Radiant

Course Description

Learn how to investigate and respond to, & Microsoft Sentinel, Microsoft Defender for Cloud, & Microsoft 365 Defender are used to detect threats. This course will teach you how to mitigate cyber threats using these technologies. Specifically, you will configure & perform detection, analysis, and reporting using both Microsoft Sentinel and Kusto Query Language (KQL). The course was created for people who work in Security Operations and helped students prepare for the exam SC-200- Microsoft Security Operations Analyst.

Prerequisites

Basic knowledge of Microsoft 365
Fundamental knowledge of Microsoft security, compliance, & identity product
Intermediate knowledge of Microsoft Windows
Knowledge of Azure services, specifically Azure SQL Database and Azure Storage
Familiarity with Azure virtual machines & virtual networking
Basic knowledge of scripting concepts

Target Audience

The Microsoft Security Operations Analyst works with organizational stakeholders to secure information technology systems. Their goal is to reduce corporate risk by quickly resolving active attacks in the environment and, advising on threat protection practices improvements, & referring violations of organizational policies to appropriate stakeholders. Responsibilities include threat management, monitoring, & respond by using different security solutions across their environment. The role primarily investigates, replies to, & Finds threats using Microsoft Sentinel, Microsoft 365 Defender, Microsoft Defender for Cloud,& products for third-party security. The Security Operations Analyst is also a crucial stakeholder in the configuration because they consume the operational output of these tools & deployment of these technologies.

Content Outline

Introduction to Microsoft 365 threat protection

Understand Microsoft 365 Defender solution by domain
Understand Microsoft 365 Defender's role in a Modern SOC

Mitigate incidents using Microsoft 365 Defender

Manage incidents in Microsoft 365 Defender
Investigate incidents in Microsoft 365 Defender
Conduct advanced hunting in Microsoft 365 Defender

Protect your identities with Azure AD Identity Protection

Explain the features of Azure Active Directory Identity Protection.
Explain the investigation & remediation features of Azure Active Directory Identity Protection.

Remediate risks with Microsoft Defender for Office 365

Define the capabilities of Microsoft Defender for Office 365.
Understand how to simulate attacks within your network.
Explain how Microsoft Defender for Office 365 can remediate risks in your environment.

Safeguard your environment with Microsoft Defender for Identity

Define the capabilities of Microsoft Defender for Identity.
Understand how to configure Microsoft Defender for Identity sensors.
Explain how Microsoft Defender for Identity can remediate risks in your environment.

Secure your cloud apps & services with Microsoft Defender for Cloud Apps

Define the Defender for Cloud Apps framework
Explain how Cloud Discovery helps you see what's going on in your organization
Understand how to use Conditional Access App Control policies to control access to the apps in your organization

Reply to data loss prevention alerts using Microsoft 365

Explain data loss prevention (DLP) components in Microsoft 365
Investigate DLP alerts in the Microsoft Purview compliance portal
Investigate DLP alerts in Microsoft Defender for Cloud Apps

Manage insider risk in Microsoft Purview

Explain how Microsoft Purview Insider Risk Management can help prevent, detect, & contain internal risks in an organization.
Explain the types of built-in, pre-defined policy templates.
Write the prerequisites that need to be met before creating insider risk policies.
Explain the actions you can take on an insider risk management case.

Protect against threats with Microsoft Defender for Endpoint

Define the capabilities of Microsoft Defender for Endpoint.
Understand how to hunt threats within your network.
Explain how Microsoft Defender for Endpoint can remediate risks in your environment.

Deploy the Microsoft Defender for the Endpoint environment

Create a Microsoft Defender for the Endpoint environment
Onboard devices are to be monitored by Microsoft Defender for Endpoint
Configure Microsoft Defender for Endpoint environment settings

Implement Windows security enhancements with Microsoft Defender for Endpoint

Explain Attack Surface Reduction in Windows
Enable Attack Surface Reduction rules on Windows 10 devices
Configure Attack Surface Reduction rules on Windows 10 devices

Perform device investigations in Microsoft Defender for Endpoint

Use the device page in Microsoft Defender for Endpoint
Explain device forensics information collected by Microsoft Defender for Endpoint
Explain behavioral blocking by Microsoft Defender for Endpoint

Perform actions on a gadget using Microsoft Defender for Endpoint

Perform actions on a gadget using Microsoft Defender for Endpoint
Utilize Microsoft Defender for Endpoint to gather forensic data
Access devices remotely using Microsoft Defender for Endpoint

Perform evidence & entities investigations using Microsoft Defender for Endpoint

Investigate files in Microsoft Defender for Endpoint
Investigate domains & IP addresses in Microsoft Defender for Endpoint
Examine user accounts in Microsoft Defender for Endpoint Protection.

Configure & manage automation using Microsoft Defender for Endpoint

Set up advanced features of Microsoft Defender for Endpoint
Control automation settings in Microsoft Defender for Endpoint

Configure for alerts & detections in Microsoft Defender for Endpoint

Construct alert settings in Microsoft Defender for Endpoint
Control indicators in Microsoft Defender for Endpoint

Use Vulnerability Management in Microsoft Defender for Endpoint

Explain Vulnerability Management in Microsoft Defender for Endpoint
Find vulnerabilities on your devices with Microsoft Defender for Endpoint
Monitor new dangers with Microsoft Defender for Endpoints

Plan for cloud workload protections using Microsoft Defender for Cloud

Explain Microsoft Defender for Cloud features
Microsoft Defender for Cloud workload protections
Enable Microsoft Defender for Cloud

Link Azure assets to Microsoft Defender for Cloud

Explore Azure assets
Set up auto-provisioning in Microsoft Defender for Cloud
Explain manual provisioning in Microsoft Defender for Cloud

Connect non-Azure resources to Microsoft Defender for Cloud

Link non-Azure machines to Microsoft Defender for Cloud
Link AWS accounts to Microsoft Defender for Cloud
Link GCP accounts to Microsoft Defender for Cloud

Manage your cloud security posture management

Explain Microsoft Defender for Cloud features.
Describe the Microsoft Defender for Cloud security posture management protections for your resources.

Describe cloud workload protections in Microsoft Defender for Cloud

Describe which workloads are protected by Microsoft Defender for Cloud
Explain the benefits of the protections offered by Microsoft Defender for Cloud
Explain how Microsoft Defender for Cloud protection function

Microsoft Defender for the Cloud can be used to resolve security alerts.

· After completion of this module, the learner will be able to:
· Explain alerts in Microsoft Defender for Cloud
· Remediate alerts in Microsoft Defender for Cloud
· Automate responses in Microsoft Defender for Cloud

Construct KQL statements for Microsoft Sentinel

Build KQL statements
KQL can be used to search log files for security events.
Use search filters to limit results based on event time, severity, domain, & other relevant data using KQL.

Analyze query results using KQL

Summarize data using KQL statements
Render visualizations using KQL statements

Build multi-table statements using KQL

Make queries using unions to view results across multiple tables using KQL
Utilize the join operator to combine two tables in KQL.

Work with data in Microsoft Sentinel using Kusto Query Language

Extract data from unstructured string fields using KQL
Extract data from structured string data using KQL
Create Functions using KQL

Introduction to Microsoft Sentinel

Identify the various components & functionality of Microsoft Sentinel.
Find use cases where Microsoft Sentinel would be a good solution.

Create & manage Microsoft Sentinel workspaces

Explain Microsoft Sentinel workspace architecture
Install Microsoft Sentinel workspace
Manage a Microsoft Sentinel workspace

Query logs in Microsoft Sentinel

Use the Logs page to view data tables in Microsoft Sentinel
Query the most used tables using Microsoft Sentinel

Use watchlists in Microsoft Sentinel

Make a watchlist in Microsoft Sentinel
Access the watchlist in Microsoft Sentinel using KQL.

Utilize threat intelligence in Microsoft Sentinel

Control threat indicators in Microsoft Sentinel
Access threat indicators in Microsoft Sentinel using KQL.

Connect data to Microsoft Sentinel using data connectors

Describe the use of data connectors in Microsoft Sentinel
Explain the Microsoft Sentinel data connector providers
Explain the Common Event Format & Syslog connector differences in Microsoft Sentinel

Connect Microsoft services to Microsoft Sentinel

Connect Microsoft service connectors
Explain how connectors auto-create incidents in Microsoft Sentinel

Connect Microsoft 365 Defender to Microsoft Sentinel

Activate the Microsoft 365 Defender connector in Microsoft Sentinel
Activate the Microsoft Defender for Cloud connector in Microsoft Sentinel
Activate the Microsoft Defender for IoT connector in Microsoft Sentinel

Connect Windows hosts to Microsoft Sentinel

Connect Azure Windows Virtual Machines to Microsoft Sentinel
Connect non-Azure Windows hosts to Microsoft Sentinel
Configure Log Analytics agent to collect Sysmon events

Connect Common Event Format logs to Microsoft Sentinel

Explain the Common Event Format connector deployment options in Microsoft Sentinel
Run the deployment script for the Common Event Format connector

Connect Syslog data sources to Microsoft Sentinel

Explain the Syslog connector deployment options in Microsoft Sentinel
Run the connector deployment script to send data to Microsoft Sentinel
Configure the Log Analytics agent integration for Microsoft Sentinel
Create a parse using KQL in Microsoft Sentinel

Connect threat indicators to Microsoft Sentinel

Configure the TAXII connector in Microsoft Sentinel
Configure the Threat Intelligence Platform connector in Microsoft Sentinel
View threat indicators in Microsoft Sentinel

Threat detection with Microsoft Sentinel analytics

Explain the importance of Microsoft Sentinel Analytics.
Explain different types of analytics rules.
Create rules from templates.
Create new analytics rules & queries using the analytics rule wizard.
Manage rules with modifications.

Automation in Microsoft Sentinel

Explain automation options in Microsoft Sentinel
Create automation rules in Microsoft Sentinel

Threat response with Microsoft Sentinel playbooks

Explain Microsoft Sentinel SOAR capabilities.
Explore the Microsoft Sentinel Logic Apps connector.
Create a playbook to automate incident response.
Run a playbook on demand in response to an incident.

Security incident management in Microsoft Sentinel

Understand Microsoft Sentinel incident management
Explore Microsoft Sentinel evidence & entity management
Investigate & manage incident resolution

Identify threats with Behavioral Analytics

Explain User & Entity Behavior Analytics in Azure Sentinel
Explore entities in Microsoft Sentinel

Data normalization in Microsoft Sentinel

Use ASIM Parsers
Create ASIM Parser
Create parameterized KQL functions

Query, visualize, & monitor data in Microsoft Sentinel

Visualize security data using Microsoft Sentinel Workbooks.
Understand how questions work.
Explore workbook capabilities.
Create a Microsoft Sentinel Workbook.

Manage content in Microsoft Sentinel

Install a content hub solution in Microsoft Sentinel
Connect a GitHub repository to Microsoft Sentinel

Explain threat-hunting concepts in Microsoft Sentinel

Explain threat-hunting concepts for use with Microsoft Sentinel
Define a threat-hunting hypothesis for use in Microsoft Sentinel

Threat hunting with Microsoft Sentinel

Use queries to hunt for threats.
Save key findings with bookmarks.
Observe threats over time with the Livestream.

Use Search jobs in Microsoft Sentinel

Use Search Jobs in Microsoft Sentinel
Restore archive logs in Microsoft Sentinel

Look for threats using notebooks in Microsoft Sentinel

Examine Microsoft Sentinel's API libraries for advanced threat detection
Explain notebooks in Microsoft Sentinel
Create & use notebooks in Microsoft Sentinel

FAQs

What is the infrastructure required to attend your training program?

To attend the training session, you should have operational Desktops or Laptops with the required specification and a good internet connection to access the labs.

What if I miss a class on a particular day?

We would always recommend you attend the live session to practice & clarify the doubts instantly & get more value from your investment. However, if, due to some contingency, you have to skip the class, Radiant Techlearning will help you with the recorded session of that particular day. However, those recorded sessions are not meant only for personal consumption & NOT for distribution or commercial use.

How will I be accessing the labs?

Radiant Techlearning has a data center containing a Virtual Training environment for participants' hands-on practice.

Participants can easily access these labs over Cloud with the help of a remote desktop connection.

Radiant virtual labs allow you to learn from anywhere in the world & in any time zone.

What kind of projects are included as a part of training?

The learners will be enthralled as we engage them the real-world & industry Oriented projects during the training program. These projects will improve your skills & knowledge & you will gain a better experience. These real-time projects will help you a lot in your future tasks & assignments.

Send a Message.

Enroll