YoVDO

SC-200: Connect logs to Microsoft Sentinel

Offered By: Microsoft via Microsoft Learn

Tags

SC-200: Microsoft Security Operations Analyst Courses Threat Intelligence Courses Threat Detection Courses Microsoft Sentinel Courses

Course Description

Overview

  • Module 1: Connect data to Microsoft Sentinel using data connectors

    • Upon completion of this module, the learner will be able to:

    • Explain the use of data connectors in Microsoft Sentinel
    • Describe the Microsoft Sentinel data connector providers
    • Explain the Common Event Format and Syslog connector differences in Microsoft Sentinel
  • Module 2: Connect Microsoft services to Microsoft Sentinel

    • Upon completion of this module, the learner will be able to:

    • Connect Microsoft service connectors
    • Explain how connectors auto-create incidents in Microsoft Sentinel
  • Module 3: Connect Microsoft 365 Defender to Microsoft Sentinel

    • Upon completion of this module, the learner will be able to:

    • Activate the Microsoft 365 Defender connector in Microsoft Sentinel
    • Activate the Microsoft Defender for Endpoint connector in Microsoft Sentinel
    • Activate the Microsoft Defender for Office 365 connector in Microsoft Sentinel
  • Module 4: Connect Windows hosts to Microsoft Sentinel

    • Upon completion of this module, the learner will be able to:

    • Connect Azure Windows Virtual Machines to Microsoft Sentinel
    • Connect non-Azure Windows hosts to Microsoft Sentinel
    • Configure Log Analytics agent to collect Sysmon events
  • Module 5: Connect Common Event Format logs to Microsoft Sentinel

    • Upon completion of this module, the learner will be able to:

    • Explain the Common Event Format connector deployment options in Microsoft Sentinel
    • Run the deployment script for the Common Event Format connector
  • Module 6: Connect syslog data sources to Microsoft Sentinel

    • Upon completion of this module, the learner will be able to:

    • Describe the Syslog connector deployment options in Microsoft Sentinel
    • Run the connector deployment script to send data to Microsoft Sentinel
    • Configure the Log Analytics agent integration for Microsoft Sentinel
    • Create a parse using KQL in Microsoft Sentinel
  • Module 7: Connect threat indicators to Microsoft Sentinel

    • Upon completion of this module, the learner will be able to:

    • Configure the TAXII connector in Microsoft Sentinel
    • Configure the Threat Intelligence Platform connector in Microsoft Sentinel
    • View threat indicators in Microsoft Sentinel

Syllabus

  • Module 1: Connect data to Microsoft Sentinel using data connectors
    • Introduction
    • Ingest log data with data connectors
    • Understand data connector providers
    • View connected hosts
    • Knowledge check
    • Summary and resources
  • Module 2: Connect Microsoft services to Microsoft Sentinel
    • Introduction
    • Plan for Microsoft services connectors
    • Connect the Microsoft Office 365 connector
    • Connect the Azure Active Directory connector
    • Connect the Azure Active Directory identity protection connector
    • Knowledge check
    • Summary and resources
  • Module 3: Connect Microsoft 365 Defender to Microsoft Sentinel
    • Introduction
    • Plan for Microsoft 365 Defender connectors
    • Connect alerts from Microsoft Defender for Office 365
    • Connect alerts from Microsoft Defender for Endpoint
    • Connect the Microsoft 365 Defender connector
    • Knowledge check
    • Summary and resources
  • Module 4: Connect Windows hosts to Microsoft Sentinel
    • Introduction
    • Plan for Windows hosts security events connector
    • Collect Sysmon event logs
    • Knowledge check
    • Summary and resources
  • Module 5: Connect Common Event Format logs to Microsoft Sentinel
    • Introduction
    • Plan for Common Event Format connector
    • Connect your external solution using the Common Event Format connector
    • Knowledge check
    • Summary and resources
  • Module 6: Connect syslog data sources to Microsoft Sentinel
    • Introduction
    • Plan for the syslog connector
    • Collect data from Linux-based sources using syslog
    • Configure the log analytics agent
    • Parse syslog data with KQL
    • Knowledge check
    • Summary and resources
  • Module 7: Connect threat indicators to Microsoft Sentinel
    • Introduction
    • Plan for threat intelligence connectors
    • Connect the threat intelligence TAXII connector
    • Connect the threat intelligence platforms connector
    • View your threat indicators with KQL
    • Knowledge check
    • Summary and resources

Tags

Related Courses

SC-200: Configure your Microsoft Sentinel environment
Microsoft via Microsoft Learn SC-200: Create detections and perform investigations using Microsoft Sentinel
Microsoft via Microsoft Learn SC-200: Create queries for Microsoft Sentinel using Kusto Query Language (KQL)
Microsoft via Microsoft Learn SC-200: Mitigate threats using Microsoft Defender for Cloud
Microsoft via Microsoft Learn SC-200: Mitigate threats using Microsoft Defender for Endpoint
Microsoft via Microsoft Learn