The Complete Course of Microsoft Sentinel

Explore prerequisites and system requirements for Microsoft Sentinel, including an Azure subscription, permissions, Azure Active Directory, data sources, a Log Analytics workspace, connectivity, and Azure deployment with data connectors.

Configure Azure Sentinel by creating an active Azure subscription, creating a resource group, assigning roles (Owner, Contributor, or Reader), and provisioning a Log Analytics workspace in the Azure portal.

Learn to configure data connectors and data sources in Microsoft Sentinel after deployment. Ingest data from Microsoft and non-Microsoft sources via connectors and APIs, with permissions and setup steps.

Answer a four-question quiz to test Sentinel knowledge. Learn about data sources for visibility, Azure Monitor, ownership to delegate roles, and viewing events over time in the overview pane.

Collect and ingest data from various sources into Microsoft Sentinel by configuring data connectors. Enable UEBA and analytics rules to detect incidents using Azure activity and Microsoft Entra ID.

Explore how Azure Monitor collects telemetry data from diverse sources and feeds Microsoft Sentinel for security analytics, automated response, and advanced threat detection.

Learn to configure custom data connectors in Microsoft Sentinel, from CCP and Log Analytics agent to Logic Apps and Azure Functions, with practical portal steps.

Configure custom data connectors in Microsoft Sentinel by selecting a pre-existing connector and adjusting its settings, then monitor activity via Sentinel console logs to discover security threats.

Explore Microsoft Sentinel workbooks for data visualization and interactive dashboards, using templates or custom workbooks, with prerequisites and permissions to enable security analytics and monitoring.

Learn to build custom workbooks for data visualizations in Microsoft Sentinel using templates from the Content Hub, customize with edits, and manage saving, sharing, and auto refresh.

Learn how to monitor and manage Microsoft Sentinel workbooks with Azure Monitor, using templates or from scratch, to create interactive dashboards from Log Analytics and other data sources.

Learn to create and customize Microsoft Sentinel workbooks in the Azure portal, using templates or custom edits, manage workbook reader or contributor permissions, and set auto-refresh.

Test your understanding of Microsoft Sentinel workbooks and dashboards through four questions on drilling down into data points and using log analytics queries for security data.

Explore how analytics rules in Microsoft Sentinel enable early threat detection, automation, and customization with built-in and custom rules for proactive security.

Create custom analytics rules in Microsoft Sentinel by using templates or building your own, to detect suspicious activity and automatically generate incidents for investigation.

Learn to fine-tune and manage analytics rules in Microsoft Sentinel, using machine learning insights, testing rules, integrating threat intelligence, and optimizing queries to reduce false positives and improve detection.

Wraps up module five with a four-question quiz on tuning performance, validating rules with the test rule feature, automating incident response via custom analytics rules, and using Kusto query language.

Discover how Microsoft Sentinel detects security incidents and uses a full-featured case management platform, incident details page, and automation rules to triage and respond.

Classify and investigate incidents in Microsoft Sentinel by aggregating alerts into a single incident from analytics rules, then manage the investigation through the incident detail page with permissions and ownership.

Automate incident response in Microsoft Sentinel with playbooks, using templates or custom automations, tested before deployment, and triggered by automation rules to remediate and isolate threats.

Master how playbooks trigger automatically on conditions, what a logic app does as an automated workflow, and how severity levels support incident management in Microsoft Sentinel.

Learn proactive threat hunting in Microsoft Sentinel by collecting data, applying analytics rules and kql queries, and following a continuous improvement workflow.

Use KQL for threat hunting in Microsoft Sentinel, build analytics queries and proactive detection rules with pre-built and custom analytics, and integrate threat intelligence while continuously monitoring data.

Review four quiz questions on threat hunting in Microsoft Sentinel, highlighting proactive detection and response, Kusto query language, automation benefits, and threat intelligence feeds for contextual alerts.

Explore monitoring compliance with security policies in Microsoft Sentinel through built-in dashboards, continuous monitoring, automated checks, and Azure policy and Security Center integration for enforcement and audits.

Create tailored reports in microsoft sentinel with azure workbooks, templates, and kusto queries, and integrate sentinel with azure security center to enhance security monitoring and compliance.

Master compliance monitoring in Microsoft Sentinel through the module eight quiz, focusing on policy enforcement, adherence tracking with compliance policies, data retention, and third-party integration with Azure Security Center.

Automate security tasks in Microsoft Sentinel with Logic Apps and playbooks, enabling incident enrichment, automated responses, and orchestration across security tools and feeds.

Learn to create custom automation workflows in Microsoft Sentinel using Logic Apps and orchestrate tasks with Azure Functions, enabling incident response, threat hunting, and security operations.

Wraps up module nine with a four-question quiz on Microsoft Sentinel automation, covering goals to boost security operations efficiency, Azure Logic Apps for automated workflows, and playbooks and Azure Functions.

Explore advanced Kql queries in Microsoft Sentinel, including time series analysis and anomaly detection, while integrating third-party solutions and managing multi-cloud environments across AWS, Azure Monitor, and Google Cloud Security.

Test your understanding of integrating third party security solutions with Microsoft Sentinel, using connectors, logic apps, and Azure Functions to ingest data and build workflows.