TryHackMe | SOC Level 2 Training

Skip to main content

New 2026

Path SOC Level 2

Learn all the skills needed to take you to the next level in your SOC Analyst career.

Master log analysis in SIEM
Train your mindset for a new role
Keep up with the defensive trends
Discover surrounding SOC L2 duties

Certificate of Completion

Example learning path completion certificate

Complete this learning path to
develop your skills and earn a
certificate of completion.

SAL2 Professional Certification completion certificate

SAL2 Professional Certification

Demonstrate the skills required to operate at the next level.

Introduction

This new and improved SOC Level 2 path trains the mindset and builds the technical skills to move up from L1 or perform stronger in your current role, through realistic hands-on labs. You'll use SIEM to triage across new areas like Active Directory, M365, and AWS, and go deep on CTI, network, and malware analysis. You'll also cover surrounding duties like detection engineering, threat hunting, adversary emulation, and more to become a capable, versatile L2 analyst.

Section 1

Intro to SOC Level 2

Senior Security Analyst Intro SOC L2 Alert Triage Report Writing for SOC L2 Defensive Security Trends

Topic Rewind Recap

Section 2

Advanced Splunk

Splunk: Exploring SPL Splunk: Setting up a SOC Lab Splunk: Dashboards and Reports Splunk: Data Manipulation Fixit

Topic Rewind Recap

Section 3

Advanced Elastic

Elastic: Query Languages Elastic: Setting up a SOC Lab Elastic: Using Elastic Defend Elastic: Using Logstash Slingshot

Topic Rewind Recap

Section 4

Active Directory for SOC

Monitoring Active Directory Detecting AD Initial Access Detecting AD Credential Attacks Detecting AD Lateral Movement Detecting AD Post-Exploitation

Topic Rewind Recap

Section 5

Microsoft 365 for SOC

M365 Monitoring Basics Entra ID Monitoring Exchange Online Monitoring SharePoint Online Monitoring Microsoft Intune Monitoring

Topic Rewind Recap

Section 6

Cloud Security for SOC

Cloud Security Pitfalls AWS Security Logging Monitoring AWS Logins Monitoring AWS Services Monitoring AWS Workloads

Topic Rewind Recap

Section 7

Detection Engineering for SOC

Intro to Detection Engineering Detection Rules Development Sigma Language SigHunt AI & Automation in Detection Engineering DetectMare

Topic Rewind Recap

Section 8

Threat Hunting

Threat Hunting: Introduction Threat Hunting: Foothold Threat Hunting: Pivoting Threat Hunting: Endgame Hunt Me I: Payment Collectors Hunt Me II: Typo Squatters

Topic Rewind Recap

Section 9

Threat Emulation

Intro to Threat Emulation Threat Modelling Atomic Red Team Atomic Bird Goes Purple #1 Atomic Bird Goes Purple #2

Topic Rewind Recap

Section 10

Incident Response Lifecycle

Preparation Detection and Analysis Response and Recovery Post-Incident Activity

Topic Rewind Recap

Section 11

Cyber Threat Intelligence

Intro to Cyber Threat Intel CTI for Alert Triage MISP OpenCTI Trooper

Topic Rewind Recap

Section 12

Advanced Traffic Analysis

Traffic Analysis Pitfalls Detection Engineering With Snort Network Monitoring with Zeek Threat Hunting with Zui Advanced Packet Analysis The Silent Transfer

Topic Rewind Recap

Section 13

Static Malware Analysis

Basic Static Analysis Threat Hunting With YARA Advanced Static Analysis Script Static Analysis MalDoc Static Analysis MalBuster

Topic Rewind Recap

Section 14

Wazuh for SOC and GRC

Exploring Wazuh Building Wazuh Rules Osquery: The Basics Monday Monitor

Topic Rewind Recap

Section 15

SOC Level 2 Capstone Challenges

Volt Typhoon Servidae APIWizards Breach Friday Overtime Conti

Topic Rewind Recap