microsoft partner logo color
8515  Reviews star_rate star_rate star_rate star_rate star_half

Configure SIEM security operations using Microsoft Sentinel

Get started with Microsoft Sentinel security operations by configuring the Microsoft Sentinel workspace, connecting Microsoft services and Windows security events to Microsoft Sentinel, configuring...

Read More
$675 USD
Duration 1 day
Course Code SC-5001
Available Formats Classroom

Overview

Get started with Microsoft Sentinel security operations by configuring the Microsoft Sentinel workspace, connecting Microsoft services and Windows security events to Microsoft Sentinel, configuring Microsoft Sentinel analytics rules, and responding to threats with automated responses. After completing this course, students will be able to: 

  • Create and configure a Microsoft Sentinel workspace 
  • Deploy a Microsoft Sentinel content hub solution 
  • Connect Windows hosts to Microsoft Sentinel 
  • Configure analytics rules in Microsoft Sentinel 
  • Configure automation in Microsoft Sentinel

Audience Profile

The Microsoft Security Operations Analyst collaborates with organizational stakeholders to secure information technology systems for the organization. Their goal is to reduce organizational risk by rapidly remediating active attacks in the environment, advise on improvements to threat protection practices, and referring violations of organizational policies to appropriate stakeholders. Responsibilities include threat management, monitoring, and response by using a variety of security solutions across their environment. The role primarily investigates, responds to, and hunts for threats using Microsoft Sentinel, Microsoft Defender for Cloud, Microsoft Defender XDR, and third-party security products. Since the Security Operations Analyst consumes the operational output of these tools, they are also a critical stakeholder in the configuration and deployment of these technologies.

Prerequisites

  • Fundamental understanding of Microsoft Azure
  • Basic understanding of Microsoft Sentinel
  • Experience using Kusto Query Language (KQL) in Microsoft Sentinel

Course Details

Outline

  • Create and manage Microsoft Sentinel workspaces
    • Plan for the Microsoft Sentinel workspace
    • Create a Microsoft Sentinel workspace
    • Manage workspaces across tenants using Azure Lighthouse
    • Understand Microsoft Sentinel permissions and roles
    • Manage Microsoft Sentinel settings
    • Configure logs
    • Module assessment
    • Summary and resources
  • Connect Microsoft services to Microsoft Sentinel
    • Plan for Microsoft services connectors
    • Connect the Microsoft 365 connector
    • Connect the Microsoft Entra connector
    • Connect the Microsoft Entra ID Protection connector
    • Connect the Azure Activity connector
    • Module assessment
    • Summary and resources
  • Connect Windows hosts to Microsoft Sentinel
    • Plan for Windows hosts security events connector
    • Connect using the Windows Security Events via AMA Connector
    • Connect using the Security Events via Legacy Agent Connector
    • Collect Sysmon event logs
    • Module assessment
    • Summary and resources
  • Threat detection with Microsoft Sentinel analytics
    • Exercise - Detect threats with Microsoft Sentinel analytics
    • What is Microsoft Sentinel Analytics?
    • Types of analytics rules
    • Create an analytics rule from templates
    • Create an analytics rule from wizard
    • Manage analytics rules
    • Exercise - Detect threats with Microsoft Sentinel analytics
  • Automation in Microsoft Sentinel
    • Understand automation options
    • Create automation rules
    • Module assessment
    • Summary and resources
  • Configure SIEM security operations using Microsoft Sentinel
    • Exercise - Configure SIEM operations using Microsoft Sentinel
    • Exercise - Install Microsoft Sentinel Content Hub solutions and data connectors
    • Exercise - Configure a data connector Data Collection Rule
    • Exercise - Perform a simulated attack to validate the Analytic and Automation rules
    • Exercise - Connect Microsoft Sentinel to Microsoft Defender XDR

Schedule

FAQ

How do I get a Microsoft exam voucher?

Pearson Vue Exam vouchers can be requested and ordered with your course purchase or can be ordered separately by clicking here.

  • Vouchers are non-refundable and non-returnable. Vouchers expire 12 months from the date they are issued unless otherwise specified in the terms and conditions.
  • Voucher expiration dates cannot be extended. The exam must be taken by the expiration date printed on the voucher.

Do Microsoft courses come with post lab access?

Most Microsoft official courses will include post-lab access ranging from 30 to 180 calendar days after instructor led course delivery. A lab training key in class will be provided that can be leveraged to continue connecting to a remote lab environment for the individual course attendee.

Does the course schedule include a Lunchbreak?

Lunch is normally an hour-long after 3-3.5 hours of the class day.

What languages are used to deliver training?

Microsoft courses are conducted in English unless otherwise specified.

Reviews

vary good online learning. instructor is vary good the way he explained every thing.

This is my second course with ExitCertified. This course exceeded my expectations. The teacher was great and the class was fun.

The technical data in the AWS Solutions Architect course was very thorough.

Exit certified was great as it is very in depth and hands on learning which made it very easy to learn this type of work.

The exit certified aws course provided a good introduction to the tools available on aws.