Course Modules
Learning Path 1: Mitigate threats using Microsoft Defender XDR
- Introduction to Microsoft 365 threat protection
- Mitigate incidents using Microsoft Defender XDR
- Protect your identities with Entra ID Protection
- Remediate risks with Microsoft Defender for Office 365
- Safeguard your environment with Microsoft Defender for Identity
- Secure your cloud apps and services with Microsoft Defender for Cloud Apps
- Lab: Explore Microsoft Defender XDR
Learning Path 2: Get started with Microsoft Copilot for Security
- Fundamentals of Generative AI
- Describe Microsoft Copilot for Security
- Describe core features of Microsoft Copilot for Security
- Describe the Microsoft Copilot for Security embedded experience
- Lab: Explore use cases in Microsoft Security Copilot
Learning Path 3: Mitigate threats using Microsoft Purview
- Microsoft Purview Compliance Solutions
- Respond to data loss prevention alerts using Microsoft Purview
- Manage insider risk in Microsoft Purview
- Investigate threats using Content search in Microsoft Purview
- Investigate threats using Microsoft Purview Audit
- Lab: Explore Microsoft Purview Audit Logs
Learning Path 4: Mitigate threats using Microsoft Defender for Endpoint
- Protect against threats with Microsoft Defender for Endpoint
- Deploy the Microsoft Defender for Endpoint environment
- Implement Windows security enhancements with Microsoft Defender for Endpoint
- Perform device investigations in Microsoft Defender for Endpoint
- Perform actions on a device using Microsoft Defender for Endpoint
- Perform evidence and entities investigations using Microsoft Defender for Endpoint
- Configure and manage automation using Microsoft Defender for Endpoint
- Configure for alerts and detections in Microsoft Defender for Endpoint
- Utilize Vulnerability Management in Microsoft Defender for Endpoint
- Lab: Deploy Microsoft Defender for Endpoint
- Lab: Mitigate attacks with Microsoft Defender for Endpoint
Learning Path 5: Mitigate threats using Microsoft Defender for Cloud
- Plan for cloud workload protections using Microsoft Defender for Cloud
- Connect Azure assets to Microsoft Defender for Cloud
- Connect non-Azure resources to Microsoft Defender for Cloud
- Manage your cloud security posture management
- Explain cloud workload protections in Microsoft Defender for Cloud
- Remediate security alerts using Microsoft Defender for Cloud
Learning Path 6: Create queries for Microsoft Sentinel using Kusto Query Language (KQL)
- Construct KQL statements for Microsoft Sentinel
- Analyze query results using KQL
- Build multi-table statements using KQL
- Work with data in Microsoft Sentinel using Kusto Query Language
- Lab: Create queries for Microsoft Sentinel using Kusto Query Language (KQL)
Learning Path 7: Configure your Microsoft Sentinel environment
- Introduction to Microsoft Sentinel
- Create and manage Microsoft Sentinel workspaces
- Query logs in Microsoft Sentinel
- Use watchlists in Microsoft Sentinel
- Utilize threat intelligence in Microsoft Sentinel
- Integrate Microsoft Defender XDR with Microsoft Sentinel
- Lab: Configure your Microsoft Sentinel Environment
- Lab: Connect data to Microsoft Sentinel using Data Connectors
- Lab: Configure your Microsoft Sentinel Environment
Learning Path 8: Connect logs to Microsoft Sentinel
- Connect data to Microsoft Sentinel using data connectors
- Connect Microsoft services to Microsoft Sentinel
- Connect Microsoft Defender XDR to Microsoft Sentinel
- Connect Windows hosts to Microsoft Sentinel
- Connect Common Event Format logs to Microsoft Sentinel
- Connect syslog data sources to Microsoft Sentinel
- Connect threat indicators to Microsoft Sentinel
- Lab: Connect Windows Devices to Microsoft Sentinel using Data Connectors
- Lab: Connect Linux Hosts to Microsoft Sentinel using Data Connectors
- Lab: Connect Defender XDR to Microsoft Sentinel using Data Connectors
Learning Path 9: Create detections and perform investigations using Microsoft Sentinel
- Threat detection with Microsoft Sentinel analytics
- Automation in Microsoft Sentinel
- Threat response with Microsoft Sentinel playbooks
- Security incident management in Microsoft Sentinel
- Identify threats with Entity behavioral analytics in Microsoft Sentinel
- Data normalization in Microsoft Sentinel
- Query, visualize, and monitor data in Microsoft Sentinel
- Manage content in Microsoft Sentinel
- Lab: Create a playbook
- Lab: Create a scheduled query from a template
- Lab: Explore entity behavior analytics
- Lab: Prepare to perform simulated attacks
- Lab: Connect Defender XDR to Microsoft Sentinel using Data Connectors
- Lab: Conduct Attacks
- Lab: Create Detections
- Lab: Investigate Incidents
- Lab: Create ASIM Parsers
- Lab: Create Workbooks
- Lab: Use Repositories in Microsoft Sentinel
Learning Path 10: Perform threat hunting in Microsoft Sentinel
- Explain threat hunting concepts in Microsoft Sentinel
- Threat hunting with Microsoft Sentinel
- Use Search jobs in Microsoft Sentinel
- Hunt for threats using notebooks in Microsoft Sentinel
- Lab: Perform Threat Hunting in Microsoft Sentinel
- Lab: Threat Hunting using Notebooks with Microsoft Sentinel
- Lab: Perform Threat Hunting in Microsoft Sentinel
Course Prerequisites
Learning Objectives
Target Audience