SAL1 Exam Prep & Study Resources

The TryHackMe Security Analyst Level 1 (SAL1) is an entry-level blue team certification from TryHackMe. It validates foundational skills in security operations, including log analysis, threat detection, incident triage, and SIEM usage. SAL1 is designed for aspiring SOC analysts who want a hands-on credential demonstrating their ability to perform core security monitoring and analysis tasks.

SAL1 is an entry-level certification and is designed to be achievable for candidates who have completed TryHackMe's SOC-focused learning paths. The exam tests practical defensive security skills in a realistic environment, requiring candidates to analyze logs, identify threats, and demonstrate security monitoring capabilities. Candidates with basic IT experience who have thoroughly completed the relevant TryHackMe content should be well prepared. The difficulty is comparable to other entry-level blue team certifications.

SAL1 covers foundational SOC analyst skills including SIEM fundamentals and log querying, network traffic analysis, Windows and Linux log analysis, common attack pattern recognition, phishing email analysis, malware triage basics, incident detection and escalation procedures, and security tool usage. The certification focuses on the practical day-to-day tasks that a junior SOC analyst would perform in a security operations center environment.

SAL1 and CompTIA CySA+ both target defensive security roles but differ significantly in format and recognition. CySA+ is an established, widely recognized multiple-choice exam that is DoD 8570 approved. SAL1 offers a more hands-on, practical assessment aligned with TryHackMe's interactive learning methodology. CySA+ has much broader industry recognition and is more likely to satisfy HR requirements. SAL1 provides better practical skill validation and is more accessible in terms of cost and preparation.

Most candidates spend one to three months preparing for SAL1 using TryHackMe's SOC and defensive security learning paths. Those with existing IT or networking experience may need less preparation time. Complete beginners should start with TryHackMe's Pre-Security and Introduction to Cyber Security paths before moving to SOC-specific content. Consistent daily practice on the platform, particularly with rooms focused on log analysis and SIEM tools, is the most effective preparation approach.

There are no formal prerequisites for SAL1. However, candidates should have basic understanding of networking (TCP/IP, DNS, HTTP), familiarity with Windows and Linux operating systems, and a general awareness of common cyber threats. TryHackMe's introductory paths cover these foundations well. A TryHackMe premium subscription provides access to the most relevant preparation content, though many introductory rooms are available on the free tier.

SAL1 is a useful entry-level credential for aspiring SOC analysts, particularly those who prefer hands-on practical validation over multiple-choice exams. It demonstrates that you have practiced real defensive security tasks in a structured environment. However, for maximum career impact, SAL1 is best combined with more established certifications like CompTIA Security+ or CySA+, which have broader employer recognition. SAL1 serves well as a supplementary credential that proves practical capability alongside knowledge-based certifications.

The SAL1 exam is a practical, hands-on assessment conducted in TryHackMe's virtual lab environment. Candidates must perform realistic SOC analyst tasks including analyzing logs, investigating alerts, identifying threats, and answering questions based on their findings. The exam is browser-accessible through the TryHackMe platform. Specific details about timing, scoring thresholds, and the exact number of tasks are available on the official TryHackMe certification page.

TryHackMe's SOC Level 1 and Cyber Defense learning paths are the most directly relevant preparation resources. Additional helpful practice includes Blue Team Labs Online challenges, CyberDefenders platform exercises, and the SANS Cyber Aces free training for foundational knowledge. Learning to use open-source SIEM tools like Wazuh or the ELK stack in a home lab environment provides valuable supplementary experience that strengthens exam readiness and real-world capabilities.

The SAL1 exam requires a TryHackMe premium subscription and a separate exam voucher purchase. The pricing is accessible compared to established blue team certifications from CompTIA or GIAC, making it a budget-friendly option for early-career professionals. The TryHackMe subscription includes extensive learning content beyond exam preparation. Visit the official TryHackMe certification page for current pricing, as rates and bundle options may change over time.