SC-200T00: Microsoft Security Operations Analyst Training & Certification Course

✦ Microsoft Sentinel ✦ Microsoft Defender XDR ✦ Microsoft Defender for Endpoint ✦ Microsoft Defender for Cloud ✦ Microsoft Security Copilot ✦ Kusto Query Language (KQL) ✦ Security Information and Event Management (SIEM) ✦ Extended Detection and Response (XDR) ✦ Security Operations Center (SOC) operations ✦ Threat Detection ✦ Threat Investigation ✦ Incident Response ✦ Security Incident Management ✦ Threat Hunting ✦ Security Analytics ✦ Security Monitoring ✦ Security Automation ✦ Automated Investigation and Response ✦ Attack Disruption ✦ Security Alert Management ✦ Detection Engineering ✦ Analytics Rules ✦ Advanced Hunting ✦ Log Management ✦ Data Connectors ✦ Windows Security Events ✦ Syslog ✦ Common Event Format (CEF) ✦ Threat Intelligence ✦ MITRE ATT&CK ✦ Security Workbooks ✦ Microsoft Purview Audit ✦ Identity Threat Detection ✦ Cloud Security Monitoring

• ✓ Intermediate knowledge of Windows 10 and Windows security features, essential for the SC-200T00: Microsoft Security Operations Analyst certification by Microsoft
• ✓ Familiarity with Azure virtual machines, virtual networking (VNets, subnets, NSGs), and core Azure services like Azure Storage and Azure SQL Database, crucial for security operations roles
• ✓ Basic understanding of Microsoft 365 workloads and identity management with Entra ID (formerly Azure AD), important for managing security in cloud environments
• ✓ Fundamental knowledge of Microsoft security, compliance, and identity solutions such as Microsoft Defender for Endpoint, Microsoft Defender for Identity, and Microsoft Purview, vital for effective threat response
• ✓ Experience in writing and analyzing Kusto Query Language (KQL) for log analysis enhances security monitoring capabilities
• ✓ Basic scripting skills and automation understanding in security operations help streamline incident response and threat detection processes

Module 1: Mitigate threats using Microsoft Defender for Endpoint

• Implement the Microsoft Defender for Endpoint platform to detect, investigate, and respond to advanced threats.
• Learn how Microsoft Defender for Endpoint can help your organization stay secure.
• Learn how to deploy Microsoft Defender for Endpoint environment, including onboarding devices and configuring security.
• Learn how to investigate incidents and alerts using Microsoft Defender for Endpoints.
• Perform advanced hunting and consult with threat experts.
• You will also learn how to configure automation in Microsoft Defender for Endpoint by managing environmental settings.
• Lastly, you will learn about your environment's weaknesses by using Threat and Vulnerability Management in Microsoft Defender for Endpoint.

Module 2: Mitigate threats using Microsoft 365 Defender

• Analyze threat data across domains and rapidly remediate threats with built-in orchestration and automation in Microsoft 365 Defender.
• Learn about cybersecurity threats and how the new threat protection tools from Microsoft protect your organization’s users, devices, and data.
• Use the advanced detection and remediation of identity-based threats to protect your Azure Active Directory identities and applications from compromise.

Module 3: Mitigate threats using Azure Defender

• Use Azure Defender integrated with Azure Security Center, for Azure, hybrid cloud, and on-premises workload protection and security.
• Learn the purpose of Azure Defender, Azure Defender's relationship to Azure Security Center, and how to enable Azure Defender.
• You will also learn about the protections and detections provided by Azure Defender.

Module 4: Connect logs to Azure Sentinel

• Connect data at cloud scale across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds to Azure Sentinel.
• The primary approach to connect log data is using the Azure Sentinel provided data connectors.

Module 5: Create detections and perform investigations using Azure Sentinel

• Detect previously uncovered threats and rapidly remediate threats with built-in orchestration and automation in Azure Sentinel.
• You will learn how to create Azure Sentinel playbooks to respond to security threats.

Module 6: Perform threat hunting in Azure Sentinel

• In this module, you'll learn to proactively identify threat behaviors by using Azure Sentinel queries.
• You'll also learn to use bookmarks and livestream to hunt threats.