YoVDO

SC-200: Configure your Microsoft Sentinel environment

Offered By: Microsoft via Microsoft Learn

Tags

SC-200: Microsoft Security Operations Analyst Courses Threat Intelligence Courses KQL Courses Microsoft Sentinel Courses

Course Description

Overview

  • Module 1: Get familiar with Microsoft Sentinel, a cloud-native, security information and event management (SIEM) service.

    • By the end of this module, you will be able to:

    • Identify the various components and functionality of Microsoft Sentinel.
    • Identify use cases where Microsoft Sentinel would be a good solution.
  • Module 2: Create and manage Microsoft Sentinel workspaces

    • Upon completion of this module, the learner will be able to:

    • Describe Microsoft Sentinel workspace architecture
    • Install Microsoft Sentinel workspace
    • Manage an Microsoft Sentinel workspace
  • Module 3: Query logs in Microsoft Sentinel

    • Upon completion of this module, the learner will be able to:

    • Use the Logs page to view data tables in Microsoft Sentinel
    • Query the most used tables using Microsoft Sentinel
  • Module 4: Use watchlists in Microsoft Sentinel

    • Upon completion of this module, the learner will be able to:

    • Create a watchlist in Microsoft Sentinel
    • Use KQL to access the watchlist in Microsoft Sentinel
  • Module 5: Utilize threat intelligence in Microsoft Sentinel

    • Upon completion of this module, the learner will be able to:

    • Manage threat indicators in Microsoft Sentinel
    • Use KQL to access threat indicators in Microsoft Sentinel

Syllabus

  • Module 1: Introduction to Microsoft Sentinel
    • Introduction
    • What is Microsoft Sentinel?
    • How Microsoft Sentinel works
    • When to use Microsoft Sentinel
    • Knowledge check
    • Summary
  • Module 2: Create and manage Microsoft Sentinel workspaces
    • Introduction
    • Plan for the Azure Sentinel workspace
    • Create an Azure Sentinel workspace
    • Manage workspaces across tenants using Azure Lighthouse
    • Understand Azure Sentinel permissions and roles
    • Manage Azure Sentinel settings
    • Knowledge check
    • Summary and resources
  • Module 3: Query logs in Microsoft Sentinel
    • Introduction
    • Query logs in the logs page
    • Understand Azure Sentinel tables
    • Understand common tables
    • Understand Microsoft 365 Defender tables
    • Knowledge check
    • Summary and resources
  • Module 4: Use watchlists in Microsoft Sentinel
    • Introduction
    • Plan for watchlists
    • Create a watchlist
    • Knowledge check
    • Summary and resources
  • Module 5: Utilize threat intelligence in Microsoft Sentinel
    • Introduction
    • Define threat intelligence
    • Manage your threat indicators
    • View your threat indicators with KQL
    • Knowledge check
    • Summary and resources

Tags

Related Courses

Cloud-native security operations with Microsoft Sentinel
Microsoft via Microsoft Learn Microsoft Security, Compliance, and Identity Fundamentals: Describe the capabilities of Microsoft security solutions
Microsoft via Microsoft Learn MS-500 part 2 - Implement and manage threat protection
Microsoft via Microsoft Learn SC-200: Connect logs to Microsoft Sentinel
Microsoft via Microsoft Learn SC-200: Create detections and perform investigations using Microsoft Sentinel
Microsoft via Microsoft Learn