Zero to Job Ready for Free

Professor Messer — CompTIA Network+ N10-009 (Full free course)

professormesser.com/network-plus/n10-009

Cisco NetAcad — NDG Linux Essentials (Free)

Official Cisco-backed Linux course. Hands-on labs, no install needed. Covers everything from CLI navigation to file permissions and bash scripting intro.

netacad.com

↗ Lab

TryHackMe — Pre-Security Learning Path (Free)

Browser-based guided labs. Start here before anything else on THM. Covers networking, web, Linux all in one structured path.

tryhackme.com/path/outline/presecurity

NetworkChuck — YouTube (Free)

"Linux for hackers" series + OSI and TCP/IP explainer videos. Fast-paced, practical, and genuinely engaging. Perfect supplement.

youtube.com/@NetworkChuck

VirtualBox — Free VM Hypervisor

Install this first. Runs your Ubuntu, Windows Server, Kali, and pfSense VMs for free on any PC or Mac.

virtualbox.org

Wireshark — Packet Analyser (Free)

Industry-standard network traffic analyser. Install this early — capturing your first TCP handshake makes all the theory click instantly.

wireshark.org

SubnettingPractice.com (Free)

Unlimited subnetting drills. Do 20 problems a day until it's instinctive. Subnetting comes up in every SOC interview.

subnettingpractice.com

OverTheWire — Bandit (Free, no login)

The best free Linux CLI training that exists. Gamified puzzles force you to use grep, find, pipes, ssh. Levels 0–20 cover everything in this phase.

overthewire.org/wargames/bandit

Hindi Me Tech — YouTube (Free)

Video

Networking fundamentals explained in Hindi. OSI Model, TCP/IP, IP Addressing — all clearly covered for beginners.

OSI मॉडल, TCP/IP, नेटवर्किंग की पूरी basics हिंदी में — बिल्कुल शुरुआत से।

youtube.com/@HindiMeTech

Geeky Shows — YouTube (Free)

Complete Networking + Linux tutorials in Hindi. One of the most popular tech education channels in India. Very structured playlist format.

Networking और Linux की complete tutorials हिंदी में। बहुत structured playlist — beginners के लिए perfect।

youtube.com/@GeekyShows

Code With Harry — Linux & Networking (Free)

India का सबसे popular tech channel। Linux CLI और networking की tutorials — लाखों students follow करते हैं।

youtube.com/@CodeWithHarry

Sunil Dhanak — Networking Hindi (Free)

Dedicated networking educator in Hindi. Covers subnetting, OSI model, routing, switching in depth. Exam-oriented explanations.

Subnetting और OSI model की depth में explanation हिंदी में — exam के लिए बहुत useful।

youtube.com/@SunilDhanak

Technical Guruji — Tech Concepts Hindi (Free)

Clear Hindi explanations of networking concepts, cybersecurity basics, and how the internet works. Great for complete beginners.

Internet कैसे काम करता है, networking concepts — बिल्कुल simple हिंदी में। नए learners के लिए best।

youtube.com/@TechnicalGuruji

Apna College — Linux & OS Concepts (Free)

Free structured courses in Hindi covering Linux fundamentals and operating system basics. Clear teaching style, widely recommended.

Linux fundamentals और OS concepts — free structured course हिंदी में। बहुत clear explanation।

youtube.com/@ApnaCollege

Phase 1 checklist

WatchComplete Professor Messer Network+ Section 1 (Networking Fundamentals) — ~4 hrs video

LabInstall VirtualBox + create Ubuntu 22.04 LTS VM + Kali Linux VM

LabOpen Wireshark and capture a TCP 3-way handshake. Identify SYN, SYN-ACK, ACK packets by hand.

THMComplete TryHackMe rooms: What is Networking? + Introductory Networking + Packets and Frames

PracticeScore 80%+ on SubnettingPractice.com 20-question drill without help. Can answer: what is /24? /28? How many hosts?

THMComplete THM: DNS in Detail + HTTP in Detail + How Websites Work

LabOverTheWire Bandit — complete levels 0–15

PortfolioCreate GitHub repo "soc-home-lab" with a README, network diagram, and screenshots of your lab setup

Portfolio project

🔬

Home lab network build

VirtualBox with pfSense firewall VM + Ubuntu VM + Windows VM. Network diagram, setup documentation, firewall rules. Push to GitHub with screenshots.

portfolio #1

📡

Wireshark capture analysis

Capture real network traffic. Annotate a TCP handshake, a DNS query, and an HTTP request. Write a 1-page summary of what you found. Add to GitHub.

portfolio #2

Months 2–4

Security Fundamentals + First Cert

CIA triad, threat types, cryptography basics, SIEM concepts, incident response intro. Prep and pass CompTIA Security+.

▾

Topics to cover

CIA triad Threat actors & vectors Vulnerability management Cryptography basics (AES, RSA, hashing) PKI & certificates Authentication (MFA, SSO) SIEM concepts Incident response intro Malware categories Social engineering

Target certification

🏆

CompTIA Security+ (SY0-701)

The most widely recognised entry-level security certification. Required or preferred by the majority of SOC Analyst job postings. Prep is 100% free via Professor Messer. Exam cost ~$392 (many employers reimburse or sponsor).

Free resources

Professor Messer — Security+ SY0-701 (Full free course)

Complete video course, perfectly aligned to the SY0-701 exam. The single best free resource for this certification. Watch alongside practice questions.

professormesser.com/security-plus/sy0-701

IBM Cybersecurity Analyst Certificate — Coursera (Audit free)

Click "Audit" (not Enrol) to access all videos and readings free. Covers SIEM, threat intelligence, phishing, and practical SOC analyst skills across 8 courses.

coursera.org → search "IBM Cybersecurity Analyst" → Audit

↗ Lab

TryHackMe — SOC Level 1 Learning Path

Covers alerts, phishing analysis, log analysis, Splunk, and network traffic analysis. Directly relevant to Tier 1 SOC work. Many rooms free.

tryhackme.com/path/outline/soclevel1

Cybrary — SOC Analyst Career Path (Free tier)

Free tier includes core SOC analyst video courses. Good for theory and tool overviews. Complements hands-on lab work from THM.

cybrary.it

Wazuh SIEM — Open Source, Free

Deploy in your home lab VM. Connect your Windows VM as an agent. Generates real alerts you can investigate. The best free SIEM for learning.

wazuh.com

PhishTank — Real Phishing Samples (Free)

Community-sourced verified phishing URLs. Use these to practise phishing email/URL analysis — a core daily task in any SOC.

phishtank.com

ANY.RUN — Interactive Malware Sandbox (Free tier)

Run suspicious files/URLs safely. Free tier gives 60-second public analysis sessions. Use this for phishing analysis and malware investigation tasks.

any.run

Tech Chip — Cybersecurity Hindi (Free)

Video

Cybersecurity concepts explained in Hindi. Covers CIA triad, types of malware, phishing, encryption basics — exactly what Security+ tests.

CIA triad, malware types, phishing, encryption — Security+ के topics हिंदी में clearly explain किए गए हैं।

youtube.com/@TechChipIN

Hacker Roy Hindi — Ethical Hacking & Security (Free)

Ethical hacking and cybersecurity basics in Hindi. Covers SIEM concepts, incident response, and security fundamentals for beginners.

Ethical hacking और cybersecurity की basics हिंदी में — SIEM, incident response सब कुछ beginners के लिए।

youtube.com/@HackerRoyHindi

Sunil Dhanak — Security+ Hindi Prep (Free)

Security concepts and CompTIA preparation in Hindi. Covers cryptography, authentication, vulnerability management clearly.

CompTIA Security+ की preparation हिंदी में — cryptography, authentication, vulnerability management सब cover किया।

youtube.com/@SunilDhanak

Technical Sagar — Cyber Security Hindi (Free)

Practical cybersecurity demonstrations in Hindi. Phishing analysis, malware overview, security tools explained with live demos.

Phishing analysis और security tools की live demos हिंदी में — practical और easy to follow।

youtube.com/c/TechnicalSagar

InfosecTrain Hindi — Security Certifications (Free)

Free Hindi content for Security+ and cybersecurity certifications. Professional quality from a recognized training institute.

Security+ और cybersecurity certifications के लिए free Hindi content — professional training institute की quality।

youtube.com/@InfosecTrain_Hindi

Phase 2 checklist

WatchComplete Professor Messer Security+ SY0-701 full video course

CourseAudit IBM Cybersecurity Analyst Certificate on Coursera (courses 1–4 minimum)

LabDeploy Wazuh SIEM on Ubuntu VM. Connect Windows VM as agent. Verify alerts are flowing.

PracticeAnalyse 5 phishing samples from PhishTank. Write a 1-page report per sample (headers, IOCs, verdict).

THMComplete TryHackMe SOC Level 1 path — at minimum the Phishing and Log Analysis sections

ExamPass Professor Messer's free practice exam with 80%+ before booking the real Security+ test

PortfolioGitHub: add phishing analysis reports and Wazuh SIEM setup documentation as separate repo

Portfolio projects

📧

Phishing analysis series

Analyse 5+ real phishing samples. For each: extract email headers, identify IOCs, check URLs in VirusTotal, write verdict. Host on GitHub.

portfolio #3

🛡️

Wazuh SIEM lab

Deploy Wazuh, generate alerts (failed logins, port scans), write 3–5 custom detection rules. Document with screenshots and rule logic.

portfolio #4

Months 4–7

Core SOC Analyst Skills

SIEM (Splunk/Elastic), log analysis, Wireshark deep-dive, IDS/IPS, MITRE ATT&CK, threat intelligence, incident response process.

▾

Topics to cover

Splunk (SPL queries) Elastic SIEM (KQL) Windows Event logs (IDs) Sysmon & Syslog Wireshark deep analysis Suricata / Snort IDS MITRE ATT&CK framework OSINT techniques Threat intelligence (IOCs) Sigma rules Alert triage process Ticket handling

Free resources

Splunk — Fundamentals 1 (Official free course)

Official Splunk training. Covers the search interface, SPL queries, dashboards. This is the tool used in most enterprise SOCs. Free to register.

splunk.com/en_us/training/free-courses

Elastic — Free Security Training

Official ELK stack training. Elastic Security is widely used in SOC environments. Free fundamentals course covers data ingestion, detection rules, KQL queries.

elastic.co/training/free

Blue Team Labs Online (Free tier)

Realistic defensive security challenges: log analysis, PCAP investigation, threat hunting. Free tier gives access to enough challenges to build genuine skills.

blueteamlabs.online

LetsDefend.io — Simulated SOC (Free incidents)

Simulates a real SOC environment. You receive alerts, investigate them, write reports, and escalate. Free tier includes real incidents to work through.

letsdefend.io

CyberDefenders — Blue Team CTF (Free)

PCAP analysis, memory forensics, log investigation challenges. Excellent for building real investigative skills. Many challenges are free.

cyberdefenders.org

↗ Reference

MITRE ATT&CK Framework (Free)

The definitive reference for adversary tactics, techniques, and procedures (TTPs). Learn this deeply — it's the common language of every SOC team worldwide.

attack.mitre.org

↗ Dataset

Splunk BOTS (Boss of the SOC) Dataset — GitHub (Free)

Real attack scenario data from Splunk's annual CTF. Ingest into Splunk Free (500MB/day) and investigate end-to-end attack chains. Massive portfolio value.

github.com/splunk/botsv3

↗ Dataset

Malware-Traffic-Analysis.net — Free PCAP samples

Hundreds of real malware PCAP files with write-up answers to check your work. The best free source for hands-on Wireshark malware analysis practice.

malware-traffic-analysis.net

↗ Reference

EventID.net — Windows Event ID Reference (Free)

Explains every Windows Security Event ID. Bookmark this immediately — you'll reference it daily as a SOC analyst. 4624=logon, 4625=failed, 4688=process creation.

eventid.net

Tech Defence Hindi — SOC & Blue Team (Free)

Video

SOC analyst workflow, SIEM basics, log analysis concepts explained in Hindi. Covers Splunk and Elastic in Hindi for Indian learners.

SOC analyst workflow, SIEM, Splunk — सब हिंदी में। Indian learners के लिए specifically बनाया गया।

youtube.com/@TechDefenceHindi

Splunk Tutorial in Hindi — YouTube Search

Multiple creators have made Splunk tutorials in Hindi. Search this query and filter by upload date for the most current content.

Splunk tutorials हिंदी में — कई creators ने बनाए हैं। इस query से search करें और latest videos देखें।

Search: "splunk tutorial hindi" on YouTube

Hacker Roy Hindi — MITRE ATT&CK & Threat Intel (Free)

MITRE ATT&CK framework, threat intelligence concepts, and network traffic analysis explained in Hindi with practical demonstrations.

MITRE ATT&CK, threat intelligence — practical demonstrations के साथ हिंदी में। Wireshark analysis भी cover किया।

youtube.com/@HackerRoyHindi

Wireshark Hindi Tutorials — YouTube Search

Several Indian creators have detailed Wireshark tutorials in Hindi. Search and pick the most viewed recent video series.

Wireshark tutorials हिंदी में — "wireshark tutorial hindi" YouTube पर search करें, most-viewed series चुनें।

Search: "wireshark tutorial hindi" on YouTube

Technical Sagar — Log Analysis Hindi (Free)

Windows Event log analysis and incident response basics in Hindi. Covers Event IDs, log formats, and how to read security logs.

Windows Event logs और incident response हिंदी में — Event IDs, log formats, security logs कैसे पढ़ें।

youtube.com/@TechnicalSagarOfficial

REMnux — Linux Malware Analysis Distro (Free)

Phase 3 checklist

CourseComplete Splunk Fundamentals 1 official free course. Write 10 real SPL queries in your lab.

LabIngest BOTS v3 dataset into Splunk Free. Investigate and document 3 full attack scenarios.

LabAnalyse 5 malware PCAPs from malware-traffic-analysis.net. Write analysis for each.

StudyRead MITRE ATT&CK for one APT group (e.g. APT29). Map 5+ techniques to real detection ideas.

PracticeComplete 5+ challenges on LetsDefend.io (use the free incident queue)

PracticeComplete 3+ challenges on CyberDefenders (PCAP or log analysis category)

PortfolioPublish 3 Wireshark PCAP write-ups to GitHub. Write a MITRE ATT&CK threat hunt report.

Portfolio projects

🔍

Splunk BOTS investigation

Use the BOTS v3 dataset to investigate real attack scenarios in Splunk. Document timeline, IOCs, SPL queries used, and attacker goals for 3 scenarios.

portfolio #5

🌐

Wireshark PCAP analysis series

Analyse 5 malware PCAPs from malware-traffic-analysis.net. Step-by-step write-ups with screenshots, IOCs, Wireshark filters used, and verdict.

portfolio #6

🎯

MITRE ATT&CK threat hunt report

Pick an APT (e.g. APT29). Map their TTPs. Simulate 2–3 techniques in your lab. Write detection rules in Sigma format. Host full report on GitHub.

portfolio #7

Months 7–10

Advanced Skills + Second Cert

Threat hunting, digital forensics, malware analysis, Python automation, SOAR concepts, cloud security basics. Target Blue Team Level 1 (BTL1).

▾

Topics to cover

Threat hunting methodology Digital forensics (Autopsy, FTK Imager) Memory forensics (Volatility) Static malware analysis Dynamic malware analysis Python scripting for SOC Log parsing automation SOAR concepts AWS/Azure security basics IR playbook writing

Target certification

🎖️

Blue Team Level 1 (BTL1) — Security Blue Team

Highly practical, 24-hour hands-on exam. Widely recognised for SOC roles. Covers SIEM, phishing, threat intel, digital forensics, and incident response. Exam ~$399. If budget is tight: audit the Google Cybersecurity Certificate on Coursera for free as an alternative path.

Free resources

Tool

Free Linux distribution pre-loaded with every malware analysis tool you need: strings, pestudio, FLOSS, Ghidra, Wireshark, and more. Download and run in VirtualBox.

remnux.org

Volatility — Memory Forensics Framework (Free)

Industry-standard memory forensics tool. Extract processes, network connections, and injected code from RAM dumps. Free and open source.

volatilityfoundation.org

Autopsy — Digital Forensics Platform (Free)

GUI-based forensics tool used by law enforcement and SOC teams. Free, open source. Use it to analyse disk images in your home lab.

autopsy.com

John Hammond — YouTube (Free)

Malware analysis walkthroughs, forensics, threat hunting. Exceptionally high quality. Watch his malware series alongside your Remnux lab work.

youtube.com/@_JohnHammond

Hack The Box — Sherlocks (Blue team challenges)

HTB's defensive track. PCAP analysis, forensic investigation, log analysis. Free tier access to selected challenges. Excellent for portfolio write-ups.

hackthebox.com/hacker/sherlocks

Python Official Tutorial (Free)

You don't need to be a developer. Learn enough Python to: parse log files, interact with APIs (VirusTotal), automate repetitive triage tasks. Chapters 1–9 are enough.

docs.python.org/3/tutorial

VirusTotal — File/URL/IP Analysis (Free tier)

Free API and web interface to check files, URLs, and IPs against 70+ AV engines. Core daily tool for any SOC analyst. Free public API for automation.

virustotal.com

Code With Harry — Python Hindi (Free, Full Course)

Complete Python tutorial in Hindi — the most watched Python course in India. Covers everything from basics to file handling and APIs needed for SOC scripting.

India का सबसे popular Python course हिंदी में — बिल्कुल शुरुआत से log parsing और API automation तक।

youtube.com/@CodeWithHarry — search "Python tutorial Hindi"

Malware Analysis Hindi — YouTube Search

Growing content area — multiple creators now explain malware analysis in Hindi including REMnux usage and static/dynamic analysis techniques.

Malware analysis हिंदी में — "malware analysis hindi" YouTube पर search करें। REMnux और static/dynamic analysis के videos मिलेंगे।

Search: "malware analysis hindi" on YouTube

Hacker Roy Hindi — Digital Forensics Hindi (Free)

Digital forensics and incident response concepts in Hindi. Covers memory forensics, disk forensics, and threat hunting methodology.

Digital forensics और memory forensics हिंदी में — Volatility और Autopsy के concepts explain किए गए हैं।

youtube.com/@HackerRoyHindi

Python for Cybersecurity Hindi — YouTube Search

Several channels cover Python automation for security tasks in Hindi — log parsing scripts, API integration, and SOC automation use cases.

"python for cybersecurity hindi" search करें — log parsing, VirusTotal API, automation scripts हिंदी में सिखाए जाते हैं।

Search: "python for cybersecurity hindi" on YouTube

Technical Sagar — Threat Hunting Hindi (Free)

Threat hunting concepts and incident response in Hindi. Practical demonstrations using free tools. Good for Phase 4 advanced topics.

Threat hunting और incident response हिंदी में — free tools के साथ practical demonstrations।

youtube.com/@TechnicalSagar

Daniel Miessler — SOC Interview Questions (GitHub)

Phase 4 checklist

SetupInstall REMnux in VirtualBox. Familiarise yourself with the core tools (strings, pestudio, FLOSS).

LabAnalyse 3 malware samples: static (PE headers, strings, imports) + dynamic (ANY.RUN sandbox). Write full threat reports.

LabUse Volatility on a memory image (use CyberDefenders free challenges). Identify injected processes.

CodeWrite a Python script that reads a log file, extracts failed login IPs, queries VirusTotal API, and outputs a triage report.

PracticeComplete 3 Hack The Box Sherlocks challenges. Publish write-ups to GitHub.

WriteWrite 3 IR playbooks in Markdown: ransomware response, phishing response, brute force response. Host on GitHub Pages.

CertRegister and pass BTL1 exam (or audit Google Cybersecurity Certificate as free alternative)

Portfolio projects

🦠

Malware analysis lab reports

3 full malware analysis reports using REMnux + ANY.RUN. Cover static and dynamic analysis, network IOCs, registry changes, and threat verdict.

portfolio #8

🐍

Python SOC automation script

Open-source Python tool: reads Splunk/Wazuh alerts, enriches IPs via VirusTotal API, outputs triage report. GitHub with README and demo GIF.

portfolio #9

📋

IR playbook documentation

3 professional incident response playbooks (ransomware, phishing, brute force) with detection criteria, containment steps, eradication, and recovery.

portfolio #10

Months 10–12

Resume, Portfolio & Job Search

Build a job-ready resume, polish your GitHub portfolio, set up LinkedIn, prep for technical interviews, and start applying confidently.

▾

Resume essentials

1 page, ATS-optimised Skills section: list every tool GitHub links in projects section Certs listed prominently Quantify impact where possible No generic objectives section

Free resources

Reference

100+ real SOC analyst interview questions with model answers. Work through all of them. Covers everything from "what is a SIEM?" to deep PCAP analysis questions.

github.com/danielmiessler

↗ Jobs

LinkedIn Jobs — SOC Analyst listings

Set up job alerts for "SOC Analyst", "Security Analyst", "Tier 1 SOC", "Junior SOC". LinkedIn is where the majority of recruiters source entry-level candidates.

linkedin.com/jobs

↗ Jobs

Indeed — SOC Analyst job board

Free. Apply daily. Filter by "entry level" and sort by date. Don't wait for perfect postings — apply if you meet 60%+ of requirements.

indeed.com

CyberSeek — Cybersecurity Career Heatmap (Free)

Shows where cybersecurity jobs are concentrated, what certs employers want, and salary ranges. Useful for targeting your applications geographically.

cyberseek.org/heatmap.html

↗ Portfolio

GitHub — Free portfolio hosting

Every project needs a public GitHub repo with a polished README. Use GitHub Pages to host your IR playbooks as a website. Recruiters check this.

github.com

↗ Blog

Medium — Write-up blog (Free)

Publish CTF write-ups, lab walkthroughs, and analysis reports on Medium. This builds your public presence and demonstrates writing skills — critical for SOC roles.

medium.com

Naukri.com — SOC Analyst Jobs India

Jobs

India's largest job board. Search "SOC Analyst", "Security Analyst", "Cyber Security Analyst". Set up daily email alerts. Many Indian MSSP companies hire from here.

India का सबसे बड़ा job portal — "SOC Analyst" search करें और daily email alerts set करें। Indian MSSPs यहाँ actively hire करते हैं।

naukri.com/soc-analyst-jobs

↗ Jobs

LinkedIn — SOC Analyst Jobs India

Filter by India location. Target companies: Wipro, TCS, Infosys, HCL, Accenture, IBM India — all have large cybersecurity practices that hire freshers with certs.

India में filter करें। TCS, Wipro, Infosys, HCL, Accenture — ये सब cyber security fresher hire करते हैं certs के साथ।

linkedin.com/jobs — location: India

↗ Internship

Internshala — Cybersecurity Internships India

Get your first cybersecurity role through an internship — many lead to full-time. Great starting point when you have skills but no formal experience.

Cybersecurity internship से शुरुआत करें — experience नहीं है तो भी skills हैं तो internship मिल सकती है। बहुत full-time roles में convert होती हैं।

internshala.com/internships/cyber-security-internship

SOC Interview Prep Hindi — YouTube Search

Multiple creators cover SOC and cybersecurity interview questions in Hindi. Watch 3–4 of these before interviews to understand what Indian hiring managers ask.

"SOC analyst interview questions hindi" search करें — Indian hiring managers क्या पूछते हैं यह समझने के लिए 3-4 videos जरूर देखें।

Search: "SOC analyst interview questions hindi" on YouTube

Cybersecurity Resume Hindi — YouTube Search

Hindi tutorials on building ATS-friendly resumes for IT and cybersecurity roles in India. Covers what Indian recruiters look for specifically.

Cybersecurity resume कैसे बनाएं हिंदी में — Indian recruiters क्या देखते हैं, ATS-friendly format — सब step-by-step।

Search: "cybersecurity resume hindi" on YouTube

↗ Gov

CERT-In — Indian Computer Emergency Response Team

India's official cybersecurity authority. Following CERT-In on LinkedIn and their site shows awareness of India-specific threats — a plus in Indian SOC interviews.

India की official cybersecurity authority। CERT-In को follow करें — Indian SOC interviews में India-specific threats की awareness बहुत काम आती है।

cert-in.org.in

IPs, MAC addresses, how the internet works. Start here — no prior knowledge needed.

Phase 5 checklist

ResumeWrite 1-page ATS-friendly resume. Skills section, projects with GitHub links, certs listed. Get it reviewed.

LinkedInOptimise LinkedIn: same content as resume, add skills endorsements, post 2–3 write-ups publicly

GitHubAll 8–10 portfolio projects have polished READMEs, screenshots, and clear descriptions. Profile README pinned.

PrepWork through Daniel Miessler's SOC interview question list. Answer every question out loud.

ApplyApply to minimum 5 positions per week. Track applications in a spreadsheet (company, role, date, status).

NetworkConnect with 3–5 SOC professionals on LinkedIn per week. Comment on their posts. Build visibility.

TryHackMe free rooms

Best Free TryHackMe Rooms

Do these in order. All confirmed free as of 2026. If a room goes behind paywall, check github.com/winterrdog/tryhackme-free-rooms for the latest list.

Phase 1 — Networking basics

Room 01

What is Networking?

tryhackme.com/room/whatisnetworking

OSI model + TCP/IP model with guided hands-on questions. Directly covers Week 1 material.

Room 02

Introductory Networking

tryhackme.com/room/introtonetworking

Dedicated room, one layer at a time. Task per layer. Best for cementing OSI knowledge.

Room 03

OSI Model

tryhackme.com/room/osimodelzi

TCP/IP packets, IP headers, ports. Includes TCP 3-way handshake simulation you work through interactively.

Room 04

Packets and Frames

tryhackme.com/room/packetsframes

DNS record types (A, AAAA, MX, CNAME, TXT), resolution process, practical nslookup simulation.

Room 05

DNS in Detail

tryhackme.com/room/dnsindetail

HTTP methods, status codes (200, 301, 403, 404), headers, cookies. Daily content in SOC alert analysis.

Room 06

HTTP in Detail

tryhackme.com/room/httpindetail

End-to-end: what happens when you type a URL. Ties DNS, HTTP, and HTML together in one flow.

Room 07

How Websites Work

tryhackme.com/room/howwebsiteswork

Capstone room for the networking module. Connects all prior rooms into one cohesive flow.

Room 08

Putting it All Together

tryhackme.com/room/puttingitalltogether

Interface navigation, display filters, following TCP streams, PCAP analysis. Essential before any malware traffic analysis work.

Phase 2–3 — SOC tools & analysis

Room 09

Wireshark: The Basics

tryhackme.com/room/wiresharkthebasics

Port scanning types, service detection, OS fingerprinting. You'll see nmap in every SOC environment.

Room 10

Nmap (Further)

tryhackme.com/room/furthernmap

SPL queries, event search, dashboards. Use alongside Splunk Fundamentals 1 course.

Room 11

Splunk 101

tryhackme.com/room/splunk101

Introduction to IDS/IPS. Write detection rules, analyse alerts. Snort and Suricata are used in enterprise SOCs.

Room 12

Snort

tryhackme.com/room/snort