sal1

[calm bramble]

You might have occasional failures like that when practicing. You need to re-attempt and see if you have the same problem multiple times. It might be a matter of updating something your end, or it might be something to discuss with support

[drowsy pollen]

It happens quite often in simulators, so I see the best option is to discuss with support. Thanks for your help🙏

[drowsy pollen]

Also, what are the topics should I work on again for SAL1 simulator challenges? I worked on Windows Security Monitoring, Phishing and Linux rooms again. What others can I get in the exam?

[tall wigeon]

I have (or am about to) completed the SOC Level 1 learning path in the portal.
How do I know if I am ready for the SAL1 exam? are there some other things that I should do to prepare?

[keen crescent]

Try SOC simulator

[calm bramble]

Click on the link at the top of the page, click the Get Started button and look at the list of Recommended Learning. Have you completed everything in that list?

[bitter trench]

Just finished the learning path myself. Definitely try the SOC Simulators.. it’s an eye opener and the feedback is helpful! I plan to test out for SAL1 in June.

[tall wigeon]

finished the learning path this morning too. I feel like the end of it was quite nice, but there are for sure some parts of the learning path which I didnt pick up so well. Going to try out some soc simulators today, hopped on to do it
I feel like i often need nudges in the rooms so I would look up the writeups but I feel scared that i gave myself a false sense of security in the learning path. Hope the SOC Simulator will wake me up. I guess/ hope the exam is more like the simulator

[bitter trench]

Right, nothing wrong with revisiting sections/rooms to get a firm handle on concepts. I plan to do the same before sitting for the exam. You(We) got this!!

[tall wigeon]

just tried a SOC Simulator, that was cool, definitely will do some more. Lets do this

[bitter trench]

@tall wigeon Good deal!

[tame stag]

thank you!!!!

[clever horizon]

Gave +1 Rep to @keen crescent (current: #1 - 6158)

[coarse marsh]

Hi! I have been going over emails and I found that I have won a 30% voucher off SAL1 -> given the fact that I am not interested in BT and focusing more on Offensive security / Red team, can someone clarify whether I can swap the code with a person who has PT1 ( if any were issued of course ) Thanks 🙂

[peak crown]

You're allowed to swap prizes, you can't sell them though.

[coarse marsh]

Thanks!

[south laurel]

Swap the prize for money 🥸

[flat pebble]

How many months will it take to finish sal 1 certificate???

Im unemployed so I can give 5-7 hours a day

[haughty seal]

Same

[haughty seal]

It depends how quickly you pick up the knowledge, and when you feel ready.

[flat pebble]

Turu

Have you finished sal1?

[haughty seal]

No I haven't

[flat pebble]

Where are you in the learning path?

[haughty seal]

Cybersec101

[flat pebble]

Sameee

[flat pebble]

You wanna be my study buddy?

[haughty seal]

Sure

[dire adder]

Hi! I had problem during exam. The SOC Simulator for the third section of the exam has not started at all (it stuck at 99%). I have tried all steps listed in guide center, however they did not work. Due to that I failed the exam as I could not launch the simulator in two hours. I created the ticket to Support, however I have not received any response so far. Also I tried the email [e-mail]. Is there other way to contact them?

[vague nacelle]

Email is the only way. They answer within days.

[robust niche]

Can you dm me your tryhackme username? i'll have the team take a look.

[silver totem]

hi, im currently learning SAL1, i really need advice for SAL1 reporting, specially for the exam. Many people told me that MITRE ATT&CK techniques should have included in report, my question is how much detail i need to mention for that? For example, in phishing email, i only name as phishing email thorugh malicious link, am i missing any aspect?

[lyric mortar]

@vague nacelle how to know my purchase date & expiry date of sal 1 & pt 1 certificate exam?

Havent take exam

[vague nacelle]

For purchase date check your emails for your receipt.

Expiry is 1 year after purchase

[still reef]

https://www.linkedin.com/posts/security-analyst-level-2-sal2-is-live-ugcPost-7442571166847868928-wpcX?utm_source=social_share_send&utm_medium=ios_app&rcm=ACoAAATGSN4B_dk6YpoLBw310nMPF3MzDB0rJjY&utm_campaign=share_via

[lyric mortar]

I can't find the receipts😓

[vague nacelle]

Well it's ok, it doesn't matter as much as the expiry. Check the expiry on the website. Purchase should be 1 year prior to thay date

[lyric mortar]

Yeah, ok . Thanks

[clever horizon]

Gave +1 Rep to @vague nacelle (current: #22 - 506)

[vague nacelle]

No problem

[sinful ether]

where can i ask for a refund and return an exam voucher?

[keen crescent]

Email below

[safe trout]

TryHackMe's Email

TryHackMe's support email address.

​

[e-mail]

TryHackMe Socials · Mar 27, 2026, 12:49 PM

[drowsy skiff]

Hey I was wondering if you guys have any advice on how you guys review for the SAL other than just doing the learning path? I finally was able to fix my THM account and I havent practiced for about 2 weeks 😅

[keen crescent]

Try SOC sim 🙂

[drowsy skiff]

thank you so much! 😄

[humble grove]

Hi, how can i have THM invoice for SAL1 certification purchase? I only receive receipt. Receipts are not sufficient for French accounting requirements.

[wispy kayak]

@humble grove this seems something that may require you contacting support directly

[humble grove]

Thx for your answer. I already contact them by email in november, but i don't have any answer 🙁 I try again this week, but it was the same 🙁 It's why I try from here...

[clever horizon]

Gave +1 Rep to @wispy kayak (current: #1821 - 3)

[wispy kayak]

Maybe attempt sending another email and contacting them within the support tab on the website sir. I understand how frustrating it can be to not get a response quickly

[humble grove]

thx, it what i tried this week, i hope i will have an answer 🙁 thx again for your answer I don't know how many days I have to wait before it falls into oblivion. It could be easier if I have the acces from the account page (like for the subscription)

[clever horizon]

Gave +1 Rep to @wispy kayak (current: #1475 - 4)

[wispy kayak]

hopefully you get a response sir

[vague nacelle]

THM username and support ticket number?

Also don't directly send an email, use the support bot.

[frigid rapids]

hiiiii

[dry hawk]

Hello,
I need some advice from you. I’ve just finished SOC Level 1, but I feel like I should further develop my investigation skills before going for the certification. What other labs would you recommend so I don’t just do them randomly?
Thank you very much!

[keen crescent]

Try SOC simulator

Exam's very similar to those scenarios 🙂

[civic crown]

hi, i have completed SAL1, is there any other practice need to pass it

[humble grove]

Hi, Thx for your answer to. This week I try the support bot instead, but it didn't gave me a number 🙁 My THM name is Micke666, and my support request is named "Invoice request"

[clever horizon]

Gave +1 Rep to @vague nacelle (current: #22 - 516)

[frozen pike]

just passed 🥳

[keen crescent]

Congrats 🙂

[frigid briar]

hello y'all, I'm about to finish soon the SOC L1 path, I wanted to know how the SAL1 certification is going to be, I saw that there was a first part with questions (how this part will be ? multiple choice ? fill in the blank ? commands ?) and after that, a SOC Simulation is that right ?

[keen crescent]

Multiple choice

[clever shard]

Just passed

[keen crescent]

Congrats 🙂

[grave vault]

Awesome!: 🥳

[prime oyster]

Hzllo, I'm trying to access the SAL1 exam but it's not loading properly. I've tried different devices, browsers, and connection but it still doesn't work. My exam expires on April 12. Could someone help me please ?

[vague nacelle]

https://tryhackme.com/contact

[tall wigeon]

if i failed the first attempt, will the scenarios be the same in the second attempt?

[keen crescent]

probably not , they're chosen at random

[civic crown]

No, the questions and the scenarios change every time

wohooo I passed my SAL1

[keen crescent]

Congrats 🙂

[flat pebble]

how did yal solve this

i'm a beginner

[silver night]

You are not in the right directory

for the fil

Completely wrong machine, start up the machine the room provides

and not the attackbox, then you can find it

[flat pebble]

thank youuuuuuuuu

[clever horizon]

Gave +1 Rep to @silver night (current: #45 - 255)

[finite sandal]

Hello, i just passed SAL1 exam, howw do i get a role now? TIA 🙂

[keen saffron]

cg

[vague nacelle]

Done. Congrats!

[finite sandal]

Thank you!

[clever horizon]

Gave +1 Rep to @vague nacelle (current: #22 - 524)

[silver totem]

hello eveyone, i have a question about how i would score on report. In Soc-sim, i got 10 for escalation, 10 for correct TP, and 70 for report writing, so my total score is 90 or 70 is already my total score?

[keen saffron]

Congrats mate!

[finite sandal]

Thank you! I appreciate

[clever horizon]

Gave +1 Rep to @keen saffron (current: #1829 - 3)

[ornate monolith]

congrats, do you recommend it?

[twilit wren]

Is sal 1 really helpful in real world to get a job?

[flat pebble]

[civic crown]

congrats

[celest geyser]

if you stack it with comptia certs yes

[finite sandal]

Thank you, yeah it was fun, soc sim was great.

[clever horizon]

Gave +1 Rep to @ornate monolith (current: #1833 - 3)

[finite sandal]

Thank you!

[clever horizon]

Gave +1 Rep to @civic crown (current: #989 - 7)

[west trail]

congratz

[twilit wren]

Thanks mate

[clever horizon]

Gave +1 Rep to @celest geyser (current: #2429 - 2)

[twilit wren]

And what are the projects I do for soc l1

[thorny lance]

Hey guys, I just finished SOC L1 path, do we have an aggregated guide/ review tips before taking SAL1?

[keen crescent]

Try SOC Simulator , exam looks very similar to it 🙂

[calm knot]

Hey guys! I currently have my Sec+ , and I am looking to go for the SAL1. Do you have any tips and tricks on what I should start doing?

[native hornet]

Go over recommended learning is the best idea imho

[dense scroll]

hello guys i am new here.
i have an issue with my SOC Metrics and Objectives module, it is a question on MTTD, MTTA, MTTR, i keep in puting the right answer but it keeps saying the answer is wrong which it is not, has anyone had any issue about this in the past and how did you get through it.

[tender warren]

yeah i got stuck on that for a while. MTTD is just 10 or whatever, MTTA is 12, MTTR is (MTTA + 6 + MTTR) I think

[slow frost]

Hello everyone, I’m new here.
It’s an honor to be part of this community, and one of my biggest dreams is to earn the SAL1 certification.

I also kindly ask the staff team for their support on this journey. Even though my financial situation is not very good, achieving the SAL1 certification is one of my first big goals and dreams.

[keen crescent]

Try to play a bit with SOC simulator , exam is pretty similar to it 🙂

[slow frost]

I understand you completely. I’ve already practiced both the real environment and the simulator many times. The only thing left is making it official with the certification. Unfortunately, because of my financial situation, it still feels like just a dream for now. But I will not give up on this path. Earning that certification is one of my biggest dreams, and I’ll keep working until I achieve it.

🙂

[keen crescent]

Wish you all the best , keep up the good work 🙂 🚀 🔥

[slow frost]

Thanks for your support 🎉

[clever horizon]

Gave +1 Rep to @keen crescent (current: #1 - 6189)

[dense scroll]

it worked bro, im really happy, you made my night, been stuck on this for days

[lean timber]

Hey good people, i recently just took my SAL1 exam, thought I was pretty prepared for it and I completely BOMBED it. Currently my case reporting is very weak and that was large chunk of my grade, so if anyone has the time today, I would greatly appreciate some help before my 2nd exam attempt

you can ping me here or just shoot me a DM

[keen crescent]

Make sure to cover principle of 5 W's in detail . Try to play with SOC simulator a bit , exam is very similar to it 🙂

[lean timber]

How should I go about case reporting the critial and high alerts? I strugged with those alot and part of it was cause I didnt understand what to look for in the SIEM, to help me properly triage the alert

[keen crescent]

Wdym exactly ?

[lean timber]

So for those level of alerts, my investigation skills arent there. When it comes to looking at certain commands, executables, or artifacts that are malicous, I dont know how to report that information. For example, there could be an obvious malicious command in a command line, but explaining WHY its malicious and understanding the scope of what its doing is where i fall short

since i cant explain it, it makes the case report extremely weak

[keen crescent]

Why is it malicious = how it harms the system / users

[lean timber]

what are some modules you recommend revisiting that help with SIEM investigations

[keen crescent]

This one may be helpful 🙂
https://tryhackme.com/module/soc-team-internals

[lean timber]

thanks so much, i'll look into it

[clever horizon]

Gave +1 Rep to @keen crescent (current: #1 - 6196)

[hallow badger]

Hi everyone! Im getting ready to take on the SAL1 exam, having completed the Learning Path and done the Simulators I now have some questions that maybe some share or maybe have already been answered. So focusing on the SOC Simulator, Im finding hard to get good evaluations on case reports. I tend to group multiple incidents on one case report. Could this be the issue? Does the correcting AI benefit more if we go case by case? My mentality is also prioritizing response time and closing time as I thought in a real world scenario it would be more important to collect the more important info and act on it rather than go to the detail. Is it better to take longer and pay attention to detail?

[steel locust]

Hey, I’m a final-year cyber security and digital forensics student with some hands-on experience in forensics, networking, and scripting. Roughly how long do you think it would take me to get ready for SAL1 if I wanted to do it soon?

[pliant marsh]

try the SOC simulator, if you have no problem with that, take on the exam

[steel locust]

Thanks

[pliant marsh]

Yeah I think that you have to close the incidents one by one, I tried grouping 4-5 incidents together (which all described one attack path) and I got really low rating on that part of the exam. It is kind of weird but try to do them one by one

[hallow badger]

Thanks will go for an extra run at it with that approach

[clever horizon]

Gave +1 Rep to @pliant marsh (current: #3774 - 1)

[wooden pollen]

Uhhh im currently having CompTIA sec+, I wonder should i go for SEC1 before i can go SAL1 or i can go straight to SAL1

[tender warren]

skip SEC1 as there's no market recognition and its super basic. Focus on SAL1, that's what I'm doing plus PT1.

[wooden pollen]

Oh thanks for the answer but i still should finish the cyber101 ?

[native hornet]

It'll for sure help you reinforce the basics so finish it

[wooden pollen]

The metaspoit module give me pain

🥲🥲

[rapid jungle]

Hi everyone ! I just completed the SAL1 exam but it's been many hours (about 6 hours) i'm waiting on the screen "Loading your results... Almost there! We're just finalizing your results"

I tried refresh the page, delete cache, use incognito, remove extensions, changed browser but nothing worked... I use Chrome. Do you have any idea to solve this issue ?

[sonic veldt]

Email [e-mail]
and they can help with the issue, hopefully you passed <3

[rapid jungle]

Thanks so much ! I'll have an answer monday right ? Cuz now it's closed and it's close the weekend if i remember correctly

[clever horizon]

Gave +1 Rep to @sonic veldt (current: #1004 - 7)

[sonic veldt]

yh im sure, you will have an answer on Monday, they normally have decently good support.

You going to be thinking about it all weekend lol

[rapid jungle]

Yeah that's pretty horrible and stressing 😂 Hope i get it ! Thanks for your answer 😉

[clever horizon]

Gave +1 Rep to @sonic veldt (current: #916 - 8)

[sonic veldt]

I feel you, let us know how it goes man. Good luck <3

[pallid parrot]

1 more here waiting 7+ hours to get the result xD What a day to take the exam

[wooden pollen]

for anyone passed the SAL1, do we need to remember all the room we been through on SAL1 path ?

[wispy kayak]

I have not done the exam but for any practical exam I would expect to go into it with the knowledge from the learning material provided 🙂

[rapid jungle]

The SOC simulator is really helpful for the exam ! Do it A LOT of times until the AI gives you a good result on the report. I did the simulator like 10 times and it helped a lot

[wooden pollen]

Tks for the tips

[rapid jungle]

You're welcome but you also need to do all the rooms cuz the questions part will be about it and some questions are tricky ^^ and it will still help you by their way for the SOC part

[wooden pollen]

Yeah because some room is very easy and i may forget some of them