Start here
Free SOC Analyst Training
Free SOC analyst training comes in two forms: courses that explain how a SOC works, and labs where you investigate alerts yourself. TryHackMe, LetsDefend and CyberDefenders each give away part of their catalog. The SOCSimulator free tier is all labs, with alerts to triage in SIEM, XDR and Firewall consoles.
Right now 71 of the 143 operations in the catalog are free, and the 30-day plan below picks the ones to start with.
Reviewed October 2026 by SOCSimulator Research
Free courses vs free cybersecurity labs
A free course is reading, video and quizzes. It tells you what Event ID 4625 means, what a spoofed sender looks like in a header and how a SIEM correlates logs. You need that, and the free courses on TryHackMe and LetsDefend cover enough of it to get going.
A free lab hands you the evidence and asks a question. Which host beaconed out? Did the brute force succeed? Which process created the scheduled task? You only get good at answering those by answering them, with the logs in front of you and nobody pointing at the right line.
For the first month, take one short course per skill and put every other hour into labs. SOCSimulator only does the lab half, with practice in SIEM, XDR and Firewall consoles built to look like the ones a SOC uses.
What each free tier gives you
Checked against each platform's own pages on the date in the last column. Free tiers change often, so follow the link before you plan around one.
| Platform | Free | Paid | Best for | Verified |
|---|---|---|---|---|
| TryHackMe | 650+ free rooms, including SOC Fundamentals and the intro to defensive security. | Premium or MAX for structured paths, certifications and most of the Windows content. | Broad fundamentals (networking, Linux, web, a little offence) before you pick a lane. | Oct 23, 2026 (TryHackMe source) |
| LetsDefendSOCSimulator vs LetsDefend | Basic plan: the free courses, plus the first part of some advanced ones. | VIP or VIP+ for paths, hands-on labs inside courses, more SOC alerts and assessments. The platform is moving to Hack The Box: from October 15 new courses and challenges ship only there, and annual plans are discontinued. | A simulated SOC alert queue. Read the Hack The Box migration notice first: new content ships there, and the alert queue follows by the end of 2026. | Oct 23, 2026 (LetsDefend source) |
| CyberDefendersSOCSimulator vs CyberDefenders | A free account, and a lab catalog that splits labs into Community and Premium.Verified Oct 23, 2026 (CyberDefenders free labs source) | CyberRange at $25/month for every premium lab. Certifications (CCDL1, CCDL2) are a one-time purchase from $599. | Forensics depth: packet captures, disk and memory images, cloud logs. | Oct 23, 2026 (CyberDefenders source) |
| SOCSimulator | 71 free operations with SIEM, XDR and Firewall consoles, guided walkthroughs, learning tracks and ad-hoc queries in the Query Console. | Pro ($18/month) for Shift Mode, the Pro operations, performance analytics and saved queries. | Working an alert from first log line to verdict, the way a Tier 1 analyst does. | Oct 23, 2026 |
A 30-day free SOC analyst training plan
One skill a week, a few free operations each, easiest first. Every operation below is free today. When you finish a week early, pick another one on the same theme from the full operations catalog.
Days 1-7
Phishing and email triage
Start with the guided walkthroughs. Read the headers, follow the redirect chain and work out whether anyone clicked. The last one has no walkthrough, so you run the investigation yourself.
- QR Code Phishing: Scan to Compromiseeasy · 15 min
- Trusted Domain, Untrusted Destination: Open-Redirect Phishingeasy · 25 min
- Weaponized SVG: Embedded Code in an Image Attachmenteasy · 25 min
- EvilProxy AiTM: Indeed Redirect to M365 Cookie Theftmedium · 45 min
Days 8-14
Windows logons and brute force
Failed and successful logons (Event IDs 4625 and 4624), share access and VPN authentication. Every time, ask the same two questions: did a guess succeed, and what did that account do next?
- RDP Brute Force: Internet-Facing Server Logineasy · 25 min
- VPN Brute Force: Credential Attack on the Remote-Access Portaleasy · 25 min
- Open SMB Share: Unauthorized Data Accesseasy · 25 min
Days 15-21
Endpoint detection (EDR and XDR)
Process trees, encoded PowerShell, scheduled tasks and run keys. Find the parent process, the persistence and the outbound beacon, in that order.
Days 22-28
Firewall and edge devices
Each one starts on an internet-facing system: an exposed server, a VPN gateway, a firewall's management interface. Read firewall and VPN logs to spot the exploit, then follow the attacker inside. The last operation is rated hard and takes over an hour.
- Wide Openeasy · 25 min
- PAN-OS GlobalProtect: Command Injection (CVE-2024-3400)medium · 45 min
- Operation Lunar Peek: PAN-OS Mgmt Interface Takeoverhard · 75 min
Days 29-30
Write it up
Replay the operation you found hardest, then write a one-page incident summary: what fired, what you checked, what you concluded and what you would escalate. The investigation playbooks make a good outline. A write-up like that is something you can walk an interviewer through.
What the SOCSimulator free tier covers, and what it does not
In the free tier
- Every free operation, with no monthly cap
- SIEM, XDR and Firewall consoles
- Guided walkthroughs for your first operations
- Learning tracks grouped by threat theme
- MITRE ATT&CK® mapping
- Ad-hoc queries in the Query Console
Pro only
- Shift Mode: a real-time shift with a live alert stream
- The other 72 operations
- Performance analytics
- Saved queries, query history across sessions and CSV export
Pro is $18/month. Compare plans
Questions about free SOC training
Can I get SOC analyst training for free?
Yes. TryHackMe, LetsDefend and CyberDefenders all have free content, and SOCSimulator has a free tier with hands-on operations in SIEM, XDR and Firewall consoles. Free courses teach the concepts. Free labs make you apply them to evidence that looks like a real SOC queue.
Is there a free SOC analyst course?
TryHackMe's SOC Fundamentals room and LetsDefend's free courses cover what a SOC does and how alerts flow. Neither gives you the full career path for free; both keep structured paths behind a subscription. Pair one free course with a free lab platform so you practise what you read the same week.
Where can I find free SOC labs?
CyberDefenders has a free account and Community labs alongside its Premium ones, with a forensics slant. SOCSimulator's free operations are alert investigations: you get an alert, the logs behind it and a set of questions to answer in a SIEM, XDR or Firewall console. TryHackMe has free defensive rooms too, though most of its Windows content needs a subscription.
What does the SOCSimulator free tier include?
Every free operation, with no monthly cap. The free tier includes the SIEM, XDR and Firewall consoles, guided walkthroughs, learning tracks and ad-hoc queries in the Query Console. Pro adds Shift Mode, the Pro operations, performance analytics and the saved-query workflow.
How long does SOC analyst training take?
A focused month gets you through the core alert types: phishing, logons, endpoint and network. That is what the plan on this page covers, at roughly one operation every other day. Job-ready takes longer than a month. Keep the same habit after day 30, and add a certification if the roles you want ask for one.
Day 1 is a short guided walkthrough
Create a free account and open the first phishing operation.