YoVDO

Configure SIEM security operations using Microsoft Sentinel

Offered By: Microsoft via Microsoft Learn

Tags

Microsoft Sentinel Courses Cybersecurity Courses Cloud Security Courses Threat Detection Courses

Course Description

Overview

Save Big on Coursera Plus. 7,000+ courses at $160 off. Limited Time Only!
  • Module 1: Create and manage Microsoft Sentinel workspaces

    Upon completion of this module, the learner will be able to:

    • Describe Microsoft Sentinel workspace architecture
    • Install Microsoft Sentinel workspace
    • Manage a Microsoft Sentinel workspace
  • Module 2: Connect Microsoft services to Microsoft Sentinel

    Upon completion of this module, the learner will be able to:

    • Connect Microsoft service connectors
    • Explain how connectors auto-create incidents in Microsoft Sentinel
  • Module 3: Connect Windows hosts to Microsoft Sentinel

    Upon completion of this module, the learner will be able to:

    • Connect Azure Windows Virtual Machines to Microsoft Sentinel
    • Connect non-Azure Windows hosts to Microsoft Sentinel
    • Configure Log Analytics agent to collect Sysmon events
  • Module 4: Threat detection with Microsoft Sentinel analytics

    In this module, you will:

    • Explain the importance of Microsoft Sentinel Analytics.
    • Explain different types of analytics rules.
    • Create rules from templates.
    • Create new analytics rules and queries using the analytics rule wizard.
    • Manage rules with modifications.
  • Module 5: Provide an introduction to implementing threat response with Microsoft Sentinel playbooks.

    In this module you will:

    • Explain Microsoft Sentinel SOAR capabilities.
    • Explore the Microsoft Sentinel Logic Apps connector.
    • Create a playbook to automate an incident response.
    • Run a playbook on demand in response to an incident.
  • Module 6: Configure security information and event management (SIEM) security operations using Microsoft Sentinel.

    Upon completion of this module, the learner is able to:

    • Create and configure a Microsoft Sentinel workspace
    • Deploy Microsoft Sentinel Content Hub solutions and data connectors
    • Configure Microsoft Sentinel Data Collection rules, NRT Analytic rule and Automation
    • Perform a simulated attack to validate Analytic and Automation rules

Syllabus

  • Module 1: Module 1: Create and manage Microsoft Sentinel workspaces
    • Introduction
    • Plan for the Microsoft Sentinel workspace
    • Create a Microsoft Sentinel workspace
    • Manage workspaces across tenants using Azure Lighthouse
    • Understand Microsoft Sentinel permissions and roles
    • Manage Microsoft Sentinel settings
    • Configure logs
    • Knowledge check
    • Summary and resources
  • Module 2: Module 2: Connect Microsoft services to Microsoft Sentinel
    • Introduction
    • Plan for Microsoft services connectors
    • Connect the Microsoft Office 365 connector
    • Connect the Microsoft Entra connector
    • Connect the Microsoft Entra ID Protection connector
    • Connect the Azure Activity connector
    • Knowledge check
    • Summary and resources
  • Module 3: Module 3: Connect Windows hosts to Microsoft Sentinel
    • Introduction
    • Plan for Windows hosts security events connector
    • Connect using the Windows Security Events via AMA Connector
    • Connect using the Security Events via Legacy Agent Connector
    • Collect Sysmon event logs
    • Knowledge check
    • Summary and resources
  • Module 4: Module 4: Threat detection with Microsoft Sentinel analytics
    • Introduction
    • Exercise - Detect threats with Microsoft Sentinel analytics
    • What is Microsoft Sentinel Analytics?
    • Types of analytics rules
    • Create an analytics rule from templates
    • Create an analytics rule from wizard
    • Manage analytics rules
    • Exercise - Detect threats with Microsoft Sentinel analytics
    • Summary
  • Module 5: Module 5: Threat response with Microsoft Sentinel playbooks
    • Introduction
    • Exercise - Create a Microsoft Sentinel playbook
    • What are Microsoft Sentinel playbooks?
    • Trigger a playbook in real-time
    • Run playbooks on demand
    • Exercise - Create a Microsoft Sentinel playbook
    • Summary
  • Module 6: Module 6: Configure SIEM security operations using Microsoft Sentinel
    • Introduction
    • Exercise - Configure SIEM operations using Microsoft Sentinel
    • Exercise - Install Microsoft Sentinel Content Hub solutions and data connectors
    • Exercise - Configure a data connector Data Collection Rule
    • Exercise - Perform a simulated attack to validate the Analytic and Automation rules
    • Summary

Tags

Related Courses

Computer Security
Stanford University via Coursera Cryptography II
Stanford University via Coursera Malicious Software and its Underground Economy: Two Sides to Every Story
University of London International Programmes via Coursera Building an Information Risk Management Toolkit
University of Washington via Coursera Introduction to Cybersecurity
National Cybersecurity Institute at Excelsior College via Canvas Network