Microsoft Security Operations Analyst

Outline

• Introduction to Microsoft Defender XDR threat protection
  • Explore Extended Detection & Response (XDR) response use cases
  • Understand Microsoft Defender XDR in a Security Operations Center (SOC)
  • Explore Microsoft Security Graph
  • Investigate security incidents in Microsoft Defender XDR
  • Knowledge check
  • Summary and resources
• Mitigate incidents using Microsoft Defender
  • Use the Microsoft Defender portal
  • Manage incidents
  • Investigate incidents
  • Manage and investigate alerts
  • Manage automated investigations
  • Use the action center
  • Explore advanced hunting
  • Investigate Microsoft Entra sign-in logs
  • Understand Microsoft Secure Score
  • Analyze threat analytics
  • Analyze reports
  • Configure the Microsoft Defender portal
  • Knowledge check
  • Summary and resources
• Remediate risks with Microsoft Defender for Office 365
  • Introduction to Microsoft Defender for Office 365
  • Automate, investigate, and remediate
  • Configure, protect, and detect
  • Simulate attacks
  • Summary and knowledge check
• Manage Microsoft Entra Identity Protection
  • Review identity protection basics
  • Implement and manage user risk policy
  • Exercise enable sign-in risk policy
  • Exercise configure Microsoft Entra multifactor authentication registration policy
  • Monitor, investigate, and remediate elevated risky users
  • Implement security for workload identities
  • Explore Microsoft Defender for Identity
  • Knowledge check
  • Summary and resources
• Safeguard your environment with Microsoft Defender for Identity
  • Introduction to Microsoft Defender for Identity
  • Configure Microsoft Defender for Identity sensors
  • Review compromised accounts or data
  • Integrate with other Microsoft tools
  • Summary and knowledge check
• Secure your cloud apps and services with Microsoft Defender for Cloud Apps
  • Understand the Defender for Cloud Apps Framework
  • Explore your cloud apps with Cloud Discovery
  • Protect your data and apps with Conditional Access App Control
  • Walk through discovery and access control with Microsoft Defender for Cloud Apps
  • Classify and protect sensitive information
  • Detect Threats
  • Knowledge check
• Fundamentals of Generative AI
  • What is generative AI?
  • What are language models?
  • Using language models
  • Copilot and AI agents
  • Understand Microsoft Copilot
  • Considerations for prompts
  • Extending and developing copilot-like agents
  • Exercise - Explore generative AI in Azure AI Foundry portal
  • Knowledge check
• Describe Microsoft Security Copilot
  • Get acquainted with Microsoft Security Copilot
  • Describe Microsoft Security Copilot terminology
  • Describe how Microsoft Security Copilot processes prompt requests
  • Describe the elements of an effective prompt
  • Describe how to enable Microsoft Security Copilot
  • Knowledge check
  • Summary and resources
• Describe the core features of Microsoft Security Copilot
  • Describe the features available in the standalone experience of Microsoft Security Copilot
  • Describe the features available in a session of the standalone experience
  • Describe the Microsoft plugins available in Microsoft Security Copilot
  • Describe the non-Microsoft plugins supported by Microsoft Security Copilot
  • Describe custom promptbooks
  • Describe knowledge base connections
  • Knowledge check
  • Summary and resources
• Describe the embedded experiences of Microsoft Security Copilot
  • Describe Copilot in Microsoft Defender XDR
  • Copilot in Microsoft Purview
  • Copilot in Microsoft Entra
  • Copilot in Microsoft Intune
  • Copilot in Microsoft Defender for Cloud (Preview)
  • Knowledge check
  • Summary and resources
• Explore use cases of Microsoft Security Copilot
  • Explore the first run experience
  • Explore the standalone experience
  • Configure the Microsoft Sentinel plugin
  • Enable a custom plugin
  • Explore file uploads as a knowledge base
  • Create a custom promptbook
  • Explore the capabilities of Copilot in Microsoft Defender XDR
  • Explore the capabilities of Copilot in Microsoft Purview
  • Knowledge check
  • Summary and resources
• Respond to data loss prevention alerts using Microsoft 365
  • Describe data loss prevention alerts
  • Investigate data loss prevention alerts in Microsoft Purview
  • Investigate data loss prevention alerts in Microsoft Defender for Cloud Apps
  • Knowledge check
  • Summary and resources
• Manage insider risk in Microsoft Purview
  • Insider risk management overview
  • Introduction to managing insider risk policies
  • Create and manage insider risk policies
  • Knowledge check
  • Investigate insider risk alerts
  • Take action on insider risk alerts through cases
  • Manage insider risk management forensic evidence
  • Create insider risk management notice templates
  • Summary and knowledge check
• Search and investigate with Microsoft Purview Audit
  • Microsoft Purview Audit overview
  • Configure and manage Microsoft Purview Audit
  • Conduct searches with Audit (Standard)
  • Audit Microsoft Copilot for Microsoft 365 interactions
  • Investigate activities with Audit (Premium)
  • Export audit log data
  • Configure audit retention with Audit (Premium)
  • Knowledge check
• Investigate threats with Content search in Microsoft Purview
  • Explore Microsoft Purview eDiscovery solutions
  • Create a content search
  • View the search results and statistics
  • Export the search results and search report
  • Configure search permissions filtering
  • Search for and delete email messages
  • Knowledge check
• Protect against threats with Microsoft Defender for Endpoint
  • Introduction to Microsoft Defender for Endpoint
  • Practice security administration
  • Hunt threats within your network
  • Summary and knowledge check
• Deploy the Microsoft Defender for Endpoint environment
  • Create your environment
  • Understand operating systems compatibility and features
  • Onboard devices
  • Manage access
  • Create and manage roles for role-based access control
  • Configure device groups
  • Configure environment advanced features
  • Knowledge check
  • Summary and resources
• Implement Windows security enhancements with Microsoft Defender for Endpoint
  • Understand attack surface reduction
  • Enable attack surface reduction rules
  • Knowledge check
  • Summary and resources
• Perform device investigations in Microsoft Defender for Endpoint
  • Use the device inventory list
  • Investigate the device
  • Use behavioral blocking
  • Detect devices with device discovery
  • Knowledge check
  • Summary and resources
• Perform actions on a device using Microsoft Defender for Endpoint
  • Explain device actions
  • Run Microsoft Defender antivirus scan on devices
  • Collect investigation package from devices
  • Initiate live response session
  • Knowledge check
  • Summary and resources
• Perform evidence and entities investigations using Microsoft Defender for Endpoint
  • Investigate a file
  • Investigate a user account
  • Investigate an IP address
  • Investigate a domain
  • Knowledge check
  • Summary and resources
• Configure and manage automation using Microsoft Defender for Endpoint
  • Configure advanced features
  • Manage automation upload and folder settings
  • Configure automated investigation and remediation capabilities
  • Block at risk devices
  • Knowledge check
  • Summary and resources
• Configure for alerts and detections in Microsoft Defender for Endpoint
  • Configure advanced features
  • Configure alert notifications
  • Manage alert suppression
  • Manage indicators
  • Knowledge check
  • Summary and resources
• Utilize Vulnerability Management in Microsoft Defender for Endpoint
  • Understand vulnerability management
  • Explore vulnerabilities on your devices
  • Manage remediation
  • Knowledge check
  • Summary and resources
• Plan for cloud workload protections using Microsoft Defender for Cloud
  • Explain Microsoft Defender for Cloud
  • Describe Microsoft Defender for Cloud workload protections
  • Exercise – Microsoft Defender for Cloud interactive guide
  • Enable Microsoft Defender for Cloud
  • Knowledge check
  • Summary and resources
• Connect Azure assets to Microsoft Defender for Cloud
  • Explore and manage your resources with asset inventory
  • Configure auto provisioning
  • Manual log analytics agent provisioning
  • Knowledge check
  • Summary and resources
• Connect non-Azure resources to Microsoft Defender for Cloud
  • Protect non-Azure resources
  • Connect non-Azure machines
  • Connect your AWS accounts
  • Connect your GCP accounts
  • Knowledge check
  • Summary and resources
• Manage your cloud security posture management​
  • Explore Secure Score
  • Explore Recommendations
  • Measure and enforce regulatory compliance
  • Understand Workbooks
  • Knowledge check
  • Summary and resources
• Explain cloud workload protections in Microsoft Defender for Cloud
  • Understand Microsoft Defender for servers
  • Understand Microsoft Defender for App Service
  • Understand Microsoft Defender for Storage
  • Understand Microsoft Defender for SQL
  • Understand Microsoft Defender for open-source databases
  • Understand Microsoft Defender for Key Vault
  • Understand Microsoft Defender for Resource Manager
  • Understand Microsoft Defender for DNS
  • Understand Microsoft Defender for Containers
  • Understand Microsoft Defender additional protections
  • Knowledge check
  • Summary and resources
• Remediate security alerts using Microsoft Defender for Cloud
  • Understand security alerts
  • Remediate alerts and automate responses
  • Suppress alerts from Defender for Cloud
  • Generate threat intelligence reports
  • Respond to alerts from Azure resources
  • Knowledge check
  • Summary and resources
• Construct KQL statements for Microsoft Sentinel
  • Understand the Kusto Query Language statement structure
  • Use the search operator
  • Use the where operator
  • Use the let statement
  • Use the extend operator
  • Use the order by operator
  • Use the project operators
  • Knowledge check
  • Summary and resources
• Analyze query results using KQL
  • Use the summarize operator
  • Use the summarize operator to filter results
  • Use the summarize operator to prepare data
  • Use the render operator to create visualizations
  • Knowledge check
  • Summary and resources
• Build multi-table statements using KQL
  • Use the union operator
  • Use the join operator
  • Knowledge check
  • Summary and resources
• Work with data in Microsoft Sentinel using Kusto Query Language
  • Extract data from unstructured string fields
  • Extract data from structured string data
  • Integrate external data
  • Create parsers with functions
  • Knowledge check
  • Summary and resources
• Introduction to Microsoft Sentinel
  • What is Microsoft Sentinel?
  • How Microsoft Sentinel works
  • When to use Microsoft Sentinel
  • Knowledge check
• Create and manage Microsoft Sentinel workspaces
  • Plan for the Microsoft Sentinel workspace
  • Create a Microsoft Sentinel workspace
  • Manage workspaces across tenants using Azure Lighthouse
  • Understand Microsoft Sentinel permissions and roles
  • Manage Microsoft Sentinel settings
  • Configure logs
  • Knowledge check
  • Summary and resources
• Query logs in Microsoft Sentinel
  • Query logs in the logs page
  • Understand Microsoft Sentinel tables
  • Understand common tables
  • Understand Microsoft Defender XDR tables
  • Knowledge check
  • Summary and resources
• Use watchlists in Microsoft Sentinel
  • Plan for watchlists
  • Create a watchlist
  • Manage watchlists
  • Knowledge check
  • Summary and resources
• Utilize threat intelligence in Microsoft Sentinel
  • Define threat intelligence
  • Manage your threat indicators
  • View your threat indicators with KQL
  • Knowledge check
  • Summary and resources
• Integrate Microsoft Defender XDR with Microsoft Sentinel
  • Understand the benefits of integrating Microsoft Sentinel with Defender XDR
  • Explore the capability differences between Microsoft Defender XDR and Microsoft Sentinel portals
  • Onboarding Microsoft Sentinel to Microsoft Defender XDR
  • Explore Microsoft Sentinel features in Microsoft Defender XDR
  • Knowledge check
• Connect data to Microsoft Sentinel using data connectors
  • Ingest log data with data connectors
  • Understand data connector providers
  • View connected hosts
  • Knowledge check
  • Summary and resources
• Connect Microsoft services to Microsoft Sentinel
  • Plan for Microsoft services connectors
  • Connect the Microsoft 365 connector
  • Connect the Microsoft Entra connector
  • Connect the Microsoft Entra ID Protection connector
  • Connect the Azure Activity connector
  • Knowledge check
  • Summary and resources
• Connect Microsoft Defender XDR to Microsoft Sentinel
  • Plan for Microsoft Defender XDR connectors
  • Connect the Microsoft Defender XDR connector
  • Connect Microsoft Defender for Cloud connector
  • Connect Microsoft Defender for IoT
  • Connect Microsoft Defender legacy connectors
  • Knowledge check
  • Summary and resources
• Connect Windows hosts to Microsoft Sentinel
  • Plan for Windows hosts security events connector
  • Connect using the Windows Security Events via AMA Connector
  • Connect using the Security Events via Legacy Agent Connector
  • Collect Sysmon event logs
  • Knowledge check
  • Summary and resources
• Connect Common Event Format logs to Microsoft Sentinel
  • Plan for Common Event Format connector
  • Connect your external solution using the Common Event Format connector
  • Knowledge check
  • Summary and resources
• Connect syslog data sources to Microsoft Sentinel
  • Plan for syslog data collection
  • Collect data from Linux-based sources using syslog
  • Configure the Data Collection Rule for Syslog Data Sources
  • Parse syslog data with KQL
  • Knowledge check
  • Summary and resources
• Connect threat indicators to Microsoft Sentinel
  • Plan for threat intelligence connectors
  • Connect the threat intelligence TAXII connector
  • Connect the threat intelligence platforms connector
  • View your threat indicators with KQL
  • Knowledge check
  • Summary and resources
• Threat detection with Microsoft Sentinel analytics
  • Exercise - Detect threats with Microsoft Sentinel analytics
  • What is Microsoft Sentinel Analytics?
  • Types of analytics rules
  • Create an analytics rule from templates
  • Create an analytics rule from wizard
  • Manage analytics rules
  • Exercise - Detect threats with Microsoft Sentinel analytics
• Automation in Microsoft Sentinel
  • Understand automation options
  • Create automation rules
  • Knowledge check
  • Summary and resources
• Threat response with Microsoft Sentinel playbooks
  • Exercise - Create a Microsoft Sentinel playbook
  • What are Microsoft Sentinel playbooks?
  • Trigger a playbook in real-time
  • Run playbooks on demand
  • Exercise - Create a Microsoft Sentinel playbook
• Security incident management in Microsoft Sentinel
  • Exercise - Set up the Azure environment
  • Understand incidents
  • Incident evidence and entities
  • Incident management
  • Exercise - Investigate an incident
• Identify threats with Behavioral Analytics
  • Understand behavioral analytics
  • Explore entities
  • Display entity behavior information
  • Use Anomaly detection analytical rule templates
  • Knowledge check
  • Summary and resources
• Data normalization in Microsoft Sentinel
  • Understand data normalization
  • Use ASIM Parsers
  • Understand parameterized KQL functions
  • Create an ASIM Parser
  • Configure Azure Monitor Data Collection Rules
  • Knowledge check
  • Summary and resources
• Query, visualize, and monitor data in Microsoft Sentinel
  • Exercise - Query and visualize data with Microsoft Sentinel Workbooks
  • Monitor and visualize data
  • Query data using Kusto Query Language
  • Use default Microsoft Sentinel Workbooks
  • Create a new Microsoft Sentinel Workbook
  • Exercise - Visualize data using Microsoft Sentinel Workbooks
• Manage content in Microsoft Sentinel
  • Use solutions from the content hub
  • Use repositories for deployment
  • Knowledge check
  • Summary and resources
• Explain threat hunting concepts in Microsoft Sentinel
  • Understand cybersecurity threat hunts
  • Develop a hypothesis
  • Explore MITRE ATT&CK
  • Knowledge check
  • Summary and resources
• Threat hunting with Microsoft Sentinel
  • Exercise setup
  • Explore creation and management of threat-hunting queries
  • Save key findings with bookmarks
  • Observe threats over time with livestream
  • Exercise - Hunt for threats by using Microsoft Sentinel
• Use Search jobs in Microsoft Sentinel
  • Hunt with a Search Job
  • Restore historical data
  • Knowledge check
  • Summary and resources
• Hunt for threats using notebooks in Microsoft Sentinel
  • Access Azure Sentinel data with external tools
  • Hunt with notebooks
  • Create a notebook
  • Explore notebook code
  • Knowledge check
  • Summary and resources