Capability Development / Cyber Security
Defend Against Cyberthreats (SC-200)
This program prepares security professionals to monitor, investigate, and respond to cyberthreats across Microsoft cloud, hybrid, multi-cloud, and on-premises environments. It focuses on practical security operations using Microsoft Defender XDR, Microsoft Sentinel, Microsoft Defender for Cloud, Microsoft Entra ID, Microsoft Purview, and Kusto Query Language. Participants build hands-on skills in incident triage, threat investigation, threat hunting, detection engineering, and automated response aligned to the Microsoft Security Operations Analyst role.
Program Overview
This program prepares security professionals to monitor, investigate, and respond to cyberthreats across Microsoft cloud, hybrid, multi-cloud, and on-premises environments. It focuses on practical security operations using Microsoft Defender XDR, Microsoft Sentinel, Microsoft Defender for Cloud, Microsoft Entra ID, Microsoft Purview, and Kusto Query Language. Participants build hands-on skills in incident triage, threat investigation, threat hunting, detection engineering, and automated response aligned to the Microsoft Security Operations Analyst role.
Audience Profile
SOC analysts and security operations professionals; Incident responders working in Microsoft environments; Candidates preparing for the Microsoft SC-200 certification; IT professionals moving into threat detection roles; and Familiarity with Microsoft 365 and Azure recommended.
Course Syllabus
Module 1: Manage Threat Mitigation Using Microsoft Defender XDR
Topics
- Unified security portal navigation
- Incident queue review and alert prioritization
- Evidence and incident timeline analysis
- Endpoint device investigation and isolation
- Malware analysis and automated investigation
- Identity risk and suspicious sign-in review
- Cloud app activity and risky session monitoring
Module 2: Configure and Manage Microsoft Sentinel
Topics
- Workspace planning and retention settings
- Role assignments and cost management
- Content hub solutions
- Data connector configuration
- Azure activity logs and Defender XDR integration
- Syslog and CEF data ingestion
- Analytics rule creation and entity mapping
- Incident grouping
Module 3: Investigate Threats Using KQL and Microsoft Sentinel
Topics
- Kusto Query Language structure and filtering
- Time range analysis and summarization
- Joins and unions
- Account, device, IP, and URL investigation
- File and process analysis
- Threat hunting queries and MITRE ATT&CK mapping
- Bookmarks and livestream monitoring
Module 4: Automate Security Response and Manage Threat Mitigation
Topics
- Automation rules and playbook design
- Logic Apps integration and orchestration
- Microsoft Purview data risk and insider risk alerts
- Information protection and compliance investigation
- Data loss response actions
- Triage process improvement and detection tuning
- False-positive reduction and incident reporting