Microsoft Security Operations Analyst SC-200

Upcoming dates

See every class on the schedule

About this class

What you'll be able to do

• Upon successful completion of this course, students will have the following skills and
• knowledge:
• Explain how Microsoft Defender for Endpoint can remediate risks in your
• environment
• Administer a Microsoft Defend
• t of these
• technologies
• Explain how the threat landscape is evolving
• Manage incidents in Microsoft 365 Defender
• Conduct advanced hunting in Microsoft 365 Defender
• Investigate alerts in Microsoft 365 Defender
• Describe the investigation and remediation features of Azure Active Di rectory
• Identity Protection
• Explain how Cloud Discovery helps you see what's going on in your organization
• Module 2: Mitigate threats using Microsoft Defender for
• Endpoint
• Implement the Microsoft Defender for Endpoint platform to detect, investigate, and
• respond to advanced threats. Learn how Microsoft Defender for Endpoint can help your
• organization stay secure. Learn how to deploy the Microsoft Defender for Endpoint
• environment, including onboarding devices and configuring security. Learn how to
• investigate incidents and alerts using Microsoft Defender for Endpoint. Perform advanced
• hunting and consult with threat experts. You will also learn how to configure automation in
• Microsoft Defender for Endpoint by managing environmental settings. Lastly, you will learn
• about your environment's weaknesses by using Threat and Vulnerability Management in
• Microsoft Defender for Endpoint.
• Lessons
• Protect against threats with Microsoft D efender for Endpoint
• Deploy the Microsoft Defender for Endpoint environment
• Implement Windows security enhancements
• Perform device investigations
• Perform actions on a device
• Perform evidence and entities investigations
• Configure and manage automation
• Confi gure for alerts and detections
• Utilize Threat and Vulnerability Management
• Lab : Mitigate threats using Microsoft 365 Defender for Endpoint
• Deploy Microsoft Defender for Endpoint
• Mitigate Attacks using Defender for Endpoint
• Define the capabilities of Microsoft Defender for Endpoint
• Configure Microsoft Defender for Endpoint environment settings
• Configure Attack Surface Reduction rules on Windows devices
• Describe device forensics information collected by Microsoft Defender for
• Endpoint
• Conduct forensics data collection using Microsoft Defender for Endpoint
• Investigate user accounts in Microsoft Defender for Endpoint
• Manage automation settings in Microsoft Defender for Endpoint
• Manage indicators in Microsoft Defender for Endpoint
• Describe Threat and Vulnerability Management in Microsoft Defender for
• Endpoint
• Module 3: Mitigate threats using Microsoft Defender for Cloud
• Use Microsoft Defender for Cloud, for Azure, hybrid cloud, and on- premises workload
• protection and security. Learn the purpose of Microsoft Defender for Cloud and how to
• enable it. You will also learn about the protections and detections provided by Microsoft
• Defender for Cloud for each cloud workload. Learn how you can add Microsoft Defender
• for Cloud capabilities to your hybrid environment.
• Lessons
• Plan for cloud workload protections using Microsoft Defender for Cloud
• Workload protections in Microsoft Defender for Cloud
• Connect Azure assets to Microsoft Defender for Cloud
• Connect non - Azure resources to Microsoft Defender for Cloud
• Remediate security alerts using Microsoft Defender for Cloud
• Lab : Mitigate threats using Microsoft Defender for Cloud
• Deploy Microsoft Defender for Cloud
• Mitigate Attacks with Microsoft Defender for Cloud
• After co mpleting this module, students will be able to:
• Describe Microsoft Defender for Cloud features
• Explain which workloads are protected by Microsoft Defender for Cloud
• Explain how Microsoft Defender for Cloud protections function
• Configure auto- provisioning i n Microsoft Defender for Cloud
• Describe manual provisioning in Microsoft Defender for Cloud
• Connect non - Azure machines to Microsoft Defender for Cloud
• Describe alerts in Microsoft Defender for Cloud
• Remediate alerts in Microsoft Defender for Cloud
• Automate responses in Microsoft Defender for Cloud
• Module 4: Create queries for Microsoft Sentinel using Kusto
• Query Language (KQL)
• Write Kusto Query Language (KQL) statements to query log data to perform detections,
• analysis, and reporting in Microsoft Sentinel. This modul e will focus on the most used
• operators. The example KQL statements will showcase security related table queries. KQL
• is the query language used to perform analysis on data to create analytics, workbooks,
• and perform hunting in Microsoft Sentinel. Learn how basic KQL statement structure
• provides the foundation to build more complex statements. Learn how to summarize and
• visualize data with a KQL statement provides the foundation to build detections in
• Microsoft Sentinel. Learn how to use the Kusto Query Language (KQL) to manipulate
• string data ingested from log sources.
• Lessons
• Construct KQL statements for Microsoft Sentinel
• Analyze query results using KQL
• Build multi- table statements using KQL
• Work with string data using KQL statements
• Lab : Create queries for Microsoft Sentinel using Kusto Query Language (KQL)
• Create queries for Microsoft Sentinel using Kusto Query Language (KQL)
• Construct KQL statements
• Search log files for security events using KQL
• Filter searches based on event time, severity, domain, and other relevant data
• using KQL
• Summarize data using KQL statements
• Render visualizations using KQL statements
• Extract data from unstructured string fields using KQL
• Extract data from structured string data using KQL
• Create Functions using KQL
• Module 5: Configure your Microsoft Sentinel environment
• Get started with Microsoft Sentinel by properly configuring the Microsoft Sentinel
• workspace. Traditional security information and event management (SIEM) system s
• typically take a long time to set up and configure. They're also not necessarily designed
• with cloud workloads in mind. Microsoft Sentinel enables you to start getting valuable
• security insights from your cloud and on - premises data quickly. This module helps you get
• started. Learn about the architecture of Microsoft Sentinel workspaces to ensure you
• configure your system to meet your organization's security operations requirements. As a
• Security Operations Analyst, you must understand the tables, fields, and data ingested in
• your workspace. Learn how to query the most used data tables in Microsoft Sentinel.
• Lessons
• Introduction to Microsoft Sentinel
• Create and manage Microsoft Sentinel workspaces
• Query logs in Microsoft Sentinel
• Use watchlists in Microsoft Sentinel
• Utilize threat intelligence in Microsoft Sentinel
• Lab : Configure your Microsoft Sentinel environment
• Configure your Microsoft Sentinel environment
• Identify the various components and functi onality of Microsoft Sentinel.
• Identify use cases where Microsoft Sentinel would be a good solution.
• Describe Microsoft Sentinel workspace architecture
• Install Microsoft Sentinel workspace
• Manage an Microsoft Sentinel workspace
• Create a watchlist in Micros oft Sentinel
• Use KQL to access the watchlist in Microsoft Sentinel
• Manage threat indicators in Microsoft Sentinel
• Use KQL to access threat indicators in Microsoft Sentinel
• Module 6: Connect logs to Microsoft Sentinel
• Connect data at cloud scale across all users, devices, applications, and infrastructure,
• both on- premises and in multiple clouds to Microsoft Sentinel. The primary approach to
• connect log data is using the Microsoft Sentinel provided data connectors. This module
• provides an overview of the available data connectors. You will get to learn about the
• configuration options and data provided by Microsoft Sentinel connectors for Microsoft
• 365 Defender.
• Lessons
• Connect data to Microsoft Sentinel using data connect ors
• Connect Microsoft services to Microsoft Sentinel
• Connect Microsoft 365 Defender to Microsoft Sentinel
• Connect Windows hosts to Microsoft Sentinel
• Connect Common Event Format logs to Microsoft Sentinel
• Connect syslog data sources to Microsoft Sentinel
• C onnect threat indicators to Microsoft Sentinel
• Lab : Connect logs to Microsoft Sentinel
• Connect data to Microsoft Sentinel using data connectors
• Connect Windows devices to Microsoft Sentinel using data connectors
• Connect Linux hosts to Microsoft Sentinel using data connectors
• Connect Threat intelligence to Microsoft Sentinel using data connectors
• Explain the use of data connectors in Microsoft Sentinel
• Explain the Common Event Format and Syslog connect or differences in
• Microsoft Sentinel
• Connect Microsoft service connectors
• Explain how connectors auto- create incidents in Microsoft Sentinel
• Activate the Microsoft 365 Defender connector in Microsoft Sentinel
• Connect Azure Windows Virtual Machines to Microsoft Sentinel
• Connect non - Azure Windows hosts to Microsoft Sentinel
• Configure Log Analytics agent to collect Sysmon events
• Explain the Common Event Format connector deployment options in Microsoft
• Sentinel
• Configure the TAXII connector in Microsoft Sentinel
• View threat indicators in Microsoft Sentinel
• Module 7: Create detections and perform investigations using
• Microsoft Sentinel
• Detect previously uncovered threats and rapidly remediate threats with built - in
• orchestration and automation in Microsoft Sentinel. You will learn how to create Microsoft
• Sentinel playbooks to respond to security threats. You'll investigate Microsoft Sentinel
• incident management, learn about Microsoft Sentinel events and entities, and discover
• ways to resolve incidents. You w ill also learn how to query, visualize, and monitor data in
• Microsoft Sentinel.
• Lessons
• Threat detection with Microsoft Sentinel analytics
• Security incident management in Microsoft Sentinel
• Threat response with Microsoft Sentinel playbooks
• User and entity behavior analytics in Microsoft Sentinel
• Query, visualize, and monitor data in Microsoft Sentinel
• Lab : Create detections and perform investigations using Microsoft Sentinel
• Activate a Microsoft Security rule
• Create a Playbook
• Create a Scheduled Query
• Understand Detection Modeling
• Conduct attacks
• Create detections
• Investigate incidents
• Create workbooks
• Explain the importance of Microsoft Sentinel Analytics.
• Create rules from templates.
• Manage rules wit h modifications.
• Explain Microsoft Sentinel SOAR capabilities.
• Create a playbook to automate an incident response.
• Investigate and manage incident resolution.
• Explain User and Entity Behavior Analytics in Microsoft Sentinel
• Explore entities in Microsoft Sentinel
• Visualize security data using Microsoft Sentinel workbooks.
• Module 8: Perform threat hunting in Microsoft Sentinel
• In this module, you'll learn to proactively identify threat behaviors by using Azure Sentinel
• queries. You'll also learn to use bookmarks and livestream to hunt threats. You will also
• learn how to use notebooks in Azure Sentinel for advanced hunting.
• Lessons
• Threat hunting concepts in Microsoft Sentinel
• Threat hunting with Microsoft Sentinel
• Hunt for threats using notebooks in Micr osoft Sentinel
• Lab : Threat hunting in Microsoft Sentinel
• Perform threat hunting in Microsoft Sentinel
• Threat hunting using notebooks with Microsoft Sentinel
• Describe threat hunting concepts for use w ith Microsoft Sentinel
• Define a threat hunting hypothesis for use in Microsoft Sentinel
• Use queries to hunt for threats.
• Observe threats over time with livestream.
• Explore API libraries for advanced threat hunting in Microsoft Sentinel
• Create and use notebooks in Microsoft Sentinel

Course outline

Before you attend