SC-200: Microsoft Security Operations Analyst

Tietoturva-ammattilaiselle, jonka vastuulla tulee olemaan M365- sekä Azure-ympäristön suojaaminen sekä valvonta. Henkilölle, joka haluaa oppia Microsoftin tarjoamista tietoturvatuotteista ja ymmärtää niiden käyttöä havainnoinnissa ja tutkinnassa syvällisemmin. 

Kurssi valmentaa sertifiointitestiä ”SC-200: Microsoft Security Operations Analyst” varten. Testillä saavuttaa Security Operations Analyst Associate -tason.

• Perustuntemus Microsoft 365- sekä Azure-palveluista.
• Microsoftin tietoturvatuotteiden tunnistaminen securityn, compliancen sekä identityn osa-alueilla (esim. SC-900: Microsoft Security, Compliance, and Identity Fundamentals -kurssin kautta).
• Etua myös lokienhallinnan perusteiden sekä KQL-kielen tuntemisesta.

Module 01: Mitigate threats using Microsoft Defender for Endpoint 

• Protect against threats with Microsoft Defender for Endpoint 
• Deploy the Microsoft Defender for Endpoint environment 
• Implement Windows 10 security enhancements 
• Manage alerts and incidents 
• Perform device investigations 
• Perform actions on a device 
• Perform evidence and entities investigations 
• Configure and manage automation 
• Configure for alerts and detections 
• Utilize Threat and Vulnerability Management 

Module 02: Mitigate threats using Microsoft 365 Defender 

• Introduction to threat protection with Microsoft 365 
• Mitigate incidents using Microsoft 365 Defender 
• Protect your identities with Azure AD Identity Protection 
• Remediate risks with Microsoft Defender for Office 365 
• Safeguard your environment with Microsoft Defender for Identity 
• Microsoft Cloud App Security 
• Respond to data loss prevention alerts 
• Manage insider risk in Microsoft 365 

Module 03: Mitigate threats using Azure Defender 

• Plan for cloud workload protections using Azure Defender 
• Explain cloud workload protections in Azure Defender 
• Connect Azure assets to Azure Defender 
• Connect non-Azure resources to Azure Defender 
• Remediate security alerts using Azure Defender 

Module 04: Create queries for Azure Sentinel using Kusto Query Language (KQL) 

• Construct KQL statements for Azure Sentinel 
• Analyze query results using KQL 
• Build multi-table statements using KQL 
• Work with string data using KQL statements 

Module 05: Configure your Microsoft Sentinel environment  

• Introduction to Microsoft Sentinel 
• Create and manage Microsoft Sentinel workspaces 
• Query logs in Microsoft Sentinel 
• Use watchlists in Microsoft Sentinel 
• Utilize threat intelligence in Microsoft Sentinel 

Module 06: Connect logs to Microsoft Sentinel 

• Connect data to Microsoft Sentinel using data connectors 
• Connect Microsoft services to Microsoft Sentinel 
• Connect Microsoft 365 Defender to Microsoft Sentinel 
• Connect Windows hosts to Microsoft Sentinel 
• Connect Common Event Format logs to Microsoft Sentinel 
• Connect syslog data sources to Microsoft Sentinel 
• Connect threat indicators to Microsoft Sentinel 

Module 07: Create detections and perform investigations using Microsoft Sentinel 

• Threat detection with Microsoft Sentinel analytics 
• Threat response with Microsoft Sentinel playbooks 
• Security incident management in Microsoft Sentinel 
• Use entity behaviour analytics in Microsoft Sentinel 
• Query, visualize, and monitor data in Microsoft Sentinel 

Module 08: Perform threat hunting in Microsoft Sentinel 

• Threat hunting with Microsoft Sentinel 
• Hunt for threats using notebooks in Microsoft Sentinel