SC-200: Microsoft Security Operations Analyst

Tietoturva-ammattilaiselle, jonka vastuulla tulee olemaan M365- sekä Azure-ympäristön suojaaminen sekä valvonta. Henkilölle, joka haluaa oppia Microsoftin tarjoamista tietoturvatuotteista ja ymmärtää niiden käyttöä havainnoinnissa ja tutkinnassa syvällisemmin. 

Kurssi valmentaa sertifiointitestiä ”SC-200: Microsoft Security Operations Analyst” varten. Testillä saavuttaa Security Operations Analyst Associate -tason.

Perustuntemus Microsoft 365- sekä Azure-palveluista. Microsoftin tietoturvatuotteiden tunnistaminen securityn, compliancen sekä identityn osa-alueilla (esim. SC-900 kautta). Etua myös lokienhallinnan perusteiden sekä KQL-kielen tuntemisesta. 

Module 01 – Mitigate threats using Microsoft Defender for Endpoint 

• Protect against threats with Microsoft Defender for Endpoint 

• Deploy the Microsoft Defender for Endpoint environment 
• Implement Windows 10 security enhancements 
• Manage alerts and incidents 
• Perform device investigations 
• Perform actions on a device 

• Perform evidence and entities investigations 
• Configure and manage automation 
• Configure for alerts and detections 
• Utilize Threat and Vulnerability Management 

Module 02 – Mitigate threats using Microsoft 365 Defender 

• Introduction to threat protection with Microsoft 365 
• Mitigate incidents using Microsoft 365 Defender 
• Protect your identities with Azure AD Identity Protection 
• Remediate risks with Microsoft Defender for Office 365 

• Safeguard your environment with Microsoft Defender for Identity 
• Microsoft Cloud App Security 
• Respond to data loss prevention alerts 
• Manage insider risk in Microsoft 365 

Module 03 – Mitigate threats using Azure Defender 

• Plan for cloud workload protections using Azure Defender 
• Explain cloud workload protections in Azure Defender 
• Connect Azure assets to Azure Defender 
• Connect non-Azure resources to Azure Defender 

• Remediate security alerts using Azure Defender 

Module 04 – Create queries for Azure Sentinel using Kusto Query Language (KQL) 

• Construct KQL statements for Azure Sentinel 
• Analyze query results using KQL 

• Build multi-table statements using KQL 
• Work with string data using KQL statements 

Module 05 – Configure your Microsoft Sentinel environment  

• Introduction to Microsoft Sentinel 

• Create and manage Microsoft Sentinel workspaces 
• Query logs in Microsoft Sentinel 
• Use watchlists in Microsoft Sentinel 
• Utilize threat intelligence in Microsoft Sentinel 

Module 06 – Connect logs to Microsoft Sentinel 

• Connect data to Microsoft Sentinel using data connectors 
• Connect Microsoft services to Microsoft Sentinel 
• Connect Microsoft 365 Defender to Microsoft Sentinel 
• Connect Windows hosts to Microsoft Sentinel 

• Connect Common Event Format logs to Microsoft Sentinel 
• Connect syslog data sources to Microsoft Sentinel 
• Connect threat indicators to Microsoft Sentinel 

Module 07 – Create detections and perform investigations using Microsoft Sentinel 

• Threat detection with Microsoft Sentinel analytics 
• Threat response with Microsoft Sentinel playbooks 
• Security incident management in Microsoft Sentinel 
• Use entity behaviour analytics in Microsoft Sentinel 
• Query, visualize, and monitor data in Microsoft Sentinel 

Module 08 – Perform threat hunting in Microsoft Sentinel 

• Threat hunting with Microsoft Sentinel 
• Hunt for threats using notebooks in Microsoft Sentinel