Microsoft Sentinel Advanced Course: Secure Azure Like a Pro

Set up a GitHub repository to deploy Microsoft Sentinel artifacts—from analytics rules, automation, rules, and workbooks—while examining the PowerShell script and using Aram templates as infrastructure as code.

Automate deploying a Microsoft Sentinel analytics rule from a GitHub repository using a PowerShell script and pipeline, then verify provisioning shows success in the Sentinel analytics pane.

Learn how to verify content status in Microsoft Sentinel by reviewing repository-synced analytics rules in the source name column, exporting changes via ARM templates, and checking deployment details and errors.

Resolve pipeline errors in the Microsoft Sentinel upload process by enabling read and write workflow permissions, and learn to track deployed analytics rules to avoid redeploying existing content.

Track ARM template changes in a repository using a tracking table to deploy only updated or newly created analytics rules, improving pipeline efficiency.

Authenticate with GitHub in Visual Studio Code, clone the Microsoft Sentinel repository, and work on ARM templates locally before deploying to Microsoft Sentinel.

Open Visual Studio Code to stage and commit a playbook from your computer, push to GitHub, and deploy the Microsoft Sentinel playbook to your cloud resource group via GitHub Actions.

Deploy ARM templates, parsers, hunting queries, automation rules, and workbooks to Microsoft Sentinel from a repository. Sync changes with GitHub via terminal, resolve conflicts, and verify deployments in the portal.

Validate ARM deployment in the Azure portal by verifying the automation rule, ChatGPT playbook, and analytics rule for Azure diagnostic settings.

Learn to deploy an unsupported artifact, a watch list, to Azure Sentinel using a modified PowerShell script and pipeline updates.

Learn the correct deployment order for Microsoft Sentinel artifacts, starting with a watchlist and parsers, then analytics rules and hunting queries, followed by playbooks, automation rules, and workbooks.

Optimize Microsoft Sentinel deployments by structuring the pipeline into jobs that deploy artifacts with dependencies, or rename folders to deploy in the right order, then use git commands to deploy.

Master GitHub repositories with Microsoft Sentinel, adjust the PowerShell script and deployment pipeline for automatic deployment of new content, and learn the correct ARM template formats for infrastructure as code.

Dive into infrastructure as code for Microsoft Sentinel by mastering ARM templates and automating their generation with PowerShell for analytics rules, workbooks, playbooks, and automation rules.

Explore the arm template structure and its parts—schema, content version, api profile, parameters, variables, resources, and outputs—and deploy Microsoft Sentinel resources with a workspace parameter for log analytics.

Explore arm templates formatting and parameters for azure sentinel, including schema, content version, workspace parameter in pipelines, and using concat to generate unique resource names for watchlists and automation rules.

Generate an ARM template for analytics rule in Azure Sentinel, export from the portal, and deploy via repository using the workspace parameter with version control and descriptive naming.

Shows how to export a workbook as an ARM template from the Azure portal, edit parameters for subscription ID, resource group name, and workspace, and deploy across environments.

Learn to generate an ARM template for a playbook with the PowerShell Playbook Item Template Generator, export and adjust it, and deploy securely in Microsoft Sentinel.

Learn to generate a reusable arm template for automation rules (and analytics rules) using api calls, extract the properties section, and adapt it across environments.

Demonstrate generating an arm template for automation rules with a PowerShell script, authenticate, set your workspace and resource group, and download ready templates for Azure Sentinel.

Modify arm templates for parsers, watchlists, and hunting queries, using single quotation marks in queries to preserve json validity and adjust display names and tactics and techniques values.

Access the official Microsoft Sentinel GitHub page for up-to-date arm templates and configurations to deploy Sentinel at scale, with a catalog of playbooks and analytics rules.

Explore internal pricing factors and practical cost optimization for Microsoft Sentinel, using tools to assess costs and apply hands-on techniques to implement cost-saving measures.

Explore Microsoft Sentinel pricing, comparing analytics and basic logs, including pay-as-you-go, commitment tiers, data retention, archive tier, and costs for search, restore, and export.

Explore exceptions to Microsoft Sentinel pricing, including free ten gigabytes per day for 31 days, data grants for Microsoft 365 licenses, and free ingestion for select Microsoft logs.

Explore using the Microsoft Sentinel pricing calculator to estimate costs by region and log inputs, including retention, data ingestion, restore, and search options, with cautions about misreadings and price changes.

In the Azure Sentinel portal, manage data connectors, selecting essential Azure Active Directory logs—non-interactive sign-in and audit logs—to optimize ingestion costs while preserving value.

Set up data connectors in the Microsoft Sentinel Content Hub. Create a VM and configure a data collection rule for Windows security events via the AMA agent, with cost considerations.

Track and optimize Microsoft Sentinel costs with the portal, cost and workspace usage workbooks, and cost analysis tools to identify data ingestion drivers and opportunities to reduce spending.

Reduce Microsoft Sentinel costs by selecting the right commitment tier, using basic logs for high-volume data, and archiving with Azure Data Lake Storage or Azure Data Explorer.

Explore cost-saving strategies for Microsoft Sentinel, comparing data ingestion versus analytics locks, with eight-day retention and basic locks operator limits.

Set up a storage account and enable diagnostic settings to send basic logs to Microsoft Sentinel and Log Analytics. Ingest storage logs into Azure Data Explorer and search them.

Explore basic logs in Microsoft Sentinel, use search jobs to query storage blob blocks, create a custom table, and filter with where and other operators for rapid analysis.

Explore data collection rules in Microsoft Sentinel using a workbook to configure, transform, and deploy data for Windows events and Azure activity, including filtering failed logins and testing queries.

Apply kql transformation for windows security events by filtering event 4625, removing extra fields, and deploying the transformation query in an arm template to optimize data collection.

Explore Azure Data Explorer and its role with Microsoft Sentinel for long-term data retention, incident enrichment, and threat hunting, including archiving to Azure Data Storage and external tables.

Explore ingesting JSON logs from Azure storage into an Azure Data Explorer cluster, set up a database and table, and query the data with SQL for fast, structured searches.

Learn to perform cross resource queries from Microsoft Sentinel to Azure Data Explorer by specifying cluster URL, database, and table, then run a quick five-entry lookup.

Disable all data connectors and diagnostic settings to prevent future charges in Microsoft Sentinel, prioritizing Azure Active Directory non-interactive sign in logs, Windows events, and related resources.