Training Overview
As a candidate for this certification, you’re a Microsoft security operations analyst who reduces organisational risk by:
Rapidly remediating active attacks in cloud and on-premises environments.
Advising on improvements to threat protection practices.
Identifying violations of organisational policies.
As a security operations analyst, you:
Perform triage.
Respond to incidents.
Mitigate risk by using exposure management.
Hunt for threats by using threat intelligence.
Use KQL for reporting, detections, and investigations
You also monitor, identify, investigate, and respond to threats in cloud and on-premises environments by using:
Microsoft Defender XDR
Course Agenda
Configure automation for Microsoft Defender XDR and Microsoft Sentinel
Configure email notifications in Microsoft Defender XDR, including incidents, actions, and threat analytics
Configure alert notifications in Microsoft Defender XDR, including tuning, suppression, and correlation
Configure Microsoft Defender for Endpoint advanced features
Configure rules settings in Microsoft Defender for Endpoint
Configure custom data collection in Microsoft Defender for Endpoint
Configure security policies for Microsoft Defender for Endpoint, including attack surface reduction (ASR) rules
Manage automated investigation and response capabilities in Microsoft Defender XDR
Configure automatic attack disruption in Microsoft Defender XDR
Configure and manage device groups, permissions, and automation levels in Microsoft Defender for Endpoint
Create and configure automation rules in Microsoft Sentinel
Create and configure Microsoft Sentinel playbooks
Configure the Microsoft Sentinel SIEM and platform
Specify Microsoft Sentinel roles
Manage data retention for XDR and Microsoft Sentinel tables, including Analytics, Data Lake, and XDR tiers
Create and configure Microsoft Sentinel workbooks
Optimise the Microsoft Sentinel platform, including SOC optimisation recommendations
Ingest data into the Microsoft Sentinel SIEM and platform
Select data connectors based on data source requirements, including Windows logs and security events
Configure the collection of Windows Security events by using Windows Security Events via AMA, including data collection rules