In this course, you will learn how to investigate, respond to, and proactively search for cyberthreats using Microsoft Azure Sentinel, Azure Defender, and Microsoft 365 Defender. You'll gain skills in mitigating cyber risks through these technologies by configuring and utilizing Azure Sentinel and leveraging Kusto Query Language (KQL) for detection, analysis, and reporting purposes. This course is tailored for individuals working in Security Operations roles and will help you prepare for the SC-200: Microsoft Security Operations Analyst certification exam.
Audience Profile
The Microsoft Security Operations Analyst works with organizational stakeholders to secure IT systems within their organization. Their objective is to minimize risk by swiftly addressing active attacks, recommending improvements in threat protection practices, and reporting policy violations to relevant parties. Responsibilities include managing threats, monitoring security, and responding using various security solutions across the environment. The role involves investigating, responding to, and hunting for threats with tools like Microsoft Azure Sentinel, Azure Defender, Microsoft 365 Defender, and third-party security products. As a Security Operations Analyst, you will be crucial in configuring and deploying these technologies based on their operational output.
Job Role: Security Engineer
Preparation for Exam: SC-200
Features: none
Skills Gained
- Understand how Microsoft Defender for Endpoint can mitigate risks in your environment.
- Set up a Microsoft Defender for Endpoint environment.
- Configure Attack Surface Reduction rules on Windows 10 devices.
- Perform operations on devices using Microsoft Defender for Endpoint.
- Investigate domains and IP addresses through Microsoft Defender for Endpoint.
- Analyze user accounts with Microsoft Defender for Endpoint.
- Tailor alert configurations in Microsoft Defender for Endpoint.
- Demonstrate how the threat landscape is evolving.
- Execute advanced hunting within Microsoft 365 Defender.
- Handle incidents in Microsoft 365 Defender.
- Explain how Microsoft Defender for Identity can mitigate risks in your environment.
- Explore DLP alerts in Microsoft Cloud App Security.
- Understand the actions you can take on an insider risk management case.
- Set up auto-provisioning in Azure Defender.
- Address alerts in Azure Defender.
- Create KQL statements.
- Filter searches based on event time, severity, domain, and other pertinent data using KQL.
- Extract information from unstructured string fields with KQL.
- Manage an Azure Sentinel workspace.
- Utilize KQL to access the watchlist in Azure Sentinel.
- Handle threat indicators within Azure Sentinel.
- Explain the differences between Common Event Format and Syslog connectors in Azure Sentinel.
- Integrate Azure Windows Virtual Machines with Azure Sentinel.
- Configure Log Analytics agent for collecting Sysmon events.
- Create new analytics rules and queries using the analytics rule wizard.
- Develop a playbook to automate incident response processes.
- Use queries to search for threats.
- Monitor threats over time with livestream.
Read more...