Microsoft Defender for Cloud

Explore why complexity in cyber security across people, cloud, endpoints, ICS, OT, and IoT heightens talent needs, automation gaps, and data deluge for defenders.

Explore the security operations center's core activities, including threat intelligence, threat hunting, log management, threat detection, incident response, and root-cause investigation.

Describe the three-tier SoC model: automation handles commodity malware and most alerts, tier one addresses easy cases, tier two tackles advanced threats, tier three conducts proactive threat hunting and forensics.

Follow the NIST-based incident response process from preparation to post-incident activities, including detection, analysis, containment, eradication, and lessons learned, to reduce impact in enterprises.

Explore how EDR and XDR monitor endpoint and broader infrastructure behavior, how SIEM centralizes logs with Sentinel, and how SOAR automates incident response in the Microsoft ecosystem.

Blue team conducts SoC-oriented duties like security monitoring, incident response, and threat hunting. Red team performs vulnerability assessments, penetration testing, social engineering, and TTP simulations, enabling purple teaming.

Define cyber threat intelligence using NIST: threat is circumstance or event that adversely impacts operations, assets, or individuals through information systems, unauthorized access, disclosure, modification, destruction, or denial of service.

Explore how cyber threat intelligence fits within broader intelligence and threat intelligence concepts, and identify adversary threat actors and their tactics, techniques, and procedures (TTPs) that drive CTI.

Cyber threat intelligence provides knowledge about adversaries’ motivations, intentions, and methods collected, analyzed, and disseminated to protect enterprise assets. It emphasizes tactics, techniques, and procedures to enable threat informed defense.

Distinguish threats, vulnerabilities, and risks in cyber security, define threat actors, and explain how exploiting vulnerabilities causes downtime, confidentiality breaches, or integrity loss, with risk defined as impact and likelihood.

Identify your organization's mission, target threat actors and their motivations, and the tactics, techniques, and procedures they use, then leverage cyber threat intelligence to detect and defend with threat-informed defense.

Learn how tactics describe threat actors' high-level behavior and objectives, how techniques realize those goals, and how procedures detail the actions, including reconnaissance and vulnerability scanning.

Differentiate IOCs and ioas by focusing on evidence of compromise versus attacker intent. Ingest IOCs into CIM, EDR, or XDR to detect behavior and defend with threat informed defense.

Learn the pyramid of pain and why detecting tactics, techniques, and procedures (TTPs) offers stronger defense than chasing hashes or IPs.

Identify three CTI sources: enterprise tools, open-source intelligence, and social media, with examples like Microsoft Defender Threat Intelligence, VirusTotal, Shodan, and Twitter/X.

Explore the five cloud computing properties—on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service—to enable fast provisioning, scalable resources, and bill generation.

Explore public, private, multi, and hybrid cloud models, with examples from Azure, AWS, and GCP, and learn how hybrid and multi-cloud patterns shape enterprise deployments.

Understand the Azure global backbone, including data centers, fiber and subsea cables, edge sites, and thousands of peering connections that deliver performance, fault tolerance, and disaster recovery across Azure regions.

Explore the shared responsibility model across Azure, AWS, and GCP, and how responsibilities shift from provider to customer across IaaS, PaaS, and SaaS. Learn which layers you own for security.

Explore the Azure resource hierarchy, from management groups to subscriptions and resource groups, and learn how clustering resources by lifecycle supports governance and security in Azure.

Explore Azure subscription types, including free (30 days credits, some services free 12 months) and student (12 months free credits, no credit card), plus pay-as-you-go and enterprise agreement terms.

Clarify how Entra ID tenants serve as identity providers and how identities access Azure resources in subscriptions and resource groups, dispelling the misconception that subscriptions themselves are tenants.

Adopt zero trust as a security strategy that treats every action as untrusted, verifies explicitly, enforces least privileged access, and assumes breach to minimize blast radius.

Explore the Microsoft security cosmos, focusing on cloud security, soc, and cti, and see how defender xdr bundles secure identities, endpoints, apps, cloud, and email across multi-cloud and on-premises environments.

Defend across attack chains by leveraging Defender for Office to stop phishing, Defender for Endpoint to block exploits, and Defender for Cloud Apps with XDR to prevent data exfiltration.

Explore defender for cloud as a synapse solution, a cloud native protection platform delivering DevSecOps scanning, CSPM guidance, and runtime protection across on-premises and cloud environments.

Explore the generally available Defender for Cloud CSPM and WP plans across Azure, AWS, GCP, and on-prem, including defender for key vault, APIs, and containers.

Discover Defender for Cloud's RBAC model, featuring pre-built roles like security reader and security admin, and how resource group, subscription, and custom roles manage viewing alerts, recommendations, and policy initiatives.

Learn how to create a free Azure subscription by choosing between free and pay as you go options and providing details, then log in at portal.azure.com to build in Azure.

Install VirtualBox to host Kali Linux by downloading VirtualBox from the resources section, selecting your operating system, running the installer with default settings, and reviewing the overview after installation.

Download Kali Linux and set up a virtual machine with VirtualBox, configure memory and cores, launch the VM, log in, and prepare to attack your infrastructure.

Configure the correct Kali Linux keyboard layout before you start by using the settings manager to add a German and/or English (US) layout, adjust priority, and remove unnecessary keyboards.

Demonstrates installing the Tor Browser on Kali via apt update and apt install, launching the Tor Browser Launcher, and verifying signature before connecting to Tor during later defender services testing.

Create a resource group in the Azure portal named MDC demo and select East US, then review and create to finalize the Defender for Cloud course resource container.

Create a new log analytics workspace for defender for cloud by selecting the resource group, naming it MDC LA, then deploy and monitor logs as they populate.

Enable all defender for cloud plans, including CSPM and defender for service. Note cost implications and flip switches for key vault, databases, storage, containers, and resource manager.

Enable defender for cloud on log analytics by editing settings in your demo subscription, enabling foundational CSPM, servers, and SQL on machines plans, then saving.

Deploy two virtual machines—Linux and Windows—to test Defender for servers on Azure, configuring Ubuntu Linux and Windows Server 2022 with no public inbound ports and managed identities.

Create a storage account for defender for cloud by selecting a resource group, a globally unique lowercase name, and standard performance, then add a Malware Upload container.

Create an Azure SQL database by configuring a new SQL server in the MDC demo resource group and then review and create, verifying the server and database appear.

Create an Azure Kubernetes Services cluster by navigating to Kubernetes Services, selecting create a Kubernetes cluster, configuring production standard, naming it MDC demo, validating, and provisioning.

Create an Azure Key Vault to test Defender for Cloud, naming it MDC demo in the US region with standard pricing, then verify it appears under key vaults.

Azure policy defines desired configurations and powers Defender for Cloud's security recommendations, secure score, and regulatory compliance, enabling auto deployment of Defender for Servers and vulnerability checks.

Explore Azure policy effects, focusing on audit, deny, and deploy if not exists, including auditing resource properties, denying prohibited actions, and auto deploying defender for servers when prerequisites are unmet.

Azure policy works with Azure Resource Manager to evaluate authenticated resource creation requests, enforcing policies like region denial across portals, CLI, PowerShell, or REST.

Examine Azure policy in the console, view defender policy definitions, and learn how deploy if not exists policy enrolls all virtual machines in defender for servers and installs agent.

Azure Arc enables managing on-premises and multi-cloud resources—VMs, Kubernetes, and databases—as if in Azure, via a single pane and Azure Resource Manager, with centralized auto patching and Defender coverage.

Learn to craft Kusto query language (KQL) queries to test hypotheses, locate IOCs in security events tables, explore schemas, filter with where, summarize results, and optionally visualize with render.

Explore the log analytics dedicated cluster, a premium option offering customer log box access controls, double encryption, and availability zones, with cross-workspace query performance, requiring 500 GB per day ingestion.