Learn how to investigate, respond to and hunt for threats using Microsoft Azure Sentinel, Azure Defender and Microsoft 365 Defender. In this course, you learn how to mitigate cyber threats using these technologies. Specifically, you will configure and use Azure Sentinel and use Kusto Query Language (KQL) to perform detection, analysis and reporting. The course is designed for people who work in a Security Operations job role and helps learners prepare for the exam SC-200: Microsoft Security Operations Analyst.
Format: Online
Language: Swedish
Level: Intermediate
Request info
Want to know more before you sign up?
Send a short question and we will forward it directly to the provider.
We forward your question to Informator Utbildning. No spam, no third parties.
About the course.
Learn how to investigate, respond to and hunt for threats using Microsoft Azure Sentinel, Azure Defender and Microsoft 365 Defender. In this course, you learn how to mitigate cyber threats using these technologies. Specifically, you will configure and use Azure Sentinel and use Kusto Query Language (KQL) to perform detection, analysis and reporting. The course is designed for people who work in a Security Operations job role and helps learners prepare for the exam SC-200: Microsoft Security Operations Analyst.
What you will learn
What you learn.
Explain how Microsoft Defender for Endpoint can remediate risks in your environment
Create a Microsoft Defender for Endpoint environment
Configure attack surface reduction rules on Windows 10 devices
Perform actions on a device using Microsoft Defender for Endpoint
Investigate domains and IP addresses in Microsoft Defender for Endpoint
Investigate user accounts in Microsoft Defender for Endpoint
Configure alert settings in Microsoft Defender for Endpoint
Explain how the threat landscape is evolving
Conduct advanced hunting in Microsoft 365 Defender
Manage incidents in Microsoft 365 Defender
Explain how Microsoft Defender for Identity can remediate risks in your environment
Investigate DLP alerts in Microsoft Cloud App Security
Explain the types of actions you can take on an insider risk management case
Configure auto-provisioning in Azure Defender
Remediate alerts in Azure Defender
Construct KQL statements
Filter searches based on event time, severity, domain and other relevant data using KQL
Extract data from unstructured string fields using KQL
Manage an Azure Sentinel workspace
Use KQL to access the watchlist in Azure Sentinel
Manage threat indicators in Azure Sentinel
Explain the differences between the Common Event Format and Syslog connector in Azure Sentinel
Connect Azure Windows Virtual Machines to Azure Sentinel
Configure the Log Analytics agent to collect Sysmon events
Create new analytics rules and queries using the analytics rule wizard
Create a playbook to automate an incident response
Use queries to hunt for threats
Observe threats over time with livestream
Target audience
Who is this for?
The Microsoft Security Operations Analyst collaborates with organizational stakeholders to secure the organization's information technology systems. Their goal is to reduce organizational risk by rapidly remediating active attacks in the environment, advising on improvements to threat protection practices, and referring violations of organizational policies to the appropriate stakeholders. Responsibilities include threat management, monitoring and response using a variety of security solutions across their environment. The role investigates, responds to and hunts for threats using Microsoft Azure Sentinel, Azure Defender, Micros
What "verified" means here
Verified credential.
When you complete the course, Informator Utbildning issues your certificate. Your name, the course content and the issue date are encrypted and secured on blockchain, so it cannot be changed, and anyone can check that it is genuine.
100% Verifiable certificates Secured on blockchain
