sal2

[dusky solar]

[cerulean scaffold]

https://tryhackme.com/resources/blog/introducing-sal2-the-certification-that-proves-you-can-do-the-job 🔵 🥳

[dark cipher]

🥳

[left night]

Is there any discount for SAL2? Students for example

[zinc hamlet]

Called it 🎯

[warm trellis]

599 is crazy pricing, and comparing it like that to BTL2 is very bold. Let's see if it actually holds up to these competitors.

Will test it soon and write an honest review.

[hard wigeon]

Also there is a launch price going on which should be less than its original price , its a good deal to grab

[dawn dune]

Having tables like this with all ticks makes it looks so biased. Would make it alot more trustworthy if it was honest and showed some downsides imo

[warm trellis]

It's marketing, it's obviously going to be this way. I'm here to test it and see if it holds up to what they say in this table

The team deeply believes in it, and I'd like to do as well

[cerulean scaffold]

We are putting our best foot forward, I really really believe this is the best certification for a senior SOC position. The other certs are not bad but when thinking of next level of a role based cert I think this cert well above the others. Of course, it will be others less biased than myself to decide.

[obtuse pawn]

🤣

[odd sun]

[loud sparrow]

Cant lie I am hella excited about Sal2

And i aint even got a job lol

[cerulean scaffold]

Multiple ways to answer this.

• If they will put in on their public job posting - Over time I expect so.
• If they will use it in ATS screening - probably it's quite easy to set up screening criteria based on people having certs
• will they recognise the skills gained by the on your CV? yes tryhackme is extremely well recognised in the industry and growing.
• will they recognize the skills you've gained by studying far and reaching the standard to pass sal2? the skills you gain by studying for and passing the cert we'll absolutely help you demonstrate skills and competencies in an interview.

i really believe that if someone can pass this cert, they have the skills to do the job in a senior SOC role. The scenarios we crafted inside it it are real-world, the workflows are real SOC suitations, the time pressure, the SLA, the expectations are all so real-world that if you can pass SAL2, you can do the job.

This cert is not about proving that you know the different forensic artifacts, it's about applying your investigation skills in the SIEM, applying what forensic artifacts to look for, and doing that under time pressure where you have to make decisions under SLA.

i'm really looking forward to some independent reviews to come out on this.

[candid lantern]

Woot woot its finally here!

[snow grotto]

[stiff swift]

All good, but what about the red team , it look abandoned
Recently there has been lot of blue rooms created but not so much for the red side

[warm trellis]

It's in the roadmap don't worry. Coming soon ™

[sullen flare]

just bought SAL2 from excitement, still need to clear some blue rooms tho, especially AD and AWS

[warm trellis]

0 SOC/Threat Hunting/Threat Intel/Blue Team Experience besides IAM/VOC. Haven't even finised SOC L1 path on THM. I hate anything blue team and have done 3 SOC Sim scenarios as training in my entire life. That's it. Scored 77% and I didn't even prioritize scenarios. I went from easy to hard, so I could have gotten 80% if just did hard -> easy instead. (ish) GGs boys, no one blieved, myself included, that I could pass. I was expecting ~30%. Looks like the offensive security skills gets you a very long way when you know how an attacker thinks. The rest is just googling commands. Not much to do when you're inside the attacker's head 😄

Big review incoming, my biggest one yet.

[young parrot]

Gave +1 Rep to @warm trellis (current: #22 - 508)

[stiff swift]

Bro ,why you hate blue team this much💀

For me , i an into red team but i found blue team very interesting and also beneficial for your red team skills

Knowing how defenders operate and how their tools work is crucial for elite red team skills

[pliant sable]

So, you actually took SAL2

[warm trellis]

Review is out, you've never seen such a detailed review like this, guarrantee 100%. My usual review level. 🗿

https://dragkob.com/articles/sal2-review/

[snow grotto]

Sorry if this has been asked and answered but when does launch price end for SAL2? And if I purchase today, by when do I need to sit the exam? 🙂

[pliant sable]

Launch price for SAL2 ends on April 2nd and all the exams can be taken within a year of purchasing a voucher

[snow grotto]

Sweeto thanks

[opaque ledge]

Thanks for taking the time for such a detailed review. And Congrats on pass!

[young parrot]

Gave +1 Rep to @warm trellis (current: #22 - 514)

[candid lantern]

Is the Founding Operators Club limited to the first 100 or the first 100 before the end of the campaign on April 2?

[warm trellis]

I asked myself the exact same question.

@cerulean scaffold Maybe can you ask internally please?

Also, if we can get confirmation on who the first 100 are.

[candid lantern]

Yeah the T&S says "Recognition will be confirmed after the campaign closes on April 2." So I wasn't sure if the first 100 hasn't been reached, will folks who pass after that will be included in the Fouding Operators Club.

[warm trellis]

Well I know for sure that I'm amongst the first 100, so if I get anything I'll send it here

[cerulean scaffold]

Hey, I didn’t hear that it was tied to that campaign. Will ask for clarity.

[shell patrol]

cant believe you barged through it in less than 12 hours.

[candid lantern]

Yeah its in the fine print on the bottom of the SAL2 page https://safe.menlosecurity.com/https://tryhackme.com/certification/security-analyst-level-2

[hard wigeon]

the Founding Operators Club is not tied to campaign that ended on April 2nd, however it is limited to first 100 people

[candid lantern]

Do you know if the 100 limit has already been hit?

[candid lantern]

Planning on trying to do it next weekend

[unique sierra]

I just passed it, still had 65 hours left, enjoyed the exam. I am wondering myself if I was amongst the first 100.

[shell patrol]

Huge congrats to you. Well done!
So you completed it in 7 hours?

[unique sierra]

Checked and it was 63 not 65, my bad. Around 9 hours indeed

[shell patrol]

impressive nonetheless. i spread it out over three days. It was definitely more manageable in my experience.

[unique sierra]

Unfortunately I work a lot so I could only speed run it over the long weekend

It was infuriating at times and the windows host analysis made me sweat because my clip board completely failed, I had to screenshot the damn powershell and reconstruct the time line from there

But I liked it

[unique sierra]

Hey, any idea how to know if one's in the first 100?

[novel vigil]

Did they already choose the 50 people for free vouchers among the CySA+, eCIR, GSOC, or BTL2 holders?

I saw it closed on April 4th.

[shell patrol]

I had the same issue. Definitely added to the pressure.

[left stone]

The Discord horny vulnerability has been exploited yet again.

[fallow garnet]

Anyone here win the exam giveaway?

[tribal shoal]

Just got certified with 92%, hope I'm among the first 100 tho^^

[cerulean scaffold]

i got this message back from the team dealing with it, we're still under the 100. congratulations to everyone that has passed so far! 👏

"We are planning to send out communications to the first round of founding operators in mid-April. However there are still spots available, so this will remain open to SAL2 takers for a few more weeks whilst we begin on-boarding the first round of users who have passed"

[warm trellis]

Nice waiting for the com.

[warm trellis]

Grats! Would you like the role?

[tribal shoal]

I'm currently working as a SOC L1 "work-study" in a MSSP, where they let me conduct further invests like in the exam, so it was "similar" to what I actually do as a L1, but I'll definitly be a L2 when I'll graduate :)

[warm trellis]

I meant the discord role. 😄

[tribal shoal]

ahah oops

yes pls :P

[warm trellis]

Happy for you though! What country?

[tribal shoal]

France

[warm trellis]

Nice! I work in France.

I guessed it was France/EU from your text.

[young parrot]

➕ Gave the role SAL2 to stayaway

[warm trellis]

cc @cerulean scaffold The work-study I was talking about in DMs ^

Graduate -> L2

[sleek plume]

Hi out of curiosity is there a free voucher for beta testers similar to SAL1. If you held a CySA+ youd get a SAL1 voucher so curious if they are doing the same for SAL2

[unique sierra]

@warm trellis hey, can you wizard me the CySA+ and SAL2 roles? I also hold eCTHP but I don't know if a yellow plate exists for tat

p

please

thhx

[dark cipher]

Not yet as far as I know

[young parrot]

➕ Gave the role SAL2 to ger1e

[unique sierra]

ty

[warm trellis]

Yes but the giveaway is closed now.

[warm trellis]

Yes we have roles for cysa and ecthp but you'll need to send me proof by DMs.

[unique sierra]

s3nt

[novel vigil]

Do you know if winners have been notified?

[warm trellis]

Nope

[sleek plume]

Ah its a giveaway I thought it was a open to all situation. Similar to the PT1 and SAL1

[warm trellis]

PT1 and SAL1 were also giveaways.

You just had to put it your info and you had a chance at being randomly selected for the giveaway.

[sleek plume]

SAL1 I think it was open to all not necessarily a giveaway same with PT1 but good to know for the future

[candid lantern]

Woot woot!

[pliant sable]

You're really collecting all of those certificates like Pokémon

[candid lantern]

People need hobbies

[unique sierra]

Congratulations

[vestal jacinth]

Done!

Done!

[warm trellis]

Has anyone been reached out to for passing SAL2? (First 100)

[unique sierra]

Nope not me

[dark cipher]

Not yet 🙂

[candid lantern]

I assume I was within the first 100 but no nothing yet

[opaque ledge]

For those who have passed SAL2, Is the full soc2 path essential? Coming from an offensive background (pt1,oscp,osep) should i have enough to pass? I have completed the soc1 path

[unique sierra]

You will pass easily no learning path needed

[opaque ledge]

Thanks

[young parrot]

Gave +1 Rep to @unique sierra (current: #3718 - 1)

[vast stump]

Has anyone received an email invite to the SAL2 Founding Operators Club?

[unique sierra]

Nah not yet

[warm trellis]

Nope

[vast stump]

Hi, I found an error in the description of the SAL2 certification criteria on Credly:

“Candidates who pass the SAL2 exam complete a 72 hour, to validate foundational cyber security knowledge through a structured assessment.”

This description is similar to that of the SEC1 certification.

[warm trellis]

@cerulean scaffold @eager basin ^

[daring helm]

HI im coming towards the end of the SAl2 exam but ive really struggled with the VM's. On the following paths on the exam they did not deploy and I did what I could without the vm being deployed. This is very heartbreaking for me.

I struggled with the following :

Phishing Payroll VM (Medium)
Agenda Deception VM (low)

I do not want to start the final Vm named "no flight today" this is because ive had an issue with the vms and sla is about to expire. Please help with this issue as I only have 44 hours left of the exam.

Its taken me so long to do the exam but knowing the fact that im losing marks on the vms not being deployed is very disheartening and killed my morale. Splunk , edr and all the others were able to get deployed but on each vm section it just did not load up and the sla timer was going down.

[cerulean scaffold]

Hey Harees, I suggest you reach support first to log that you have an issue. Would also be good to understand what VM issue you are referring to? Make sure your using the a vm region on TryHackMe the is suitable for your location. The VM hosting infra is the same as room hosting but on a higher performance tier. If room perform is good then the sal2 vm performance should be better. If your seeing something else like error messages etc the include that in your ticket.

[daring helm]

@cerulean scaffold thanks so much for that 🫡

[young parrot]

Gave +1 Rep to @cerulean scaffold (current: #237 - 48)

[unique sierra]

@daring helm hang in there bro, I also had huge issues with some of the DFIR stuff due to not being able to copy paste from the VM and so, ended up having to miss the SLA and manually screenshot all lines of powershell to reconstruct the timelines outside of the VM, with varying results.... and still passed with 77 percent, you can do it!

[candid lantern]

Any word on the Founding Operators club?

[warm trellis]

Nothing... it's a bit disappointing.

Still waiting for the lost PT1 package too. The SAL2 package was as twice advertised so it would be really bad publicity if THM lies again.

[unique sierra]

Indeed.

[candid lantern]

Got my email!

[vast stump]

I haven't received it yet. Hopefully, I'm not left out of the first 100.

[warm trellis]

Was it mass sent to the first 100 or is it on an individual basis? Because I didn't receive anything. @eager basin @cerulean scaffold

[eager basin]

Not close to this one but I will ask around!

[warm trellis]

Ah thanks. As product manager, when is it appropriate to ping you? (So I don't spam)

[young parrot]

Gave +1 Rep to @eager basin (current: #376 - 24)

[eager basin]

haha you won't know, we have 9 PMs, each responsible for a different area -- I passed it on to one that works on certs! 🙌

[warm trellis]

Understood, thank you, and my apologies for the ping.

[eager basin]

ping away, worst case I won't know off the bat

[unique sierra]

Got my email! Sick.

[snow grotto]

Sorry if this has been asked already but I’m trying to prepare for SAL2 still, and I don’t know if I’m ready. I did the soc l2 learning path on THM and the question / answer style is usually fine for me to work through. Is it similar to SAL1 exam or more regarding malware analysis and reverse engineering ?

[unique sierra]

You are ready

You have oscp

[snow grotto]

I have lost all my skills since oscp 😂 it was like 6 maybe 7 years ago, and I somehow drifted away from offsec st work

[snow grotto]

Is the founding operators club already full?

[warm trellis]

https://www.dragkob.com/articles/sal2-review/

[warm trellis]

@hard wigeon / @cerulean scaffold Maybe you guys have the info? (Still waiting for my email too - nothing so far)

[snow grotto]

When I read the question and answer section it makes me think we have to do an investigation and answer questions , is that true? Then it’s similar to some rooms maybe? Or is it closer to soc simulator ?

I guess you can’t say so much hehe

[warm trellis]

Yes it's hands-on

[tribal shoal]

While filling out the Founding Operators Club form, I was connected to another google account and used this email rather than my THM email (because it's linked to my uni account and I'll lose access to it after I graduate), is this a problem?

[vast stump]

I guess TryHackMe sends them out in batches, maybe starting with the first 10 people who pass the exam.

[warm trellis]

Nope unfortunately it's not time-dependent. I passed way before @candid lantern but he got an email first - it seems like there's a problem where people who unsubscribed from marketing email have not received the founding operator email.

They will have to manually email these people.

[vast stump]

If we're lucky, we might have to wait a few more days. 😁

[candid lantern]

Yeah I know I passed thru along than other folks so I don't know why I got my email when I did. I thought maybe it was some phishing attempt becuase the link was being blocked and it brought me to a google docs form.

[warm trellis]

Didn't get my email today - guess I'll have to wait until next week.

[unique sierra]

https://klipy.com/gifs/schade-3

[candid lantern]

Did you ever get an email?

[warm trellis]

Nope.

[unique sierra]

For us who got it no response either so you are not missing anything

[warm trellis]

Still no email for SAL2.

[vast stump]

Perhaps we need to wait a few months.

[unique sierra]

For us who got it no response either

[daring helm]

Did anyone recieve an email from nick in regards to SAL2 Founding Operators profile

[warm trellis]

👋🏼
Any updates on emails? I still haven't received mine.

[warm trellis]

Got my email!! ^

[unique sierra]

Hey,
Just got an email about the founders operator assets. First, I had to provide my Discord ID. Then I am supposed to access a link, but alas, Page not found
Sorry we can't find the page you're looking for. Let's get you back on track. The mail specifically says that if this occurs, "that likely means your Founding Operators profile is incomplete."

"If you’ve already submitted your information and still can’t access the page, reach out to us directly to receive the assets."

Unfortunately I can't access even though the information has been submitted weeks ago within 10 minutes of me having received the first FO related Google form.

Could somebody from the team please help? Thanks in advance.

@eager basin reaching out as instructed.

[warm trellis]

Got the mail, same problem too! ^

[eager basin]

passed it on!

[warm trellis]

Congrats to the founding operators!
https://tryhackme.com/certification/security-analyst-level-2/founding-operators/

Your banners and message form the founders can be found in your inbox by clicking on the link!

[dark cipher]

Where should we reach out if we can't access the resource? Should we email [e-mail] or reply to the email directly 🙂 ?

[warm trellis]

There's a bug, they reached out to me to test on my account; they'll be rolling the fix for everyone shortly

cc @hard wigeon

[dark cipher]

Thanks for the update 🙂 👍

[young parrot]

Gave +1 Rep to @warm trellis (current: #20 - 538)

[jaunty fox]

Hey folks

How do you guys find so far for this SAL2?

I hold CCDL2/BTL1/SAL1/CCSK/CySA+/SC-200/AZ-500, is SAL2 worth to jump into?

[unique sierra]

Yes and no for a lot of things. I wrote it down but at the end of the day it's this khant can you afford to blow this much on a new cert? If you can go for it

[hard wigeon]

Hey folks, on the founding operators club, we are fixing the issue for users who are unable to download the assets, once its rolled out i will let you all know

Also in the email we have requested for Discord ID , not Discord name, in case someone missed sharing the discord ID , please resubmit the form with that.

Thanks you

[daring helm]

QQ if you were one of the first 100 people to pass SAL2 do you also get items in the post as we did for passing sal1 first 100

[unique sierra]

@hard wigeonyou are correct, I submitted the username and not the userid the first time around

[hard wigeon]

So the fixes are in place, people who have submitted userid - they should be able to download the new assets

[hard wigeon]

We are not giving any physical assets this time, rather we are sharing digital assets + the first 100 will form a founding operator club for SAL2 which will have more community benefits in the future

[daring helm]

Thanks for the update on that. 👌

[young parrot]

Gave +1 Rep to @hard wigeon (current: #1269 - 5)

[vast stump]

It still doesn't work with my account

[hard wigeon]

what is your user name or email ? you can message me as well

[summer solar]

any sal2 notes ?

[young parrot]

Gave +1 Rep to @hard wigeon (current: #1112 - 6)

[warm trellis]

No notes but a review, would that work?

[vast stump]

@hard wigeon I've sent a message. Please check it.
Thank you.

[young parrot]

Gave +1 Rep to @hard wigeon (current: #999 - 7)

[summer solar]

i have sal2 voucher does exam hard?

[warm trellis]

https://dragkob.com/articles/sal2-review/

[vast stump]

Another week has passed, and I still haven't received a response regarding the fix for access to the founding operators club assets in my account.
Another week of waiting is ahead.

[hard wigeon]

Hi , just seeing this , if this is not resolved , could you send me a message on what the issue exactly is with your THM email id please?

[tribal shoal]

Hello, i‘m facing also issues with the assets, I‘ve sent you a message

[vast stump]

I have access to the asset. There was a typo in my assets, and I have already emailed Nick about this issue.