Microsoft Sentinel course with hands on sims for beginners

Microsoft Sentinel course for beginners teaches how assignments and simulations work, and that you don’t need checkboxes to finish—the videos determine course completion and certification.

Set up a personal lab with Microsoft 365 and Azure, obtain a free Office 365 trial to activate a Microsoft 365 E5 subscription, and explore Teams activation options.

Create a free Microsoft 365 trial account with a new email, verify by phone, and explore licensing, portal changes, and cancellation for hands-on simulations.

Claim $200 Azure credit for 30 days at portal.azure.com, with free services for a year and pay as you go subscription, to explore virtual machines, virtual networking, and firewall services.

Explore Microsoft Sentinel, a cloud-based SIEM and SOAR that centralizes logs from Azure, Microsoft 365, and on premise sources, using connectors, analytics, and playbooks to detect and respond.

Configure a Microsoft Sentinel workspace by creating a Log Analytics workspace, reviewing prerequisites and pricing, and attaching Microsoft Sentinel to enable security analytics.

Learn Microsoft Sentinel roles: reader, responder, contributor, playbook operator, and automation contributor, plus how to create custom roles, assign them in the Sentinel resource group, and manage playbooks and workbooks.

Learn how Sentinel handles log types, stores logs in a log analytics workspace, and controls log retention with 30-day retention and long-term archive up to 12 years.

Learn how to redo simulations in the Microsoft Sentinel beginners course by navigating to the summary, returning to the assignment, and opening instructions to access the simulation link anytime.

Identify data connectors to ingest and normalize logs into a central format for Microsoft Sentinel. Explore agent-based and agentless options, REST API, and manual uploads from cloud and on-prem sources.

Explore content hub solutions in Microsoft Sentinel, discover data connectors and data sources, and navigate the evolving defender and Azure portals.

Explore the basics of the Kusto query language (KQL), a SQL-like tool for querying information in Microsoft Defender and Sentinel, used to create rules, investigate incidents and alerts, and hunt.

Learn how to configure Microsoft Sentinel data connectors in Azure, including Azure Activity with diagnostic settings, Content Hub setup, and Defender integration during the transition.

Explore Azure Monitor agent (AMA) collecting log data from Windows, Linux, and on-prem devices, with data collection rules guiding what to collect and deliver to Azure Monitor logs in Sentinel.

Explore syslog and the common event format for data collection in Microsoft Sentinel, and learn to install and configure data connectors with the Azure Monitor agent and Log Analytics.

Explore collecting Windows security events and forwarded events in Microsoft Sentinel by installing the Windows Forwarded Events connector and configuring a data collection rule with the Azure Monitor Agent.

Learn to create a custom log table in a Log Analytics workspace for Sentinel by importing a sample log and configuring a data collection rule with a file path pattern.

Configure Microsoft Sentinel data connectors for Azure Activity and Microsoft Entra ID, ingesting sign-in logs and graph activity into a Log Analytics workspace via Azure Policy and diagnostic settings.

Visualize Microsoft Sentinel data with workbooks and templates, view saved workbooks to analyze sign-in activity, and learn to tune data connectors and data collection rules to optimize ingestion.

Explore how entities in Microsoft Sentinel classify and enrich security data, map fields to entity types, and support UBA, threat hunting, and automated responses. This enables incident investigations.

Explore Microsoft Sentinel analytics rules, including scheduled query rules (KQL), fusion rules, ML behavior analytics, near real-time analytics rules, customization, alerts, incidents, playbooks, and continuous improvement to detect threats.

Discover how to create analytics rules in Microsoft Sentinel using KQL queries, distinguish scheduled versus near real time rules, and generate alerts or incidents with entity mapping and custom details.

Explore how Asim standardizes data sources in Microsoft Sentinel using normalized schemas and parsers. Apply ingest time and query time parsing with kql to normalize and analyze cross source data.

Enable behavioral analytics (UEBA) in Microsoft Sentinel to build baselines per user, device, and identity, detect anomalies, and reduce false positives while catching insider threats or compromised accounts.

Configure permissions for incident investigation by assigning the Microsoft Sentinel Responder role in the Azure IAM blade, then investigate incidents, view incident graphs and evidence, and reset passwords as needed.

Explore how Microsoft Sentinel automation rules automate incident tasks, assign severity, and standardize triage, while playbooks perform actions like enrichment and remediation across teams.

Create automation rules in Microsoft Sentinel to auto assign medium or high incidents, trigger on incident creation, run a playbook, adjust status and severity, and set rule order.

Learn to create and customize playbooks in Microsoft Sentinel using incident, alert, or entity triggers, connect to Logic Apps, and deploy templates for automated responses.

Discover how Microsoft Sentinel playbooks run on premises via a hybrid runbook worker connected to an Azure Automation account, enabling on-premises tasks from Azure-based playbooks.

Learn how Kusto query language (KQL) searches, filters, and analyzes large security data across Microsoft 365, Defender XDR, Sentinel, and Purview, using a SQL-like syntax, pipes, and time-based aggregation.

Explore Microsoft’s demo environment to practice KQL queries, guided by downloadable resources and Copilot-assisted query generation, with copious examples and copy-paste capability for real-world Azure challenges.

Master basic KQL syntax in a Microsoft Sentinel demo. Switch to KQL mode, query the security event table, and use where and pipe searches to find logon events and processes.

Learn to filter security events in Microsoft Sentinel with KQL using dynamic time ranges. Summarize results with count and distinct count, and identify top sources.

Explore kql basics to display security events, calculate event age, create time generated columns, and project, filter, and sort the ten earliest logon events by time generated.

Master variables in KQL by using the let command, and then combine outputs with union and join to correlate security events like 4624 and 4688 by account and computer.

Learn how to use advanced hunting with kql in Microsoft Defender to analyze device events, registry and logon data, email, alerts, and CVEs.

Explore the Microsoft Sentinel and Defender query repository on GitHub, learn to locate and run device inventory queries in Microsoft Defender's advanced hunting, and customize time ranges for hands-on practice.

Explore how the MITRE ATT&CK framework maps attacker techniques to tactics in enterprise environments, and how Microsoft Sentinel uses this blueprint to classify threats and guide investigations.

Explore threat indicators (IOCs) and how Microsoft Sentinel uses threat intelligence, content hub, and data connectors to ingest indicators and automatically generate alerts or incidents from logs and network data.

Learn how hunts in Microsoft Sentinel enable proactive threat hunting by manually creating structured investigations, using live streams, bookmarks, and queries to identify suspicious activity.

Create a hunting query in Microsoft Sentinel to detect suspicious sign-in activity with a kql query on sign-in logs for failed attempts in the last hour.

Learn how to use hunting bookmarks in Microsoft Sentinel to capture, preserve, and organize evidence during hunts, including entities, timestamps, and queries, and to attach bookmarks to incidents for collaboration.

Learn how to search and restore archived logs in Microsoft Sentinel, navigating analytics tier, basic, and archive data lake tiers, and manage restoration costs with saved searches.

Explore the Microsoft Sentinel search experience to quickly query log data using Kusto queries, focusing on sign-in logs and other tables, with saved searches for 14 days and archiving options.

Explore workbook templates in Microsoft Sentinel to visualize data quickly from the content hub. Customize the time range and user filters, and view templates for audit logs and role management.

Create a custom workbook in Microsoft Sentinel using KQL queries and data source visualizations, with text, parameters, actions, images, and groups; explore sign-in logs and save the workbook.

Explore how to adjust visualization options in Microsoft Sentinel workbooks, including adding images and videos, editing queries, and switching visuals like pie charts, then save your customized workbook.

Demonstrate how Udemy's role play feature uses AI to generate scenarios for practicing responses in meetings, with a demo and guidance that the activity is optional for earning the certificate.

Delete your Azure resource groups in portal.azure.com to remove resources and stop using Azure credits. Then cancel Microsoft 365 subscriptions via portal.microsoft.com before the 30 day trial ends.

Learn to obtain your Udemy certificate by completing all course videos; assignments do not matter, read the article, and contact Udemy support if you need help.

Explore where to continue learning with more Microsoft Sentinel and certification courses, access promo codes and giveaways, subscribe on YouTube, join the email list, and claim free exam vouchers.