Microsoft Defender for Cloud

Explore the security operations center's core activities, including threat intelligence, threat hunting, log management, threat detection, incident response, and root-cause investigation.

Describe the three-tier SoC model: automation handles commodity malware and most alerts, tier one addresses easy cases, tier two tackles advanced threats, tier three conducts proactive threat hunting and forensics.

Follow the NIST-based incident response process from preparation to post-incident activities, including detection, analysis, containment, eradication, and lessons learned, to reduce impact in enterprises.

Explore how EDR and XDR monitor endpoint and broader infrastructure behavior, how SIEM centralizes logs with Sentinel, and how SOAR automates incident response in the Microsoft ecosystem.

Blue team conducts SoC-oriented duties like security monitoring, incident response, and threat hunting. Red team performs vulnerability assessments, penetration testing, social engineering, and TTP simulations, enabling purple teaming.

Explore how cyber threat intelligence fits within broader intelligence and threat intelligence concepts, and identify adversary threat actors and their tactics, techniques, and procedures (TTPs) that drive CTI.

Distinguish threats, vulnerabilities, and risks in cyber security, define threat actors, and explain how exploiting vulnerabilities causes downtime, confidentiality breaches, or integrity loss, with risk defined as impact and likelihood.

Identify your organization's mission, target threat actors and their motivations, and the tactics, techniques, and procedures they use, then leverage cyber threat intelligence to detect and defend with threat-informed defense.

Identify three CTI sources: enterprise tools, open-source intelligence, and social media, with examples like Microsoft Defender Threat Intelligence, VirusTotal, Shodan, and Twitter/X.

Explore public, private, multi, and hybrid cloud models, with examples from Azure, AWS, and GCP, and learn how hybrid and multi-cloud patterns shape enterprise deployments.

Understand the Azure global backbone, including data centers, fiber and subsea cables, edge sites, and thousands of peering connections that deliver performance, fault tolerance, and disaster recovery across Azure regions.

Explore the Azure resource hierarchy, from management groups to subscriptions and resource groups, and learn how clustering resources by lifecycle supports governance and security in Azure.

Explore the Microsoft security cosmos, focusing on cloud security, soc, and cti, and see how defender xdr bundles secure identities, endpoints, apps, cloud, and email across multi-cloud and on-premises environments.

Defend across attack chains by leveraging Defender for Office to stop phishing, Defender for Endpoint to block exploits, and Defender for Cloud Apps with XDR to prevent data exfiltration.

Explore defender for cloud as a synapse solution, a cloud native protection platform delivering DevSecOps scanning, CSPM guidance, and runtime protection across on-premises and cloud environments.

Explore the generally available Defender for Cloud CSPM and WP plans across Azure, AWS, GCP, and on-prem, including defender for key vault, APIs, and containers.

Discover Defender for Cloud's RBAC model, featuring pre-built roles like security reader and security admin, and how resource group, subscription, and custom roles manage viewing alerts, recommendations, and policy initiatives.

Configure the correct Kali Linux keyboard layout before you start by using the settings manager to add a German and/or English (US) layout, adjust priority, and remove unnecessary keyboards.

Deploy two virtual machines—Linux and Windows—to test Defender for servers on Azure, configuring Ubuntu Linux and Windows Server 2022 with no public inbound ports and managed identities.

Create an Azure SQL database by configuring a new SQL server in the MDC demo resource group and then review and create, verifying the server and database appear.

Create an Azure Key Vault to test Defender for Cloud, naming it MDC demo in the US region with standard pricing, then verify it appears under key vaults.

Azure policy works with Azure Resource Manager to evaluate authenticated resource creation requests, enforcing policies like region denial across portals, CLI, PowerShell, or REST.

Examine Azure policy in the console, view defender policy definitions, and learn how deploy if not exists policy enrolls all virtual machines in defender for servers and installs agent.

Azure Arc enables managing on-premises and multi-cloud resources—VMs, Kubernetes, and databases—as if in Azure, via a single pane and Azure Resource Manager, with centralized auto patching and Defender coverage.

Learn to craft Kusto query language (KQL) queries to test hypotheses, locate IOCs in security events tables, explore schemas, filter with where, summarize results, and optionally visualize with render.