not giving up yet. I do not know if any of the commands in the snapshot is not suitable for this task. Anybody knows anything about it?

[marble laurel]

Hi ProbaN you can try this to see if it would work
alert tcp any 21 -> any any (content:"530 "; msg:"FTP Login Failed"; sid:1004;)

[quasi bough]

Can you provide a shot of what happens when you try running the Snort command ?

[opaque sail]

Hi, I would like some help with the sysmon room. When I try to start sysmon using the command provided "Sysmon.exe -accepteula -i ..\Configurations\swift.xml" IT says failed to start the service even though I am trying from PowerShell as Admin

[hasty gazelle]

Hi,
Thanks for your help. I will be busy with other matters for approximately the next 30 days.
I will retake the rooms here in THM on 25 August. I will post any updates here by then.

[hazy kettle]

Gave +1 Rep to @marble laurel (current: #2002 - 2)

[hasty gazelle]

Hi,
Thanks for reaching out. I will be busy with other matters for approximately the next 30 days.
I will retake the rooms here in THM on 25 August. I will post any updates here by then.

[quasi bough]

Ok , feel free to reach out whenever needed 🙂

[ember egret]

hello

[humble mica]

hello does anyone know why thunder bird wont work i try to sign up it wont work i am refferring to tht threat intelligence tool room

[quasi bough]

You don't need to sign-up , just close that window 🙂

[fading umbra]

Hello

Can anyone help with wazuh??

[nocturne cave]

hello. for the first question in Task 2 of "Snort Challenge - The Basics" room, i got the right answer by writing a rule to match any source and destination ip address and port, but how come that's the case if they asked "to detect all TCP packets from or to port 80" ?

[quiet osprey]

Hello, I need your help on the arrangement of these items in the kill-chain:

1. exploit public-facing application
2. data from local system
3. powershell
4. dynamic linker hijacking
5. spearphishing attachment
6. fallback channels

[quasi bough]

What's your idea ?

[quiet osprey]

1. exploit public-facing application- exploitation
2. data from local system- actions on objective
3. powershell- installation
4. dynamic linker hijacking- weaponisation
5. spearphishing attachment- delivery
6. fallback channels- command and control

[quasi bough]

You're close but dll linker hijacking is a common privesc technique we use it for exploitation of the system . Also we will use powershell for weaponization since it is a tool with which we create our initial payload 🙂

Switch those two

[quiet osprey]

Okay, thanks. But where does "exploit public-facing application" belong, installation?

[hazy kettle]

Gave +1 Rep to @quasi bough (current: #1 - 5742)

[forest fjord]

hey, this is happening to me too

[worthy berry]

Hmm

[quasi bough]

Looks like initial access technique 🙂

[hexed nexus]

it is just saying to detect all packets from port 80 from source and destination, just use port 80 in source and destination. while making a rule.You will get your answer.

[frosty dawn]

How do i share a screenshot on here?

[quasi bough]

You need to verify first , follow instructions from the link below 🙂

[fathom swan]

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Aug 5, 2025, 1:39 PM

[meager tangle]

Hey, does anyone know if it's normal to feel a little bit lost with the Intro to Cyber Threat Intelligence room? I've been following the path in order (and did the Cybersecurity 101 path before this) but I feel like I missed something somewhere because I'm kinda lost once task 3 got to the scenario 😵‍💫

Yeaaah, I'm extremely lost now. This room was making plenty of sense but once it brought up the scenario in task 3, I feel like I missed a room or two somehow... might just call it for the night, honestly

[meager tangle]

Decided to try watching a video walkthrough on "Intro to Cyber Threat Intel" in hopes that it'd help me focus a bit more on the scenario but it looks like the room has been changed since this video came out ~1 year ago? The text in the tasks is completely different from what's there now 🤨

Maybe this is why I was so confused, the room had to have changed in the last week or so because I only took a few days off from learning and the earlier tasks have completely unfamiliar text in them. It's like a Mandela effect or something... going crazy

[thorny rock]

Mate it’s totally normal to feel lost doing anything

On thm

If your not lost at some point your not learning

I have a friend on here who I will bring in to this community he is really good and can help us

I just realised this group is massive with loads of resources and people like 0day he is really cool that guy is an inspiration

[humble mica]

hey is the site not working my machine having issues loading

[light iron]

Hey guys I'm mew to this server

Can anyone teach me hacking

[quasi bough]

You can start learning here
https://tryhackme.com/resources/blog/free_path

[light iron]

Thanks

I'm really interested in learning ethical hacking

[meager tangle]

Quick question, with STIX (Structured Threat Information Expression), the current room says it's a JSON format for describing threat context. Does that mean I'm going to want to learn JSON? I know what it is and I know very basic web development tools/formats/languages/etc but JSON is beyond what I know at the moment

[meager tangle]

And man, I've tried on four separate days to get through the Intro to Cyber Threat Intel room and every time, I get to task 3 and start zoning out. As I mentioned elsewhere, I'm understanding the concepts but this practical scenario makes me feel like I've missed something, somewhere 😵‍💫

[cold dock]

Hello guys! Hope you doing well 😊
I stuck on ItsyBitsy room, Kibana just not loading. I try multiple times using VPN and Attackbox, but getting same message "Kibana server is not ready yet"

[vital lodge]

I've also recently got into the SOC level 1 path and am also finding it hard to stay focused.

It just seems very verbose and a lot of technical words which I'm unfamiliar with I guess. I got through the frameworks and just completed the Intro to Cyber Threat Intel, but yh a lot of re-reading due to zoning out and most of it just not entirely going in. Just hoping the important content sticks when I actually start having to use it

[meager tangle]

Exactly my issue. It could be because I learn best by doing, and second-best by watching other people do it (a la videos) but yeah, the sheer verbosity of it all definitely is challenging to follow. I'm hoping that doesn't bode negatively toward my future with blue teaming 😬

[snow belfry]

I usually take notes it helps. I also use the pomodoro method to stay focused. I block out 30 minutes to work ( I usually have brainwave music on) and then I take a break for 15 minutes. I hope this helps. I am almost done with SOC 1, currently at the summit.

[meager tangle]

Appreciate the tips! I take notes in Obsidian but generally copy-paste sections of interest or else it'd take me forever to get through a single room 😅 As for Pomodoro, I've heard some about that but haven't looked into it, I'll definitely be checking that during my studies for the ISC2 CC and other certs! Music-wise, I go for ambient stuff like instrumental post-rock, as it tends to help me focus. Hadn't considered doing the blocks of time, though! Thanks again, will definitely try some of these!

[hazy kettle]

Gave +1 Rep to @snow belfry (current: #3078 - 1)

[cold dock]

Hello everyone!
Guys, can I 100% complete SOC path if some modules, like capstone challenge, contains SOC Simulator rooms?

[quasi bough]

You will get the certificate even if you don't do go through those simulations , those are optional 🙂

[cold dock]

Thank you 😊

[hazy kettle]

Gave +1 Rep to @quasi bough (current: #1 - 5825)

[balmy path]

Hello, I'm having issues with a stable connection to the server in the network miner room. The room crashes on me and goes slow at other times.

[meager tangle]

In the Yara room, did anyone else notice how the room says "you're not expected to use this tool in this room" when talking about Loki, yet you're definitely required to use it on several occasions? 🤨

[tropic dragon]

hello, Can you help me about Practice Analysis of Cyber Kill Chain?

[humble mica]

hello im doing tryhackme windonws event log task 5 can someone tell me whast wrong wiht this

get-winevent -logname security -filterxpath '*system/provider[@name="wlms"]' and '*system/timecreated[*2020-12-15T01:09:08.940277500Z"]'

it seems right to me but won fit in anser

[quasi bough]

Can you please verify and provide a shot of your issue 🙂 ?

[fathom swan]

Discord: How Do I Verify My TryHackMe Account?

Article Link

https://help.tryhackme.com/en/articles/6495858-discord-how-do-i-verify-my-tryhackme-account

Aug 17, 2025, 9:49 AM

[knotty coral]

I am starting SOC lv1 path of someone want to join my the journey they can dm me

[oak creek]

Having problems verifying account

[quasi bough]

which problems ?

[tropic dragon]

the issue has solved

[nocturne cave]

Hey everyone! 😁
Hope you’re all doing great!
I’ve recently started studying for SOC Level 1 and right now I’m exploring the Unified Kill Chain module, super interesting stuff so far!
I’d love to connect with others who are also getting into cybersecurity or already on this journey. Let’s learn together, share insights, and support each other along the way.
Feel free to reach out, let’s grow in this field together!

[willow anchor]

Room/Azure ||should be free|| why when clicked it directed me to ||pay for premium||

[karmic laurel]

Didn’t see anyone post about it in August but the CTF in cyber threat intelligence Friday Overtime appears to be broken. VM returns a 502 bad gateway upon opening

[quasi bough]

That means that the service isn't up yet . Please allow it at least 10-15min to fully bootup . Press F5 from time to time to refresh the page and see if it's resolved 🙂

[karmic laurel]

Thank you comrade

[hazy kettle]

Gave +1 Rep to @quasi bough (current: #1 - 5866)

[tropic dragon]

Can you explain how to do the test " Summit" of Cyber defence frameworks

[orchid merlin]

in the "Sysmon room" im supposed to copy that into the answers but its impossible to copy anything is it normal ? is there any way to copy

[quasi bough]

Use clipboard 🙂
https://cdn.discordapp.com/attachments/522158539129618453/1336120736753913977/clipboard.gif?ex=68b23be7&is=68b0ea67&hm=29d5baa39e6a0ffd776da56b49b387b506116898d1751a1826af473ef0bf5ea9&

[golden knoll]

Hey guys i started this path a week ago and i finished the intro to SOC and pyramid of pain is anyone on the cyber kill chain if so how is it going?

[orchid merlin]

:/ unfortunately there is not on this machine

[quasi bough]

Try with Ctrl+Shift+Alt

[quasi bough]

How does it go for you 🙂 ?

[orchid merlin]

Ohhhhh, thank you sooo much !! 🙂 ye it works with ctrl + shift + alt

[hazy kettle]

Gave +1 Rep to @quasi bough (current: #1 - 5892)

[simple oyster]

Hi guys

can someone help me. Why is my snort not generating alerts and log

I can;t attach an image

sudo snort -c /etc/snort/snort.conf -v -A full -l /var/log/snort

the above command run the snort but it will not generate a alert and log file with data inside

"sudo snort -v -A full -l /var/log/snort -c /etc/snort/snort.conf" another command that I run to capture the traffic, unfortunately alert file and snort log is not generating. Pls help

I can't upload photo

[simple oyster]

all goods now. I need to create a custom rule first before an alert will be generated

[timber jewel]

hi community! i have an issue with the last question in this room tryhackme.com/room/fridayovertime. even though i found it, it says it's the wrong answer. what i have to do?

[mild egret]

Damn, Redline is killing me with the Attackbox/RDP

[rugged seal]

hey yall I'm decoding a base64 pdf but it seems like I have the wrong format, can someone help?

[mild egret]

What room are you working on?

[rugged seal]

Nvm I worked it out, it was phishing emails and I just need to convert from base64 to pdf

[graceful cobalt]

https://tryhackme.com/room/summit

[graceful cobalt]

Hello everyone, I hope you’re doing well.
I’m working on this room, but I’ve run into some issues with question 2.

is there someone who can help please?

[teal vector]

The malware file u can see when scanning it is trying to make a connection to its own server to control the system at the ip u can find in the scan so to stop it u have to put in a firewall rule that blocks the outgoing traffic (egress) to that ip so that the malware cant connect to the attackers ip

[graceful cobalt]

I see I see , thank you so much 😊

[hazy kettle]

Gave +1 Rep to @teal vector (current: #3157 - 1)

[teal vector]

No problem!

[graceful cobalt]

🙏

[left thunder]

Anyone had issues with SOC Simulator please do give tips on how you resolved the white screen error when selecting alert queue tab
https://tryhackme.com/soc-sim/alert-queue

[turbid palm]

Good day everyone, I was doing this exercise and after filling all the answers. The response is saying " At least one of them is incorrect".

And I got them right. Pls help

This exercise is under Cyber kill chain and it the last exercise to done there

https://tryhackme.com/room/cyberkillchainzmt

[young salmon]

hi did you succesed?

[quasi bough]

Can you provide a screenshot of your list please ?

[remote socket]

Same

[cold dock]

Hi!
I tried to run it later at the same day and it started

[muted galleon]

hi everyone, iam having troubles with the vm's on a firefox web browser. I load up the vm (windows vms exclusively for some reason) and it keeps right clicking without me right clicking, leading to me being unable to use the vm properly.

Im not sure why this happens, and if it's even on my end i would be happy to get some help from anybody

Thanks guyssssssssss goodluckkk

It is the tryhackme ui rightclick, not the firefox normal right click if that makes sense. The glitched right click only shows "paste" whilst the firefox right click allows me to copy, search with google gemini etc...

I feel like maybe i should submit a ticket 💀

[vital lodge]

From what I've read a few people have had the same issue, you either need to switch browser, use full screen or interact with the machine another way like ssh/rdp

[native viper]

exactly! I usually ssh into the machine whenever I have issues

[errant oar]

hey everyone, currently working on the benign room in the SIEM section, was wondering if anyone who is experienced and has done the room already could possibly meet up and go through the room with me. After doing the investigating with splunk room, i had to google a lot for help, because i was unaware of how to really search for things and didn't know what each eventid classified as.

Trying to build up the skills and knowledge to know how to navigate and what to look for when trying to answer these questions instead of just searching for the answers on google.

[smoky oyster]

.

[north breach]

Hi everyone,
I’ve just started the SOC Level 1 path on TryHackMe, but I feel a bit lost. I’m not sure if this is the best place to start, or if there’s a better path for beginners. Could anyone guide me on the right starting point? Any advice would be really appreciated! 🙏

Also, I’d love to hear how you started your own journey on this path. Any advice would mean a lot!

[hushed wedge]

maybe check THM roadmap: https://tryhackme.com/hacktivities?tab=roadmap

[tulip river]

helo i am solving SOC level 1
Osquery: The Basics
i am stuck in task 5 question 5 its correct answer is Wireshark 3.6.8 64-bit but there is no space to type bit i also tried x64 it doesnot work
and also in task 6 question 4 its answer is 214 but it is not accepting
can any one help me plaese

[sinful vigil]

Hi, the answers dont get accepted cause theyre wrong. This vid from John Hammond should help 🙂 https://youtu.be/YpmGZseJbJY

[tiny turret]

I have the same problem and the vid did not help me on this problem i think its a probleme from THM

[native viper]

I just did the Summit Room's Challenge and all I can say is WOW!! Is that what real life SOC looks like? Daunting but absolutely interesting!!

[rigid solstice]

Hey Guys,

Last question in the sysmon room "What C2 is the adversary utilizing in Investigation 4?" I got the answer correct it was the name of something that couldn't really be avoided when working with another question "Trying not to spoil anything". I don't know if I arrived at the write answer correctly though as I just saw the name. Is there a way to identify C2s in event viewer with sysmon?

[tight berry]

Hi is anyone familiar with the Monday Monitor room? Is there supose to be a split view VM? Because when I start the machine no split view shows checkout the attached pic. Thanks

[native viper]

I think in cases like this you are meant to navigate to a certain url where you carry out the assign tasks just Like the Summit room under Cyber Defence Framework

[mighty hemlock]

Is anyone facing the same problem in OpenCTI where the target machine isn't producing any ip address

[hushed wedge]

are you using THM AttackBox or THM VPN?
screenshot shows my experience with starting the target VM for that room, using THM AttackBox

[ivory flint]

I use firefox and have the same issue. For the Windows machines RDP into them, it’s so much better and honestly pretty easy once you have setup thm vpn

[ivory flint]

https://github.com/anthonychl/THM-SOC-1/blob/main/04-endpoint-security-monitoring/06-osquery-basics.md

[quasi bough]

No you're supposed to click on a link from Task 1

[random osprey]

Hi, the velociraptor app (SOC1 Path) isnt' starting. Does anyone have the same problem? I have started the velociraptor server in the terminal, opened chrome and clicked the velociraptor link. Then I added the creds and it's loading, but no login possible. Please help

[hushed wedge]

it took a while for me, but all the steps from Task 2 ended up as per screenshot
however, there was no shortcut for Velociraptor after opening Chrome, hence I used the history of Chrome

[random osprey]

Thanks for retesting. The server startet but the App was loading round about for 10mins and then there was a chrome error message, e.g. no responding, site can't be loaded. I am gonna try it again later...

[hazy kettle]

Gave +1 Rep to @hushed wedge (current: #9 - 987)

[random osprey]

Testing the velociraptor vm again:

16:30 MESZ

1. start: abortion!
2. start: abortion!
3. Start: starting - ok! Then: Instance termination
   Unfortunately, your instance has been automatically terminated. Please re-start a new one. To learn more about why this happens, please refer to.
4. Followed the instructions the the info page for Instance Termination. Deactivated all Firefox Plugins!
   New Start: Yep running! 16:56, 17:11 Instance Termination

It's impossible for me to use this vm.
I followed the rules from the info page for Instance Termination and deactivated all my firefox plugins - no success.

please fix all the SOC1 VMs

[hushed wedge]

what is your Server Region under Profile > Manage Account > Account Details?
do not confuse with Access via OpenVPN though

[random osprey]

EU-Regular-2

[hushed wedge]

that is about VPN, not your Server Region (either Europe-Ireland of US-East (Virginia) )

[random osprey]

yes, europe/ireland

[hushed wedge]

thanks, Europe is just like for me
sometimes I have the impression there are more problems with VMs dying in US-East than in Europe
all I can see right now is that sometimes Velociraptor works and sometimes it does not, and I do not know what to do about that
maybe you want to take up the offer from Blackout (THM Staff) here: #site-support message
otherwise, you have the option of turning to THM Support which works by email

[hazy kettle]

Gave +1 Rep to @random osprey (current: #2105 - 2)

[fathom swan]

TryHackMe's Email

TryHackMe's support email address.

​

[e-mail]

TryHackMe Socials · Oct 7, 2025, 3:44 PM

[random osprey]

ok. thanks for the help and the infos so far

[hazy kettle]

Gave +1 Rep to @hushed wedge (current: #9 - 992)

[burnt gust]

Hello, I'm unable to run the traffic-generator file in the Snort room. When I run the file and select an action, the terminal gives the error:

Error constructing proxy for org.gnome.Terminal:/org/gnome/Terminal/Factory0: Error calling StartServiceByName for org.gnome.Terminal: Timeout was reached

[main charm]

Yo, for info, i had the same problems with Velociraptor VM, shuting down after few minutes, even after desiabling addons with Fox or Brave.. Then i changed location setting from EU to US, since then, working so far.

[native viper]

To the admins please update this room (threatinteltools) as the domain for that IP has changed. I had to look at someone's previous work to get past that point.

[karmic laurel]

I apologize if this has been covered already I do not get on this discord frequently anymore

How is it possible to get a certificate of completion for the course if THM charges 1200 to use the three SOC simulator labs

You can do phishing unfolding but hooks, upload and black cat all require an advanced sub

[native viper]

Am I doing something wrong guys?

the answer format is a single digit but the word count for strings says 627

[tepid hill]

Is it asking for the count of all strings or the number of strings that was flagged?

[tepid hill]

By "advanced", like a business plan or something similar?

[rugged seal]

You need to find all the matched strings

It asked how many strings used to flag the file not which string was used

[digital prairie]

hi everyone ,im stuck on pyramid of pain task 4, last answer ......Provide the redirected website for the shortened URL using a preview: https://tinyurl.com/bw7t8p4u

[digital prairie]

nvm, i found it

[karmic laurel]

Yes the $1200 plan

[tepid hill]

Hmm.. haven't done the path myself so I can't say for sure. However, there is a plan to make the SOC simulator available to regular subscribers

[tight berry]

Thanks I got it sorted

[hazy kettle]

Gave +1 Rep to @native viper (current: #2118 - 2)

[raven pawn]

i don't think this rooms is working properly Threat Intelligence Tools

Thunderbird Mail app is not working it all

[raven pawn]

this room should be look up ,task 6 need to be updated

[latent birch]

Hye

hey

I'm on SOC level 1, but unable to solve the last part of the Cyber kill chain

Can anyone help out

Add each item on the list in the correct Kill Chain entry-form on the Static Site Lab:

exploit public-facing application
data from local system
powershell
dynamic linker hijacking
spearphishing attachment
fallback channels

Also in the MISP room, im unable to open the VM

There appears to be an error there .

[inland obsidian]

hey, I have that difficulty also, so there is nothing wrong with what I did??

[latent birch]

anyone else facing issue while accessing vms?

[safe field]

looool

[raven pawn]

that room is not update you will have to goggle for the correct ansewer bcs that ip its already on another domain .. that just happens to me

[vague cave]

Can you confirm if this is working for you or not? https://mitre-engenuity.org/

[ivory sedge]

How are you, I would like someone to help me know how to answer the questions, I always have error messages that I am not respecting the rules

[hasty gazelle]

Hei. I just got the error 'The connection for this site is not secure'.

[raven pawn]

do any one have problem whit this room Snort Challenge - The Basics???

task 2

[tired nimbus]

Hey everyone ! Happy to be part of this group!

[native viper]

I just got to the Snort Room. I'll let you know if I encounter any challenge and the steps I took t fix them if I can

[atomic pendant]

Hello everyone, I was in the Windows Event Log room and got stuck on the first question. The question is: What is the Event ID for the earliest recorded event? I sorted the events, but I still got 4104, which seems to be wrong. Has anyone else faced a similar issue?

Anyone ?

[native viper]

Hey there, I just concluded the task 2 and the instruction was to run a shell script at a given directory. I did not encounter any errors in the process but if you can be specific about the issues you faced, I may be able to help

[white vortex]

Holy shit i cant do this no more I need Some help.

In the MITRE Room Task 4 last question:

"Which Detection ID would you implement to monitor suspicious cloud logon activity in your organization's environment?"

What is the answer?

Because...

AN1503
AN1504
AN1505
AN1506

DET0546

T1078
T1078.004

these are all wrong.

I may be stupid.

But its the only question left im stuck on this for like almost 1 hour now.

[indigo monolith]

Same situation im in... the answer should be det0546, but its not accepting. Possibly a bug with thm platform?

[static widget]

Yes I am stuck in it for the last hour

[static widget]

Have u found any solution to it

[white vortex]

No.
Even tried Asking ChatGPT.
I aswell looked at some Walktroughs from other people but they just didnt have the question.

[languid estuary]

AN-1206— Suspicious Cloud Login
OR
AN-1207: Suspicious Cloud Logon (Valid Accounts: Cloud Accounts — T1078.004)
based on chatGPT but not accepting neither one of them

Update:
also could be : "Behavioral Detection of Remote Cloud Logins via Valid Accounts " based on the enterprise level
AN0017, AN0018, AN0019, AN0020 but not accepting these also

[pallid crag]

I have the same problem. Last open question.

[white vortex]

Now ive tried every groups activitie that contains anything with "cloud" no Detection IDs worked

[static widget]

Yea I have tried everything too gemini and all but i think it's some bug

Cuz it's asking for an answer in english

[languid estuary]

@vagrant ledge @astral cedar @normal kettle anyone from the original creators of the room can give us a hint?!

[static widget]

Yea and also this question is new too cuz it's not in old walkthroughs also

[white vortex]

Its fixed guys

easy to find now, idk if im allowed to post the answer here

2+ hours of trying and then it was actually a bug damn

[astral cedar]

Apologies for the confusion. The room was updated today, and it seems MITRE recently (in the last couple of days) deprecated the previous DS series of Data Sources, which the previous question and answer were based on. It has been updated to reflect the new Detection Strategies DT. Thanks for the info 🙂

[static widget]

Thanks it's fixed now

[hazy kettle]

Gave +1 Rep to @astral cedar (current: #149 - 64)

[atomic pendant]

Hello guys have you guys completed windows event logs room?

Anyone ?

[eager crown]

Thanks for the update, Ryla. And how about those bugs in the Windows Event Logs and the Sysmon room? Are they fixed as well?

[hazy kettle]

Gave +1 Rep to @astral cedar (current: #146 - 65)

[median arrow]

Hello everyone, I am taking the soc level 1 course. I have a question: in the soc level 1 classroom, when I complete all 9 rooms in soc1, will I be provided with a certificate of completion of the soc level 1 classroom, or do I have to register for the final certificate exam in that classroom to complete the room?

[proven river]

You gonna get your certificate of completion after you finish those rooms. Then you can buy the SAL1 certificate if you want.

[median arrow]

So I will receive a certificate of completion of SOC Level 1, because I saw that when I studied, at the end there was an additional part to take the salt1 certificate exam, I was afraid that if I didn't take that exam, they wouldn't issue the certificate of completion of SOC Level 1.

[proven river]

Yes, you can get it after you complete.

The SAL1 is just there. When you finish up the rooms you get an email saying you can continue with the SAL1.

[true sphinx]

Hi! I'm into Snort Challenge - Live Attacks now, i'm kinda burnout and slow progress, maybe we can be study buddy if you don't mind

[raven pawn]

im stuck here guys

Windows Event Logs task 5

i already respond all question except the first 2

this was what i put on the power shell vm for find the answer to the anothers question

and its saying the its wrong

Get-WinEvent -LogName Application -FilterXPath ‘*/System/Provider[@Name=”WLMS”] and */System/TimeCreated[@SystemTime=”2020–12–15T01:09:08.940277500Z”]’

do im missing something or there is a error on that room ?

and for the question #2 i put this Get-WinEvent -LogName Security -FilterXPath ‘*/EventData/Data[@Name=”TargetUserName”]=”Sam” and */System/EventID=4720’

[shrewd zephyr]

Has to soc1 program just been changed/updated?

I was almost complete with the program yesterday at 72%. Now today I'm only at 31%,

[proper meteor]

Hey, Sorry. There will be some disruption today, we are doing a MAJOR upgrade on the path. Don't worry, you'll have the choice to continue origional path or switch to the upgraded path. Some announcements are due to come out shortly.

[iron drum]

oh

interesting

[shrewd zephyr]

@proper meteor

@proper meteor Thanks

[hazy kettle]

Gave +1 Rep to @proper meteor (current: #324 - 26)

[raven pawn]

i wake up this morning and i was like what its going on

for be honest the original was pretty good but i think that one have some content for soc level 2

like more advance resource , just my opinion maybe wrong , but still thinking the it was good content

[dim island]

Yeah Literally me this morning too, it just changed completely 😅. I was on the third section it was network traffic

[fast prairie]

Hey everyone!
To help you stay ahead in the fast-changing world of cybersecurity, we're thrilled to announce that the updated SOC Level 1 Analyst Path is now live! 🚀

The updated path includes:

• ✨ 9 new modules and 38 new rooms
• 🧩 Lots of content improvements
• 🏅 9 new collectible badges

This major update fully modernizes the path to focus on the core skills required for today's SOC Level 1 analysts, explaining how a SOC is organized, how the analyst role aligns with emerging threats, and how to apply these skills across real-world scenarios. We have also adjusted overly complex forensic content and expanded coverage across all SOC domains, check out the blogpost for more details. We can't wait for you to explore everything we have built!

Migration notice:
You might have experienced some temporary issues when accessing or progressing through the SOC Level 1 path while we roll out the update. Please refer to the updated URLs below:

• 🌟 New path: https://tryhackme.com/path/outline/soclevel1
• ⌛ Legacy path: https://tryhackme.com/path/outline/soclevel1legacy

Both the current and new SOC Level 1 paths will have a certificate of completion and remain available in Paths until the end of the year, but if you've just started your journey - we recommend jumping straight into the new path for the best experience!

Thanks for being with us as we continue to grow and improve, we can't wait for you to dive in and see what's new! 🎉

[proper meteor]

Yeah, the original SOC Level 1 path was great, really taught some fantastic skills. The feedback from the rooms and the modules was great. However, when reviewing the path and talking with our business customers on the expectations they have for an L1 in their teams we saw the need to improve. Some topics did not get enough coverage and some topics were relevant more for a senior role than an level 1.

We talked to lots of our customers, got feedback from them in terms of what they expect someone coming into an L1 position to have, and really focused on that to perform this major rebuild of the path. Really think this is a huge upgrade to the path, and I hope when you look at it and even talk to people currently in SOC roles, you see how great an upgrade this is.

[grim folio]

Even though I'm happy for adding new relevant rooms but still I feel that this New path looks so brief, like similar to intro rooms, the topics and its explanations that were in the new rooms looks so short compared to the old ones, i feel it doesnt take much time to complete the rooms in new path compared to old ones, does this New path carries the same depth like Old ones?

[slow moat]

I agree, looking at the new rooms, I don't feel that it goes in-depth on certain topics.

[proper meteor]

We're really focusing on skills required for the SOC L1 role. We think we've covered it at the level for this role, but if you think we missed the mark on some topics let me know and we can look at improving it. If anything, when I look at the old path, there are 8 modules, the upgraded path has 14 modules! We had worried we covered too much, but we really wanted to try and teach everything required. Also, in the old path, if you look at the Digital Forensics and Incident Response module for example, although I absolutely love that module, I think if you ask a SOC analyst if lots of that module was relevant they would say no (at least the ones we talked to agreed). We're now moving up and into the SOC L2 path, looking at that, and refreshing. There are some topics that got moved from the L1 into the L2.

What topics do you think should be added?

[slow moat]

idk, but it feels a bit off. I think this is just because its new and I need more time exploring the new rooms a bit. At first I noticed the new module for windows security monitoring, it tackled event logs but they removed the windows event logs room that was in the old DFIR module. So looking at a beginner standpoint I would be a bit lost.

but hey, can't really say not until I've completed all of them. Thanks to the team who worked hard to make this happen. Lowkey excited to learn this stuff

[sharp gyro]

i think the overall path makes more sense now with it being SOC level 1, but i do agree it feels as though there isn’t enough depth. the original path went in to way more detail with a lot of df tools, a lot of which aren’t even covered at all now. doesn’t seem a bad change, just looks a bit too simple.

[proper meteor]

I'm very open to feedback so if you think something should be covered just ping me. I can't remember the reasons we didn't include that specific room, I think it was that it was an older room which some outdated info but I may be wrong.

Yeah, we did work hard, and we hope we hit the mark. The intention is that this path will give people a better chance of getting a job in a SOC or improving their skills for those currently in the role. We really tried hard to make it relevant to the role of working in a SOC.

[slow moat]

Thanks for updating. The rooms actually look good ngl. Looking past a few missing pieces the new content is good esp that this is for SOC 1 path. I also liked the added capstones so personally I think you guys hit the mark. 😁

[hazy kettle]

Gave +1 Rep to @proper meteor (current: #317 - 27)

[proper meteor]

Yeah, there are definitely rooms in terms of forensics e.g. Volatility, Autospy, KAPE that are fun (I love them), are just not relevant for an L1 position.

[proper meteor]

There'll be one more module to come, and although we've not announced it, so a little confidential, ahem 🙂 but we hope to build a SOC L1 focused CTF and then put that as a final module as somewhat of a test your skills.

[slow moat]

Can't wait 🔥

[grim folio]

Actually i have no complaints, this new path looks perfect and more than anything else the new rooms looks very very relevant for what a SOC1 does, but since u asked me what needs to be added, I would say Threat intel & Incident response basics..

[grim folio]

Removing whole DFIR is a sensible decision, but removing sysinternals, sysmon, osquery, wazuh , zeek a bit disappointing

[tropic flower]

Did you yank a badge with this? I had 51 badges yesterday, today I only have 50.... Trying to figur out what happened

[proper meteor]

We only added new badges, we haven't removed anything unless someone pulled the wrong plug... Any idea or way you can see what might be missing?

[tropic flower]

That's what I'm trying to do, figured i'd ask cause that would make it much easier to figure out if there was a retraction.

[proper meteor]

in case it’s related 🤷🏻‍♂️ the only modification we made was one badge previously called “Phishing” is now “Phish Hunter”, and “wireshark” badge was attached to an extra room.

[tropic flower]

That's it, I no longer have the phishing badge.

[proper meteor]

Ah, I’ll go talk with the devs.

[proper meteor]

Can you check now, they made a change?

[tropic flower]

Now I have Phish Hunter

[tropic flower]

You took my Checkmark (I understand why), but did not put the Progress % back? @proper meteor

[proper meteor]

So the view on that page, which is our roadmap page now shows the updated path. If you go into the paths view, you should be able to see the older path now called 'legacy', and your completions and check marks should be the same on that.

[tropic flower]

yes I'm referring to the updated path there's no % listed

I should obviously be seeing some progress

[proper meteor]

Ah, now I understand. That's strange. You had previously completed the SOC L1 path. It did previously show a tick, but now on the updated path, it's not showing anything even though you have lots of room complete. I'll go checking, thanks for reporting it. I wonder if it's something that it doesn't see you registered on that path anymore, so it thinks you've never joined it?

[hazy kettle]

Gave +1 Rep to @tropic flower (current: #2131 - 2)

[tropic flower]

I've never joined Web Fundamentals, Web Aplication Pentesting, Red Teaming, SOC Level 2, or Advanced Endpoint... yet they have %'s

I imagine I don't have a % next to AWS is becuase even the free ourses are locked behind an additional paywall so I've not completed any rooms that would count towards it

[proper meteor]

Makes sense. It will probably be tomorrow before we get to look at what is happening.

[tropic flower]

Thank you, haven't noticed anything else wonky yet.

[silver juniper]

I was wondering what happened. 88% finished with the old path I guess I'll finish it up and then finish the new one right after

[tropic flower]

I might do that as well, re-earn my old certificate, then burn the new version. I noted a number of the newer courses reflect in both legacy and new, so you should be making progress in both doing either. It also looks like a number of legacy courses that are in the new path, had slight adjustments as I had completed all these rooms before but now show as 97% or 99% done. May not take long or much effort to re-knock it out anyway.

lol in the image above one such lists as 78% done that's almost a quarter....

[true sphinx]

just hopped into this revamped path, you guys doing great job! already 20% progress and i feel like this is more into soc level 1 job. i like it! will put more feedback after finish this path

[native viper]

I think I prefer the old one because I'm looking to get into DF & IR and the legacy path covered it to some extent. I believe this modification was done with our best interests in mind nevertheless

[static widget]

What are some of the rooms you will suggest from legacy path which can be a valuable add on after completing the new path as a jr analyst or soc 1

[native viper]

For me there's a disadvantage because @proper meteor mentioned that it will be out next year so you may not have access to those rooms anymore

[static widget]

Actually you can , i just tried out and we can access the old path and rooms

[native viper]

I meant by next year, It's just about 2 months away

[tropic flower]

I wouldn't expect rooms to disappear, they in fact appear to have added content to several of the older rooms, moved some content around, and even modified text in at least one older room where you could only provide the "No answer needed" click after turning on the VM, then reset said button. You just aren't going to have the legacy path to use a guide to hunt those rooms down after then.

[tropic flower]

Looks to be working for me at the moment, not sure if it's because I toggled between it and the legacy version several times or not, but I can confirm that enrolling in the path the first three times did not make that pop up.

[fast prairie]

The dropped rooms and modules will still be accessible after the old path is retired, so you can still find them on the platform. Over time, we will keep the DFIR content while also creating new materials or reorganizing the existing rooms into more focused paths, similar to what was done for Advanced Endpoint Investigations.

[proper meteor]

Ah, good, let me let the dev team know. They might also have been making changes, but I didn't hear.

[shut cedar]

hi having issue with SOC L1 Alert Reporting task 4

THM{nice_attempt_faking_microsoft_support} should be answer but in the box it looks like this THM{nice_att_empt_fakin_g_mi_croso_ft_su}

not sure if Im stupid or the input box is setup wrong

[floral current]

I am also having trouble in SOC L1 reporting task 4. I tried escalating to L2 for the flag and it’s not working

[shut cedar]

im skipping this ill come back later

[mental dawn]

I'm enjoying the updated learning path so far.

[misty mauve]

@floral current when you escalate the status should be in progress and not closed

[silver oxide]

Hi im having an issue with one of the task from the new path it never happen before and even the Echo IA agree with my answer idk where to escalte this issue. Also idk why i cant paste an image of it so the room is "SOC Metrics and Objectives" on task 3 "triage Metrics" the second question Imagine a scenario where an employee was lured into running data stealer malware.

1. The SOC team received the "Connection to Redline Stealer C2" alert after 12 minutes.
2. One of the L1 analysts on shift moved the alert to In Progress 10 minutes later.
3. After 6 minutes, the alert was escalated to L2, who spent 35 minutes cleaning the malware.
   Provide the MTTD, MTTA, and MTTR via comma as your answer (e.g. 10,20,30).
   My answer was 12,22,63 and idk if im wrong or not cause even the Echo bot agrees with my aswers. Hope someone can help with it 😄

[misty mauve]

@silver oxide yes your answer is wrong. What helped me get the right answer was looking at the picture that had the time lines for MTTD , MTTA, MTTR drawn out

[wet sedge]

Me too! It's goes deeper into the weeds of what I imagine is day-to-day work, which i love

[wet sedge]

i'm stuck on this question as well. the authenticity score would not update (stayed at 0%) no matter how much i submitted to the ticket. can't get the flag.

[true sphinx]

I'm stuck on this too, if "THM{nice_attempt_faking_microsoft_support}" is the answer on task 4, then i confused with task 3 which is completed with last answer is "THM{nice_attempt_faking_microsoft_support}" too!

[native viper]

To paste an image, you need to verify your account.
Go to Your profile -> Manage Account -> Scroll down to see your discord token.
Copy your token then come back her to use the /verifycommand to authenticate

[silver oxide]

Ty guys for the replys 😄

[raven pawn]

do some one know why i cant luch the phising simulatyor ?

and im in us east

[native viper]

change your region under Manage Account

[proper meteor]

I think that was and platform issue and fixed now. Can you test?

[mental dawn]

Yep. Seems spot on so farfor what I deal with.

[wet sedge]

yay! glad to hear that.

[frail hull]

Fill out the verdict and status properly

[frail hull]

Not inputing the right wording I discovered that when I wrote the names of the failed tests it jumped up the authenticity

[proper meteor]

Do you think there is some tuning or changes needed to help future learners?

[atomic pendant]

Guys do you feel that some of the rooms in the soc 1 (old) have missing logs ?

[atomic pendant]

?

[fallow ferry]

soc simulator Phishing Unfolding. work fine, then saved progress, next day resume all pages work but the alert page show the above error.

[vagrant ledge]

Which one? Can you point to the rooms for us to check?

[vague cave]

Am I allowed to post a screenshot of said SOC1 scenario and ask to explain why the numbers 12,10,51 and how do you actually calculate the given time from triage metrics in the example given?

[atomic pendant]

check the Rooms : "windows event logs " and "wazuh " they have missing logs i cant paste screenshot for the page but try wazuh task 4 question 4 there are no logs for that
FYI i have change the dates from 15 minutes (default) to last 15 years

ohh cant share the screenshot lol

[tribal eagle]

Okay I'm feeling kinda dumb. I'm doing the Intro to Phishing Soc Simulator but the AI says my reports aren't detailed enough. Is there like a list of everything we are suppose to include to make it more detailed. I don't know if I missed something or what.

[rugged seal]

In snapped phishing line room, I can't get the url for Zoe Duncan correctly for some reason. I copy paste the url into cyber chef and it is not correct?

[fallow ferry]

it need to be on defanged format

[rugged seal]

I found out that I need to open the html file and take that url and defang it

turns out for some reason the link worked when I restart the machine

at first it was giving me an error and I took that initial link and defang it

but I restart the machine and the link worked and yeah

[fallow ferry]

I had that same issue, AI keep saying incomplete, I think AI look for full report including for example "credential theft or malware compromise" I am not sure from the logs we can have this info, we can check on Firewall if user clicked the link or not (which need to be included on the report)

[fallow ferry]

I think if you verify your account in discord you can share screenshot

[fallow ferry]

which room is this?

[rugged seal]

I know this room, look at the graph again and you see there are 3 metrics: MTTD, MTTA, MTTR.
The MTTR is sum of the time for SOC team to clean everything up after the alert came. Look at the graph here, MTTR = MTTA (L1 to work on the alert and escalate if needed) + time for L2 to clean up (internal processes).

[atomic pendant]

Its verified 😭😭

[rugged seal]

@vague cave I hope this makes sense

I also struggled a bit but I read it again and it makes sense

[atomic pendant]

And please someone can check and let me know if you are facing the same issue 😭😭

[vague cave]

Thank you

[hazy kettle]

Gave +1 Rep to @rugged seal (current: #3252 - 1)

[median arrow]

Hello everyone, let me ask you, are there many jobs in soc in your country currently recruiting, and which companies will prioritize soc? I am currently in Vietnam and soc jobs in Vietnam are quite diverse but they will not prioritize interns much.

[ocean rapids]

.

[eager crown]

Is it me or the Splunk:Exploring SPL room is a bit wonky atm? None of the searches for Task 4 are working.

[atomic pendant]

I have been asking same stuff from the past 1 week it happened with me on 2 different rooms and now it the splunk 😭😭

[eager crown]

Sometimes, they fix the bug without noticing us, so it's worth going back to those rooms that you have issues with to check if it's fixed. It happened to me in the MITRE and Phishing tool room. I still have the Windows log events and Sysmon room to go back to. If they haven't fixed whatever is wrong with it, I'll just move to different rooms. I still have so many unfinished/ not started rooms to go through.

[rugged seal]

I also want to know about this

[rugged seal]

I agree, things have been a bit wonky recently

[vale saffron]

Hey guys, i'm actually at 50% of the Soc L1 path, feel free to text me to study/train together or stay in touch for help, working sessions or whatever !

[rugged seal]

hey there so am I 🙂

[vale saffron]

Lets go i texted you

[dim juniper]

@vale saffron hey i am new in the this field and want to learn .
Want help for where to start

[native viper]

start from the pre-security path

[vast stone]

Not sure whether I'm being an idiot, but the firewall logs in sentinel for the Soc simulator don't seem to... contain any useful info? All I'm being provided is the time it was generated and the datasource, there's no way to tell what the log is

[vague cave]

I had the same problem too. I just restarted it and tried again, it worked after that

@rugged seal the answer to the question in the SOC Triage Metrics room still doesn't make any sense to me. Why would it be 51 instead of 63?

[latent nebula]

Let's say the incident happened at 10 am but SOC received the alert 12 mins after the incident happened which will be 10.12 am.

Remember, SOC L1 received the alert at 10.12 am (and from here MTTR counting starts).
After 10 mins, i.e. at 10.22 am SOC L1 analyst moved the alert to 'In progress'.
After 6 mins, i.e. at 10.28 am alert is escalated to SOC L2 analyst.
After 35 mins, i.e. at 11.03 am, SOC L2 finished his work.

So, MTTR is from 10.12 am to 11.03 am which is 51mins.

[vague cave]

Thank you so much for explaining

[hazy kettle]

Gave +1 Rep to @latent nebula (current: #3252 - 1)

[digital pier]

is this talking about mean time to repair?

[vague cave]

Yeah sounds like it. but I have to argue that it is wrong because the MTTD, MTTA and MTTR is actually 63 minutes, not 51. I just spoke to an experienced SOC friend who has been in the field for 8 / 9 years now and he has explained to me it should be from the start to the end - fire started to fire extinguished as an example used by him.

Lol he just corrected himself and said if THM is going on the NIST scale, it's correct

[digital pier]

so 51 is correct?

[vague cave]

Yes

[digital pier]

and what's the NIST scale?

[vague cave]

let me find it for you

[digital pier]

thx

[digital pier]

Thanks so much

this helps a lot

[vague cave]

You're welcome

@digital pier I love your bio, it's funny

[digital pier]

Thanks inspired by my friend

[vagrant ledge]

That's my room - I will look into this and get back to you.

[vagrant ledge]

Noted - will look into this as well.

[eager crown]

Thanks Dex!!!

[hazy kettle]

Gave +1 Rep to @vagrant ledge (current: #101 - 88)

[vast stone]

Anyone? Doing a take 10 of the table there are no columns with any information beyond when the log was generated and the source (i.e. firewall) for the firewall logs in sentinel

Seemingly everyone else is doing it in Splunk so maybe I'm better off just switching over

[fallow ferry]

you better off try splunk or elastics, I did also tried Sentinel, did not work for me, logs, permission etc. I gave up on it

[vast stone]

Yeah that figures, at least I know it's not just me being thick. Cheers!

[sleek torrent]

should i post every room that i completed in thm on linkedin or would that be too much?

[forest horizon]

Hi. Quick question, I'm trying to complete the updated SOC Analyst L1 path. Done everything except the File and Hash Threat Intel room. Managed todo everything but the only thing holding me back is the question "When was the first time the file was recorded in the wild? (Answer Format: YYYY-MM-DD HH:MM:SS UTC)" whenever I input the the right answer, it keeps saying "Uh-oh! The answer you provided may not be in English. Please review it and try again". Any ideas?

[tropic flower]

You do you, whatever you want, your situation may be different as well, as in if THM is your only IT experience at all, that would make sense to advertise your experience, where as others have 10+ years expe, degrees, and certifications (not competion certificates), then they very likely won't casue they don't need to.

[forest horizon]

Any suggestions?

[forest horizon]

Hi. Quick question, I'm trying to complete the updated SOC Analyst L1 path. Done everything except the File and Hash Threat Intel room. Managed todo everything but the only thing holding me back is the question "When was the first time the file was recorded in the wild? (Answer Format: YYYY-MM-DD HH:MM:SS UTC)" whenever I input the the right answer, it keeps saying "Uh-oh! The answer you provided may not be in English. Please review it and try again". Any ideas?

[tropic flower]

I'd say you don't have the right answer and need to keep working it. I haven't done the "updated" path yet, I just refinished the "Legacy" version updates, gonna have to ask someone that's looked/done it. Not sure when I'm logging in to work on the path yet.

[forest horizon]

Thanks.

[hazy kettle]

Gave +1 Rep to @tropic flower (current: #1607 - 3)

[forest horizon]

Has anyone done the updated SOC Analyst L1 path?

[misty mauve]

I did not have an issue with that one but the question for the threat label used to identify the malicious file seems to be outdated. Virus total gives a different answer than what it is actually looking for

[forest horizon]

So essentially the answer I thought was wrong.

[fallow ferry]

Hi, I did tested the room again, virus total show the correct answer > Details > First Seen In The Wild

[forest horizon]

Thanks. I'll give it a try. Also I've been watching your videos on some of the other tasks. They're really informative.

[hazy kettle]

Gave +1 Rep to @fallow ferry (current: #113 - 83)

[sleek torrent]

got it thanks

[hazy kettle]

Gave +1 Rep to @tropic flower (current: #1289 - 4)

[vale saffron]

Hello blue team, starting my day with the Network Security Chapter ! Good luck to everyone

[runic coral]

Has Yara been removed from the new updated soc level 1 pathway?

[native viper]

Yeah. I’m glad I did it in the old path though

[runic coral]

is yara outdated then? as in not really in use much. I also completed it in the old path

[forest horizon]

Do you mean first submission?

[fallow ferry]

you said you have issue with First seen in the wild?

[forest horizon]

Yes. Whenever I input the timestamp it comes up as an error. I thought you meant the First submission.

I've done everything else in that room barring that error.

[fallow ferry]

what exactly the question you having issue with? can you copy and paste the question here

[forest horizon]

When was the first time the file was recorded in the wild? (Answer Format: YYYY-MM-DD HH:MM:SS UTC).

Whenever I input the timestamp it keeps coming up as an error.

Error: Uh-oh! The answer you provided may not be in English. Please review it and try again.

[fallow ferry]

which task number the question is?

[forest horizon]

Task 5, Q3

[fallow ferry]

which one these you are using

[forest horizon]

First Submission. There was no First Seen In the Wild when I went onto VirusTotal.

[fallow ferry]

above is from VirusTotal under Details tab

[forest horizon]

I'm on there, but I don't see "First Seen In The Wild". There's 4 instead of 5.

Found it now. I was using the wrong hash.

Done it.

[vale saffron]

I'm doing the Data Exfiltration Monitoring, such a great room

[vagrant ledge]

Happy to know you liked it. ❤️

[vale saffron]

Thank you for your work @vagrant ledge
Very hands-on and immersive, but I'll have to review it and take notes so I don't forget anything !

[hazy kettle]

Gave +1 Rep to @vagrant ledge (current: #100 - 89)

[vale saffron]

2 little questions if you don't mind

In Task 6 (Data Exfil via HTTP), you mention the beaconing method, why "followed by large uploads" ? if sending by small request to be low and slow why changing and suddently sending large chunks ?

---

And second question how can i see/export the data text ASCII out of that view ? hard to read + can't copy from here but i didn't find any other place where it's displayed

[swift bay]

Wait, the legendary @fallow ferry is on here??? Your videos have gotten me unstuck from countless binds. Thank you for doing what you do!

[hazy kettle]

Gave +1 Rep to @fallow ferry (current: #111 - 84)

[pale dirge]

Guys did anyone used sentinel in introduction to phishing ?

seems like its completly useless

[proper meteor]

Is it not working? 👀

[swift bay]

Try the "...as C String" option in that right-click menu. I think that's what I did.

[pale dirge]

seems like u can only see the UI without any logs only after selecting one of the other two (splunk/ELK) u can view anything useful

[vale saffron]

Thank you i will try that

[hazy kettle]

Gave +1 Rep to @swift bay (current: #622 - 11)

[swift bay]

Somebody says "es-oh-see" instead of "sock", lol

[obsidian prism]

is SOC simulator only for business?

[vague cave]

I have a problem here that needs clarification. Will post screenshots with spoiler tag. Why does it ask for 2 IP's defanged but it's the same IP repeated and I found a 3rd, why was this not counted in the Phishing Analysis Tools room? Really gave me a hard time copying and pasting which meant that I needed to manually add everything instead.

Spoilered screenshots.

[vale saffron]

Which room / task ?

[vague cave]

I wrote it in there

[vale saffron]

I don't understand your question tbh

You went on the text report right ?

In Network activities you see all the connections done by the malware, with a reputation tag for each

in the list there is 2 with "Malicious" tags (the second one apears two times because he's call by 2 differents PID but the IP/domain is the same)

Use cyberchef to defange them and let's go ? or i'm missing smthng

[vale saffron]

Hello everybody

It looks like the file names in picture and i the explainations about line 2 and 3 are not matching no ? Room Living Off The Land Attack Task4

[iron drum]

Uh i took a break and now i am back i see soc level 1 legacy path i have done it 70% and new one 31% so should i complete the legacy or switch to new one?

[hasty gazelle]

Why the Skills Matrix is now empty? It does not show progress in any of the six areas of the Entry Foundational level.

[vale saffron]

Same, i get stopped at 98% ahah

[fast prairie]

Hey, the platform team is aware of the issue, should be addressed this or next week.

[fast prairie]

Thanks! Should be fixed now

[hazy kettle]

Gave +1 Rep to @vale saffron (current: #3262 - 1)

[vale saffron]

nice thanks

[vale saffron]

File And Hash Threat Intel room, Task 4:
Which other process was spawned according to the process tree?

I found the answer on a walkthrough, I still don't get in on hybrid-analysis.com

(https://hybrid-analysis.com/sample/2672b6688d7b32a90f9153d2ff607d6801e6cbde61f509ed36d0450745998d58/690730dafbc9f27cfb0c2277)

[swift bay]

Yeah, I noticed that the other day too. Answers that are from external resources like that or Virus Total tend to change.

[native viper]

after losing streaks multiple times I finally hit this milestone

[vale saffron]

Nice congrats !

[native viper]

Thx!

[obsidian prism]

can anyone help me with this? i'm doing Elastic ELK room, it gives me 502 Bad gateway when i try to visit the ELK Instance...

[pale dirge]

ELK room after splunk room ?

[native viper]

Are you using the thm vpn?

[obsidian prism]

yah

[obsidian prism]

of course, im using it

and the configuration file is the newest

[native viper]

I suggest you terminate the machine, refresh the thm page, and restart the attached machine

[pale dirge]

this ELK room ?

[obsidian prism]

here, it's true

i mean exactly

[pale dirge]

it's not working after upddate

When I was trying to do it few days ago it didn't have any logs

[native viper]

It does, i completed it yesterday

[pale dirge]

really ?

ok so I have to go back to it

[obsidian prism]

oh wait, it's working now, but not a few minutes ago

thanks all

[vale saffron]

Hello,

IP And Domain Threat Intel (Task 4)
Using search.censys.io, identify the TLS certificate fingerprint for the IP address.

Need an update I guess, answer changed on censys.

[lyric oasis]

gj I am going for that one myself, only 6 days off and I have 5 streak freezes so I will get it for sure

[calm comet]

Curious to know what you guys ended up doing. The new version seems to focus a lot more on methodology instead of specific tooling like the legacy one. Debating on just finishing the legacy one since I was at 78% and shot down to 40% on the new one.

[rugged seal]

I'm in the snort room and I made rule in the local.config files

why did this happen?

[calm comet]

Can you show the rule you added to the local.conf file?

[calm comet]

Im looking at my notes from that room, on my end I have a semi colon at the end of the sid, as well as a "rev:1;" that follows the SID. That seemed to have got me by

It also looks like I was running Snort with sudo privileges which might help

[calm comet]

If I had to pick anything I listed above, it would be that you are missing the ";" that is supposed to follow the SID. I dont think the rev or sudo privs are a necessity.

[rugged seal]

I rewrite the rules again

[calm comet]

Same error?

[rugged seal]

yep

[calm comet]

Oh you are also missing a ":" in front of the first SID

You have sid100001 is should be sid:1000001

[rugged seal]

ayyyyy

it ran

thank you :DDD

my dumbass forgot the ":"

[calm comet]

Niceeeee

[rugged seal]

I have been struggling with this for so long

[calm comet]

Yeah I remember I kept forgetting colons and semi colons during the Snort rooms. It can be a pain but its pretty rewarding once you get through all of the tasks.

[wet sedge]

75% through this learning path. And on day 73 on THM! It’s exciting to see these concepts becoming clearer and sharper in my mind.

[nova roost]

What's snort room??? 🤧

[vale saffron]

Hello Brozer, i figured out that the legacy path was still available so i finished it and now i'm finishing the new one, I love the actual one, seems more accurate with actual job needings instead of the old ones with precises tools ike you said

[visual rune]

Does anybody know the answer to this and how to find out spl query for this question. How many log events are captured by the user Maleena? @lost kernel

[calm comet]

The one in the SOC L1 path

[calm comet]

Ahhh okay makes sense, I'll probably end up doing the same

[rugged seal]

can I see a screenshot?

does anyone struggle to run splunk in the attack box?

[hushed goblet]

The task has been updated. hopefully it will allow you to complete the room

[hushed goblet]

You can verify with the current report in the task

[teal wadi]

One message removed from a suspended account.

[pale dirge]

can u give link to the room

[teal wadi]

One message removed from a suspended account.

[pale dirge]

THM{nice_attempt_faking_microsoft_support}

[teal wadi]

One message removed from a suspended account.

One message removed from a suspended account.

[pale dirge]

this is flag from the next task

I mean 4

[teal wadi]

One message removed from a suspended account.

[pale dirge]

are u in good task for sure ?

[teal wadi]

One message removed from a suspended account.

[pale dirge]

this one

[teal wadi]

One message removed from a suspended account.

[pale dirge]

np

[calm comet]

Do you guys do practice labs outside of the learning tracks? If so, how do you guys know which practice labs you would be able to do and what not?

[half mica]

Hello!
I am scoping out courses to obtain my CYSA+ certification. I've seen SOC Level1 path is useful for hands-on training. How much material does this path contain to be ready for the CYSA+ exam?

[calm comet]

I recently took and passed the CYSA exam. This path is kinda overkill for that certification, for my exam i was mainly just choosing best case scenarios, looking at SIEM logs, and evaluating CVSS reports.

[obsidian prism]

can someone help me?

i am doing https://tryhackme.com/room/summit

can't connect to the server

i am using vpn and doing exactly what the challenge guides me

server not found is the reponse i got

[deft chasm]

have you tried different vpn servers?

[obsidian prism]

how can i try different, i only have 1 config file for premium account

[supple ridge]

Hello TryHackMe team / moderators,
I am having an issue with the "IP and Domain Threat Intel" room, Task 4.
The SHA256 TLS certificate fingerprint for the IP 85.188.1.133, taken from Censys, is:
5ea8e6046bdabaa8e23a1a012c01d1be5ccd42c66ef2577a59f3b3f0f056d12e
However, TryHackMe keeps rejecting it with the message:
"The answer you provided may not be in English."
I tried typing it manually, ensuring no spaces or extra characters, but it still fails.
Could you please check and fix this task?
Thank you very much!

[ivory geode]

i am having same issue

[vivid lantern]

Windows Threat Detection 1 and 3 target machines are not usable...they're on a constant loop of logging in and out - gets you in for a few seconds, then reverts to the "applying settings" blue screen and so on...that's from the browser, through VPN and RDP it just kicks you out, and same thing you can connect back where you were at, only to get kicked out again...anybody else came accross something like this and figured out what the issue is? Tried them from 2 separate machines, 1 linux and 1 windows, with the same result...

[wet sedge]

i encountered the same issue. i thought it might be some sort of issue on my end.

[vivid lantern]

Must be something on their end then...especially since I had no issues with the 2nd challenge...connected just fine through both methods.

[sleek dove]

Mondaymonitor room givem VM doesnt work with the given rev proxy url. it works if i use http://<ip>.. room suggests https:// annd rev proxy url.. the other issue is room suggests i run a saved query in wazuh but that saved query doesnt return a result even after i change the time frames

[rugged seal]

I'm in windows threat detection 2 and experience the same issue

[rugged seal]

I think they are having issues with their servers again

[ivory geode]

it works if u put the handshake from previous exercise IP: 69.197.185.26

[supple ridge]

Thanks, you’re right

[magic fulcrum]

Hi everyone. Is anyone else having trouble with the ItsyBitsy room? I can't access Kibana, and I've been trying for a while now.

[flat scarab]

hi everyone IP and Domain Threat Intel room have a problem in task 4, third question the fingerprint is out-dated. needs to be updated

[eager crown]

I'm in the Malware Introductory room and having the same issue. It seems that all the Windows instances are acting up.

[wind cobalt]

Splunk101 room has outdated VPN_Logs file (also named differently + file on attackbox and direct download are different), can't complete the lesson. Introduction to EDR earlier in the path also is having issues where the "open site" is missing information needed to give an answer.

Anyone else experiencing this?

[slim rain]

Hey folks! If anyone can tell me why I cant get the right answer in Alert Triage With Splunk > Task 2 > Question 2 that would be great! It is a single digit number and I have legitimately tried every number. Anyone else dealing with this too?

[chilly bolt]

Hello TryHackMe team / moderators,
I am having an issue with the "IP and Domain Threat Intel" room, Task 4.
The SHA256 TLS certificate fingerprint for the IP 85.188.1.133, taken from Censys, is:
5ea8e6046bdabaa8e23a1a012c01d1be5ccd42c66ef2577a59f3b3f0f056d12e
However, TryHackMe keeps rejecting it with the message:
"The answer you provided may not be in English."
I tried typing it manually, ensuring no spaces or extra characters, but it still fails.
Could you please check and fix this task?
Thank you very much!

[toxic dove]

Hi @chilly bolt Thank you for relaying this info. We appreciate the feedback and are sorry for the inconvenience. We will look into this issue right away.

[hazy kettle]

Gave +1 Rep to @chilly bolt (current: #3292 - 1)

[chilly bolt]

Thank you. I alredy took the black Friday annual membership today.

[hazy kettle]

Gave +1 Rep to @toxic dove (current: #453 - 16)

[toxic dove]

We have fixed the issue with the question in Task 4. Thank you again for sharing the feedback. Only this way we can keep on improving👏

[hazy kettle]

Gave +1 Rep to @chilly bolt (current: #2158 - 2)

[chilly bolt]

Now it's working. Thanks a lot.

[hazy kettle]

Gave +1 Rep to @toxic dove (current: #435 - 17)

[raven pawn]

Detecting Web DDoS room , for some reason on the attached vm the Splunk instance its not working and its necessary for answer the question on task 5.....

[fast prairie]

Hey, thanks for your report! Couldn't reproduce it, but does sudo /opt/splunk/bin/splunk restart from the VM terminal fix the issue for you?

[hazy kettle]

Gave +1 Rep to @raven pawn (current: #3294 - 1)

[raven pawn]

i will try it thanks

[hazy kettle]

Gave +1 Rep to @fast prairie (current: #501 - 14)

[hushed goblet]

Having a look at this for what the issue could be.

[vale saffron]

SOC Level 1 donnnnne

hehehe what is the next move

[gritty vapor]

Please my VMware isn’t connecting and this is delaying me very frustrating . Splunk ain’t opening elastic same

[scenic turtle]

Hi everyone, I finished some rooms in the soc level 1 path and I want to add thoses in my GitHub portfolio. I’m I allow to create writeups of the rooms, giving information about the questions, answers and some content in the room?

[vale saffron]

Yes of course

Yes of course = Dunno but a lot of people do it so I guess it's ok

[sly quarry]

Why is the answer wrong?

[vale saffron]

It's a recurrent issue, but you found the correct answer.
Now find a walkthrough to get the answer wanted by THM (old one)

[little ivy]

Hello, for "Data Exfiltration Detection" room, specifically Task 4, the answer of "Which local IP sent the maximum number of suspicious requests?" is not 192.168.1.104 but ||192.168.1.103|| somehow, even though .104 sends more requests. Is there something I have missed perhaps?

[vagrant ledge]

Hello - Consider narrowing down on the suspicious domain first and then look at the source IPs initiating those suspicious DNS requests. Let me know if it's still not clear

[little ivy]

Omg I'm stupid😅 Yeah, "where len(query) > 30" worked alot better. Thanks for the help!!

[hazy kettle]

Gave +1 Rep to @vagrant ledge (current: #99 - 90)

[hasty quest]

Finally got to Windows Threat Detection 1 room. Btw there's a typo in the question, it asks to run www.zoom.com file. However there's www.skype.com file which may be confusing to users

https://tryhackme.com/room/windowsthreatdetection1

Room link

Also, thank you for the incredible remake!

[trail epoch]

if someone morrocan here

[fast prairie]

Hey, glad you enjoyed the remake! Nice catch, fixed, thanks 🙂

[hazy kettle]

Gave +1 Rep to @hasty quest (current: #586 - 12)

[wet sedge]

I’d recommend contacting THM directly and confirming with them.

[tardy spoke]

Hello, how is it possible to complete the SOC path if some of the module requires B2B?. I have a premium though. Thank you!

[hollow temple]

Hello,
In the SOAR room in Task 4, shouldn't be "Contains URLs or attachments" instead of "Contains URLs of attachments" inside the playbook image example?

[frail hull]

It’s cuz it’s asking for the other ip tls had the same issue

[cyan spoke]

Guys, do y’all think learning programming/coding is important for cybersecurity?

[noble plaza]

How long did it take you?

[maiden pebble]

Basics

Do basics and have an idea what's going on in the program

[dim island]

Anybody in here from the Pittsburgh area?

[worn brook]

Is there anyone from Bulgaria ?

[kindred veldt]

Good evening! I'm working on tasks in a Windows security monitoring room, and the Windows virtual machine in each room is very unstable. It freezes for 10 minutes, directories won't open, and neither restarting the virtual machine nor restarting the room helps. Has anyone else encountered this, or is it just me?

[fast prairie]

Hey, trying to check it from my end, which exact room is it? Windows Threat Detection 1?

[kindred veldt]

Now it's Windows Threat Detection 2, but the first one had similar problems too.

There is also constant reconnection

The internet is definitely stable and no such issues were encountered on machines running Linux VMs

[proper meteor]

I don't know if this is your issue but I saw similar things when I was playing around with my VM region. If I move the region to a location far from where I'm located, things got quite sluggish.

[violet edge]

Need someone to tutor me🥹

[wet sedge]

Just finished the SOC 1!

[calm ermine]

I’m having a problem with the Splunk: The Basics room. I can’t access Splunk because Firefox requires SSL/TLS after entering the machine’s address. Is this Splunk instance running over HTTP? How am I supposed to open it?

[raven pawn]

Windows Threat Detection 2 task 5,,,, the question Which domain does the malware exfiltrate the data to? the script its no generating the dns query alert (event id 22) and its need it for answering the question...........

[pale dirge]

ye I had this problem just a moment ago

I just looked for the answer on youtube, and other guys had sysmon22 in thei events

I think something is wrong whith it

[raven pawn]

yea i had to do the same and that was how i realize the it wasn't working

[mild turret]

guys please who has issues with his/her VM because for a while now can't access any VM

[raw obsidian]

Hi I am currently doing SOC Level 1 :Core SOC Solutions : Splunk: The Basics , I am stuck , I cannot seem to open splunk in the attack box , I started attackbox and opened firefox and entered :http://10.49.178.149:8000: but it just says unable to connect, can anyone help how to start splunk

[ripe anvil]

what is the http error code?

[raw obsidian]

im not sure it just says , "Firefox can't establish a connection to the server at 10.49.178.149:8000." , i am just trying to open splunk and the chatbot told me to open firefox in attackbox and type in ":http://10.49.178.149:8000/" and it should open splunk

[ripe anvil]

okay. give the target machine time to load up

splunk instances usually take 5-7mins to load up

[raw obsidian]

yeah i've been trying for past 2 hours , is there no icon in attack box to access splunk or thats right way via the firefox browser and typing in ":http://10.49.178.149:8000/"

[ripe anvil]

what is the ip of your attack box instance?

also there is some issue with instances today, where multiple people aren't able to access them properly. might be worth taking a break

I took some time off and went back to the instances after issues with my rooms

[raw obsidian]

this is my attack box ip 10.49.105.89

it just says unable to connect, alright i will give it a try after some hours, thanks

[raw obsidian]

ok sorry, where do i look for the target machine IP? the chatbot says its on top of the attackbox screen but that only shows the attackbox ip and not the target box ip

[chilly bolt]

Someone doing the exercise Tempest Incident?

my mind go to explod

[little ivy]

Yeah... It took my dumb ass 10+ hours to complete

[chilly bolt]

Really mate, I'm doing like 2 or 3 exercises by hour. I don't know if I'm stupid or the questions are difficult to find the answer.

[tropic dragon]

Do you reset SOC 1? I have practicing 100% path but now see 50% path. 💯

[astral cedar]

It was refreshed and rereleased about a month ago 🙂 #announcements message

[high marsh]

My Analyst VM is lagging, it flickers black then wallpaper then black

[tropic dragon]

Thank you so much! I missed information!

[hazy kettle]

Gave +1 Rep to @astral cedar (current: #143 - 67)

[high marsh]

How to fix

[high marsh]

changed my browsers, it works now.

[turbid robin]

Are all SOC simulation behind the thm business service or subscription?

[raven pawn]

i think its just for business bcs i have the premium sub and i don't have access to most of the simulation on the soc level 1 path

[turbid robin]

I also have premium subscription. Too bad tho.

[native viper]

Guys I hit a snag here, I'm trying to answer this question but it seems I'm missing something

I used the wireshark filter: tls.handshake.extensions_server_name == "accounts.google.com"

I only got one result. but it seems the answer is meant to be a 2 digit number

[native viper]

Oh I got it, they are asking for the frame number not the number of the packet hehe

[green ether]

Hello - I'm doing the SOC L1 Path - just saying.
If someone fell a need to voice-chat I am open to talk.

[green ether]

catch me then

[chilly bolt]

Hello, this exercise from SOC1, Boogeyman 3, is not working

[proper meteor]

Hey, what is happening in the exercise?

[idle bone]

Hello, i got a little problem
The second question in task 6 of the unified kill chain room, i answered it correctly but it's still having a space remaining and I'm pretty sure i typed the correct the answer

[proper meteor]

This is the question about Mimikatz, so worth checking how MITRE talks about the objective of this tool - https://attack.mitre.org/software/S0002/

[idle bone]

The answer is actually CREDENTIAL ACCESS, but it's giving anoda space again (ACCESS_)

[proper meteor]

That's not the answer I got. Credential Access is the MITRE Tactic name but the question asked is

"Considering the usual capabilities and purpose of Mimikatz, what is the primary objective of this tool in such an attack scenario?"

You might even get this right without thinking of MITRE but the answer is also found on https://attack.mitre.org/software/S0002/

[proper meteor]

I was talking with one of the teams on this and we think the question could be worded better. As you have found the question, wording, and actual answer, it's open to an element of interpretation. We'll review the question and may reword it.

[chilly bolt]

sorry, i didnt see the attack box, sorry guys

[lime raft]

HELP

What is the netstat parameter in MS Windows that displays the executable associated with each active connection and listening port?

[green ether]

Check manual
https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat

[raven pawn]

on the room File and Hash Threat Intel task 3 question number 2 need to be updated virus total its already showing a different treat label to what ever the question is ....

i googole and it used to be this the answer trojan.graftor/flystudio

[proper meteor]

Thanks for highlighting. Will ask the team to fix it.

[hazy kettle]

Gave +1 Rep to @raven pawn (current: #2230 - 2)

[heady dawn]

In room ip and domain threat intel question 4 part 3 , its asking for the tls fingerprint from censys.io , I have answered every other question but its not accepting the one I have found is there something I am missing.

[heady dawn]

Anyone ?

[proper meteor]

If you check the question it points you to use the hint. The question itself says the information has changed. There's one or two things in this room where at the time we created it, they were accurate but they've changed since. We need to go back and probably do an update on it but for now if you check out the hint.

[heady dawn]

I have checked the hint and it gives a answer but that doesn’t work either

[proper meteor]

Okay just gonna test now

[heady dawn]

Thanks

[hazy kettle]

Gave +1 Rep to @proper meteor (current: #314 - 29)

[proper meteor]

Just tested there and it accepted the answer in the hint(ending in d12e). Could be something to do with the quotes? The accepted answer doesn't need them?

[heady dawn]

Ok will try it again thanks

[hazy kettle]

Gave +1 Rep to @proper meteor (current: #309 - 30)

[cyan brook]

Hello, I have a question about SOC Level 1. I was taking the path until I came across SOC Simulator: Upload and Conquer, which is a B2B SOC simulator. To obtain the path certificate, do I also need to complete this activity?

[raven pawn]

is there away the we can have access to the simulator whit out having a business plan ?

room IP and Domain Threat Intel on soc level 1 patch,,,, task#3 question 1 it need to be updated or correct the correct answered don't match whit what you find on the website .......

[quasi bough]

There are a few simulations available to premium users like Phishing Unfolding

[raven pawn]

yea I know that , i mean having access to the rest

[surreal osprey]

I was in the SOC Level 1 Learning path and working on the Phishing Prevention room in the Phishing Analysis module and saw that something is not quite right. Its in the Task 5 about the S/MIME and it says about the public key cryptography in a opposite way.

[chilly bolt]

Hello, I finished my SOC 1 path, and when I click View Certificate nothing happens.
it goes to this page https://tryhackme.com/not-found

[quasi bough]

Unfortunately , other scenarios are availabe only for business users at the moment 🙁

[proper meteor]

Hey, I just checked the IP on client.rdap.org now and it seems to be still correct?

[proper meteor]

Is this still happening, if so could you log a ticket with our support team and they can look at it? Just use the bot on our site in the bottom right corner to log it.

[proper meteor]

I think the core issue is the use of the word "decrypt!", "verify" is the correct word in that context. Although looking again I think there's a need to maybe reword more of this for clarity as that paragraph talks both about signatures and encryption. I'll bring it to the team. Apologies.

[proper meteor]

@surreal osprey The team has done an update on the text and added more clarity.

[ancient lark]

Does anyone know which ".json" file is correct for the PS ECLIPSE room? This room is for using Splunk to investigate ransomware activity.

[river fable]

anyone need help?

[balmy bramble]

is SOC level 1 free throughout or do i need premium for some modules ?

[sly vigil]

It's not entirely free

[spare chasm]

should spam emails in SIEM simulators be classed as true positive or false positive?

[narrow gull]

@spare chasm Define your “positive” clearly: What counts as a security incident in your SIEM simulation?

[rose rover]

Hi all, in SOC Metrics and Objectives > Triage Metrics > second question is telling me 12, 22, 41 is wrong. How?

[full berry]

Review the graphic from the previous task on how to calculate the MTTR. Or I should say what other metric is included in the MTTR calculation 😉

[native viper]

I can't remember the exact question but I remember there's a formula for calculation the metrics. At some point you'll be asked to provide an answer in %..

So just look at it carefully again and you'll figure it out

[rose rover]

Got, thanks for the advice.

[hazy kettle]

Gave +1 Rep to @full berry (current: #3486 - 1)

[hexed crow]

Hi,
I’m a SOC Level 1 trainee focusing on Blue Team skills (log analysis, SIEM, incident response).
I’m looking for a beginner-friendly team to learn together and participate in CTFs (Blue/Forensics).
Goal is learning + consistency, not just winning

[rose rover]

thank you

[hazy kettle]

Gave +1 Rep to @native viper (current: #1168 - 5)

[magic elm]

Hello everyone! I have almost completed the SOC Level 1 path, I wanted to ask what is the best way to added what you have done in your resume. Has there been a wording that has brought more success and how do you add the quantitative aspect?

[void rain]

has anyone been able to successfully do the Log Analysis with Siem room successfully? The splunk link never seems to come up. I've tried 3 times over the last few hours (while doing other things)

Error is where I've seen it on other rooms prior to fully spinning up: 502 Bad Gateway

It just never seems to come up

[native viper]

Have you tried refreshing your browser after terminating the machine ?

[void rain]

this has continued after I rebooted the machine, but yeah its not the same browser window between machines

[vocal mesa]

Suppose in 1 - 2 weeks I can begin with the SOC 1 course
Are there a lot of walktrough and/or challenges I can do to get better on the THM platform

[void rain]

you are working through cybersecurity 101 and have done pre-security?

[vocal mesa]

yep

[void rain]

that will be enough for the SOC Level 1 path

[vocal mesa]

am now at the offensive security tooling and have to do some metasploit challenges

[fast prairie]

Hey Zojja, that's a rare Splunk bug without a reliable fix yet. I've tuned the VM to reboot Splunk if the issue occurs, but in general, terminating and relaunching the VM should have been enough. Please let us know if the issue remains after 5-7 minutes of Splunk boot. Thanks 🙂

[hazy kettle]

Gave +1 Rep to @void rain (current: #17 - 589)

[void rain]

it took me about 6 tries, then it finally popped up

[hasty gazelle]

Hi everybody! Happy New Year! I just saw that this link is not working in the 'SOC Level 1' path, specifically at the 'IDS Fundamentals' room. The link that is not working is the one redirecting us to the 'Network Concepts' which is a prerequisite. Here are two snapshots. I hope we all have an excellent and super-productive year, completing an enormous number of rooms in this brand-new 2026.

[hallow mantle]

xin chào tất cả mọi người. chúc mừng năm mới

[void rain]

this might be something you post to #1333993673381253162 but it looks like there is an error in the link, this is the room
https://tryhackme.com/room/networkingconcepts

[river fable]

anyone needs help?

[fast prairie]

Hey, Happy New Year! Thanks, fixed

[hazy kettle]

Gave +1 Rep to @hasty gazelle (current: #3504 - 1)

[pulsar turtle]

Edit: never mind, finally managed to get it to run and not crash. Thank you

[hasty gazelle]

Thanks. It is working properly now.

[hazy kettle]

Gave +1 Rep to @fast prairie (current: #496 - 15)

[hasty quest]

Just a small remark about Living Off the Land Attacks room, there's a typo on deployable machine. Room link - https://tryhackme.com/room/livingoffthelandattacks

[vocal mesa]

With the phishing SoC challenge
Is there a good way I can see the data of the report after I decide that it is false or positive

?

[native viper]

hey guys, in the Web Security Monitoring room under Detecting DDos, we're supposed to do this simulation but it's only available for thm business. Does this mean I won't get the SOC L1 cert even after finishing it? (due to not completing this challenge?

[proper meteor]

Hey, don't worry, the simulations are optional and you don't need to complete them to get your SOC Level 1 path cert.

[proper meteor]

Can you explain this a bit more? By the data do you mean immediately knowning if you were correct or not?

[quaint apex]

Hello guys I am new in SOC I have basic knowledge of the networking SIEM and other things like IDS,IPS and Firewall.
Did anyone have have road map and is their any Qradar version with low storage requirement?

[fast prairie]

Hi! The SOC Level 1 path is a solid starting point, we updated the content a few months back. Also, I wouldn't recommend starting with QRadar as your first SIEM, as it's very admin-heavy. The course uses Splunk and Elastic, which are much easier to experiment with.

[quaint apex]

Okay thank you

[hazy kettle]

Gave +1 Rep to @fast prairie (current: #474 - 16)

[vocal mesa]

How can I make it work that the table uses the filtered data :

[hasty gazelle]

Hi. For info. This link is not working. https://tryhackme.com/room/owasptop102021
It is part of the prerequisites for the room 'Detecting Web Attacks' (https://tryhackme.com/room/detectingwebattacks) in the 'SOC Level 1' path.

[hasty gazelle]

Hi. The question is about the exact month of 'January', it is not about Simon. That is the reason that the answer is not 277. Focus on the time range from 1st January up to 31 January.

[vocal mesa]

Thanks

I made a visual on the date range and then I can filter it on action and got the right answer 🙂

now soar on the menu 🙂

[fast prairie]

Hey, thanks a lot! We recently updated the OWASP rooms to the 2025 version and didn't update the link. Fixed now.

[hazy kettle]

Gave +1 Rep to @hasty gazelle (current: #2276 - 2)

[low niche]

How's it going everyone. I'm relatively new (been in school for a cybersec op bachelor's for 2 years now though). Just started the SOC level 1 section. Its been really good. Wish I had tried out the site sooner really great experience.

Anywho. Yeah I joined the discord because it has been really fun and I just wanted to see the kind of stuff other people have been doing in it lol

[vocal mesa]

@low niche have fun

[vocal mesa]

Why is this answer wrong

[vocal mesa]

no - one ???

[wanton vector]

Did you try refreshing the page?

Sometimes its a bug

[vocal mesa]

yep, tried that several times

[wanton vector]

Did you check writeup?

[vocal mesa]

yep, there is the same answer everywhere

getting crazy, tried yet again and now the answer is right

HTM platform is wierd

@wanton vector thanks for the effort to help me

[hazy kettle]

Gave +1 Rep to @wanton vector (current: #1184 - 5)

[lyric trout]

Hey everyone. Fellow SAL-1 learner here. I'm attempting to see who won the prizes from the AOC2025...more specifically, those SAL1 fee certs. Where can I find that info???

[vocal mesa]

@lyric trout welcome

[proper meteor]

Hey, you should be able to see it here -https://tryhackme.com/adventofcyber25/winners

For those on the SOC L1 path and working towards SAL1 there are some fun things coming this month 🙂

[vocal mesa]

@proper meteor cannot wait

may we have a hint ??

[vocal mesa]

IM stuck at phising-line room question 6
Where I have to find the sha256 sum of the root-kit
and as hint I get use enumeration
But how can I use for example gobuster when there are no wordlists installed on the attackbox ?

[tight sphinx]

Hi, has anyone done the SOC Metrics and objectives module?

I'm stuck at core metrics task 2: FPR rate if only 10 out 0f 50 alerts appear rea threats
According to theory FPR = false positive / total alerts
I entered the answer and it's wrong

[vocal mesa]

How did you calculate the answer ??

@tight sphinx

[tight sphinx]

@vocal mesa sorry forgot to edit the message. Initially my logic was flawed, I skipped a step

[vocal mesa]

NP

happy that you solved it

[tight sphinx]

@vocal mesa Thanks :)

[fathom swan]

Information

Discord Slash Commands

https://support.discord.com/hc/en-us/articles/1500000368501-Slash-Commands-FAQ

Jan 9, 2026, 9:42 AM

Pong!

API Latency

122ms

Client Ping

158ms

Jan 9, 2026, 9:43 AM

[vocal mesa]

Can someone help me figure out how to solve this question

What is the total number of the "TCP Connect" scans?

WireShark : traffic analysis room

[tight sphinx]

I'm pausing soc path because there's an event that starts on 12 and we get tickets on this path. I didn't get that far, hope you figured it out

[full ice]

What have you tried so far?

They say use:

tcp.flags.syn==1 and tcp.flags.ack==0 and tcp.window_size > 1024

I dont quite understand why "tcp.window_size > 1024" is important, it could be to set the limit greater than to every 1024 viewed packet.

[glacial vigil]

I have a problem when working on the course in part 4: Practical: Defend FakeBank when I click view site I can't find the answer, can you help me with the answer?

[quaint apex]

Hello guys,
I am stucked in SOC L1 Alert reporting
The question is
What flag did you receive after correctly escalating the alert from the previous task to L2?
Note:If you correctly escalated the alert earlier,just edit the elart and click "save" again
MY ANSWER IS
THM{nice_attempt_faking_microsoft_support}
But it says incorrect answer I search on internet and medium.com website blog also show this answer.
CAN ANYONE PLEASE HELP ME IN THIS QUESTION

[vocal mesa]

That is also a part I do not understand.
Why is that number 1024 ?

[full ice]

If you get the chance ask echo, echo seems to provides theoretical answers behind some reasoning questions

[vocal mesa]

I did but this do not give a lot of more info :

The filter 'tcp.window_size <= 1024' is used to capture TCP SYN packets with a window size of 1024 bytes or less. This may help identify connections that are potentially limited in bandwidth or resources, which can be indicative of specific network conditions or configurations. It's useful in distinguishing between high-capacity and low-capacity connections during analysis. Make sure to review the task details for more insights.

[full ice]

Ill try to find out, and give you an explanation. I just finished the other Wiresharks room recently

[vocal mesa]

no hurry

[vocal mesa]

pff, the wireshark advanced filtering is hard

[vocal mesa]

may I have a hint on the question in red

[low harbor]

Hey ive seen the mail about SOC L1 getting an upgrade. Im about to start the path. Should i start now or will there be updates that i should wait for?

[native viper]

The update has been done, you can start it now