YoVDO

Configure SIEM security operations using Microsoft Sentinel

Offered By: Microsoft via Microsoft Learn

Tags

Microsoft Sentinel Courses Cybersecurity Courses Cloud Security Courses Threat Detection Courses

Course Description

Overview

Save Big on Coursera Plus. 7,000+ courses at $160 off. Limited Time Only!
  • Module 1: Create and manage Microsoft Sentinel workspaces

    Upon completion of this module, the learner will be able to:

    • Describe Microsoft Sentinel workspace architecture
    • Install Microsoft Sentinel workspace
    • Manage a Microsoft Sentinel workspace
  • Module 2: Connect Microsoft services to Microsoft Sentinel

    Upon completion of this module, the learner will be able to:

    • Connect Microsoft service connectors
    • Explain how connectors auto-create incidents in Microsoft Sentinel
  • Module 3: Connect Windows hosts to Microsoft Sentinel

    Upon completion of this module, the learner will be able to:

    • Connect Azure Windows Virtual Machines to Microsoft Sentinel
    • Connect non-Azure Windows hosts to Microsoft Sentinel
    • Configure Log Analytics agent to collect Sysmon events
  • Module 4: Threat detection with Microsoft Sentinel analytics

    In this module, you will:

    • Explain the importance of Microsoft Sentinel Analytics.
    • Explain different types of analytics rules.
    • Create rules from templates.
    • Create new analytics rules and queries using the analytics rule wizard.
    • Manage rules with modifications.
  • Module 5: Provide an introduction to implementing threat response with Microsoft Sentinel playbooks.

    In this module you will:

    • Explain Microsoft Sentinel SOAR capabilities.
    • Explore the Microsoft Sentinel Logic Apps connector.
    • Create a playbook to automate an incident response.
    • Run a playbook on demand in response to an incident.
  • Module 6: Configure security information and event management (SIEM) security operations using Microsoft Sentinel.

    Upon completion of this module, the learner is able to:

    • Create and configure a Microsoft Sentinel workspace
    • Deploy Microsoft Sentinel Content Hub solutions and data connectors
    • Configure Microsoft Sentinel Data Collection rules, NRT Analytic rule and Automation
    • Perform a simulated attack to validate Analytic and Automation rules

Syllabus

  • Module 1: Module 1: Create and manage Microsoft Sentinel workspaces
    • Introduction
    • Plan for the Microsoft Sentinel workspace
    • Create a Microsoft Sentinel workspace
    • Manage workspaces across tenants using Azure Lighthouse
    • Understand Microsoft Sentinel permissions and roles
    • Manage Microsoft Sentinel settings
    • Configure logs
    • Knowledge check
    • Summary and resources
  • Module 2: Module 2: Connect Microsoft services to Microsoft Sentinel
    • Introduction
    • Plan for Microsoft services connectors
    • Connect the Microsoft Office 365 connector
    • Connect the Microsoft Entra connector
    • Connect the Microsoft Entra ID Protection connector
    • Connect the Azure Activity connector
    • Knowledge check
    • Summary and resources
  • Module 3: Module 3: Connect Windows hosts to Microsoft Sentinel
    • Introduction
    • Plan for Windows hosts security events connector
    • Connect using the Windows Security Events via AMA Connector
    • Connect using the Security Events via Legacy Agent Connector
    • Collect Sysmon event logs
    • Knowledge check
    • Summary and resources
  • Module 4: Module 4: Threat detection with Microsoft Sentinel analytics
    • Introduction
    • Exercise - Detect threats with Microsoft Sentinel analytics
    • What is Microsoft Sentinel Analytics?
    • Types of analytics rules
    • Create an analytics rule from templates
    • Create an analytics rule from wizard
    • Manage analytics rules
    • Exercise - Detect threats with Microsoft Sentinel analytics
    • Summary
  • Module 5: Module 5: Threat response with Microsoft Sentinel playbooks
    • Introduction
    • Exercise - Create a Microsoft Sentinel playbook
    • What are Microsoft Sentinel playbooks?
    • Trigger a playbook in real-time
    • Run playbooks on demand
    • Exercise - Create a Microsoft Sentinel playbook
    • Summary
  • Module 6: Module 6: Configure SIEM security operations using Microsoft Sentinel
    • Introduction
    • Exercise - Configure SIEM operations using Microsoft Sentinel
    • Exercise - Install Microsoft Sentinel Content Hub solutions and data connectors
    • Exercise - Configure a data connector Data Collection Rule
    • Exercise - Perform a simulated attack to validate the Analytic and Automation rules
    • Summary

Tags

Related Courses

Microsoft Security, Compliance, and Identity Fundamentals: Describe the capabilities of Microsoft security solutions
Microsoft via Microsoft Learn SC-200: Configure your Microsoft Sentinel environment
Microsoft via Microsoft Learn SC-200: Connect logs to Microsoft Sentinel
Microsoft via Microsoft Learn SC-200: Create queries for Microsoft Sentinel using Kusto Query Language (KQL)
Microsoft via Microsoft Learn SC-200: Perform threat hunting in Microsoft Sentinel
Microsoft via Microsoft Learn