Learning Objectives

• Investigate, respond to, and hunt for threats using Microsoft Sentinel
• Investigate, respond to, and hunt for threats using Microsoft Defender XDR
• Investigate, respond to, and hunt for threats using Microsoft Defender for Cloud
• Apply Microsoft security operations technologies to reduce cyberthreats
• Set up and operate Microsoft Sentinel as a SIEM/SOAR platform
• Write Kusto Query Language (KQL) queries to support detection, analysis, and reporting
• Prepare for the SC-200: Microsoft Security Operations Analyst certification exam

Course Outline

Module 1: Threat Mitigation with Microsoft Defender XDR

Overview of Microsoft Defender XDR threat protection capabilities, managing incidents and alerts across Microsoft 365 Defender products, and working with the Defender suite—including Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps—to investigate and respond to threats.

Module 2: Threat Mitigation with Microsoft Defender for Cloud

Using Microsoft Defender for Cloud to protect hybrid and multi-cloud environments, configuring security policies, assessing security posture, and reviewing and remediating alerts and recommendations produced by Defender for Cloud.

Module 3: Threat Mitigation with Microsoft Sentinel

Deploying and configuring Microsoft Sentinel as a cloud-native SIEM and SOAR solution, connecting data sources, building analytics rules for threat detection, handling incidents, automating responses with playbooks, and using Kusto Query Language (KQL) for threat hunting, detection, and reporting.