🔐 Free TryHackMe SOC Labs – SIEM, Threat Detection, IR & Blue Team Practice

A curated list of free TryHackMe rooms focused entirely on Security Operations Center (SOC) training. Ideal for SOC Analysts (Level 1 & 2), Blue Teamers, and cybersecurity students, these hands-on labs cover core skills like SIEM analysis, incident response, Windows event log monitoring, and threat detection.

---

🚀 Why This List?

Whether you're a beginner or preparing for certifications like:

• CompTIA CySA+
• SC-200: Microsoft Security Operations Analyst
• Blue Team Level 1 (BTL1)
• Security Blue Team (SBT)
• SSCP / GCIH

...these labs will help you develop skills in:

✅ Alert triage
✅ Incident playbook response
✅ Threat hunting
✅ Windows log analysis
✅ APT detection
✅ SOC tool familiarity (like ELK, Splunk, Sysmon)

---

📚 TryHackMe SOC Room List (Free)

🆓 These rooms are 100% free at the time of writing and updated regularly.

---

Icon	Title	Subtitle	Link
🔵	SOC Role in Blue Team	Discover security roles	🔗 Visit
🛡️	Defensive Security Intro	Introducing defensive security and related topics, such as Threat Intelligence, SOC, DFIR, Malware Analysis, and SIEM	🔗 Visit
📊	Introduction to SIEM	Introduction to SIEM	🔗 Visit
🖥️	Introduction to EDR	Learn the fundamentals of Endpoint Detection and Response	🔗 Visit
📘	IR Playbooks	IR Playbooks	🔗 Visit
🗂️	File and Hash Threat Intel	Threat Intel & File Hashes	🔗 Visit
🧠	Splunk: Exploring SPL	Splunk: Exploring SPL	🔗 Visit
🧠	SOC Analyst Basics	SOC L1 Alert Reporting	🔗 Visit
🕵️	Threat Hunting Without Logs	Logless Hunt	🔗 Visit
⚔️	APT Detection (Volt Typhoon)	Volt Typhoon	🔗 Visit
🪵	Windows Log Analysis	Windows Logging for SOC	🔗 Visit
📂	Windows Threat Detection	Windows Threat Detection 1	🔗 Visit
🐧	Linux Threat Detection 1	Explore how attackers break into Linux systems and how you can detect this in logs	🔗 Visit
🍯	Initial Access Pot	Investigate the first, Linux part of the Honeynet Collapse!	🔗 Visit
🧾	Intro to Logs	Intro to Logs	🔗 Visit
🛠️	Splunk 101	Splunk Basics (101)	🔗 Visit
🧿	Wazuh	Wazuh SIEM Lab	🔗 Visit
📊	ELK 101	Investigating with ELK 101	🔗 Visit
🧮	ELK: Servidae	Log Analysis in ELK	🔗 Visit
📶	Network Traffic Basics	Network Traffic Analysis Basics	🔗 Visit
❄️	TShark	Network Traffic Analysis	🔗 Visit
🌐	Wireshark	Wireshark: The Basics	🔗 Visit
🌐	Event Horizon	Wireshark + file analysis	🔗 Visit
🧾	NetworkMiner	NetworkMiner Forensics	🔗 Visit
🔒	Network Security Essentials	Network security monitoring & protection	🔗 Visit
🔍	Network Discovery Detection	Detect network asset discovery activity	🔗 Visit
🪟	Windows Event Logs	Windows Event Analysis	🔗 Visit
👨‍💻	Investigating Windows	Event Log Forensics	🔗 Visit
🔍	Investigating Windows 2.0	Windows Log Forensics	🔗 Visit
💻	Osquery	Endpoint Detection & Response	🔗 Visit
🐧	Linux Server Forensics	Linux Log Forensics	🔗 Visit
🧠	Memory Forensics	RAM Dump & Analysis	🔗 Visit
🧊	Volatility	Memory Dump Analysis	🔗 Visit
🔬	YARA	Malware Rules & Detection	🔗 Visit
🧠	YARA Advanced	Threat Hunting with YARA	🔗 Visit
📑	SOC Alert Triage	SOC L1 Alert Triage	🔗 Visit
🎯	First Shift CTF	The first SOC shift won't be that challenging, right?	🔗 Visit
📊	MS Sentinel	MS Sentinel: Just Looking	🔗 Visit
🕳️	h4cked	PCAP Investigation	🔗 Visit
🕷️	Carnage	Traffic Analysis Challenge	🔗 Visit
📌	CCT2019	PCAP Forensics Competition	🔗 Visit
📡	Overpass 2 - Hacked	IR via Log Analysis	🔗 Visit
⚡	Detecting Web Attacks	Explore web attacks and detection methods	🔗 Visit
🔎	Identification & Scoping	A look into the second phase of the Incident	🔗 Visit
🛡️	AppSec IR	Application Security Incident Response	🔗 Visit
🔗	Chaining Vulnerabilities	Exploit Chain Analysis	🔗 Visit
🐧	Linux Logging for SOC	Linux Log Analysis for SOC	🔗 Visit

---

🆓 These rooms are 100% free at the time of writing and updated regularly.

---

💙 Support the Project

If you find this project helpful and want to support my work:

• ☕ Buy Me a Coffee
• 💸 Donate via PayPal
• ₿ BTC wallet: 0xB8061916BF00F1ca7C4C252533BdEeC18B86bcD3

Your support helps me keep this project up to date for the Blue Team community 🙏

---

📌 How to Use This

1. Log in to TryHackMe
2. Click each room link above
3. Start learning and practicing real-world SOC skills — no subscription required

---

🧠 Related Topics / Tags (for SEO)

SOC Training • Free Cyber Labs • SIEM • Incident Response • SOC Analyst Labs • TryHackMe Blue Team • SOC L1 • Blue Team Labs • Windows Logging • Threat Detection

---

🛠️ Contribute

Found more free SOC-related rooms? Open a pull request and I’ll update the list.

---

📄 License

This repository is licensed under the MIT License.