Microsoft Sentinel: End-to-End SOC Implementation Training

Name: Microsoft Sentinel: End-to-End SOC Implementation Training
Rating: 4.7 (52 reviews)

From Deployment to Detection — Build, Monitor, and Automate Your SOC with Hands-On Labs (SIEM)

Highest Rated

Created byYasir Mehmood

Last updated 10/2025

English

What you'll learn

Understand Microsoft Sentinel Architecture
Build and Configure a Complete Sentinel Lab
Onboard and Monitor Data Sources
Create and Manage Analytics Rules
Respond to Incidents Using Automation
Use Kusto Query Language (KQL) for Investigation
Understand Real-World Security Use Cases
Automation and Playbook

Course content

6 sections • 34 lectures • 2h 50m total length

Meet Your Instructor2:27
Engage in end-to-end SoC implementation training by building a sentinel environment, connecting endpoints, analyzing logs for threat detection, incident response, and automating responses with playbooks to strengthen proactive defense.
Lab Infrastructure1:48
Activate an Azure free trial to access a risk-free lab environment for building and testing sentinel, with $200 credit for 30 days and full administrative access.
Training Objectives3:15
Explore how Microsoft Sentinel enables a complete SOC workflow, from environment setup and data onboarding to real-time detection, automation, and incident response.

What You’ll Learn in This Module3:19
Set up a Microsoft Sentinel environment by creating a resource group and log analytics workspace, linking a data collection endpoint, and preparing on-premises VMs, then enable Sentinel for SOC operations.
Creating a Resource Group3:50
Creating a Log Analytic Workspace4:41
Create a Log Analytics workspace in Azure portal to store Sentinel logs and telemetry, keep it in the same subscription, resource group, and region, and manage retention, tags, and access.
Creating a Data Collection Endpoint3:50
Enabling Microsoft Sentinel3:25
Enable Microsoft Sentinel on your log analytics workspace to deploy its analytics engine, dashboards, and data connectors, turning the workspace into an active security center that detects threats.
RBAC and Permissions7:08
Apply role-based access control guided by the principle of least privilege to manage who can access and modify resources in Azure Sentinel, using owner, contributor, and reader roles at scope.
WrapUp1:21
Review module one by creating a resource group, configuring the Log Analytics workspace and data collection endpoint, and setting RBAC and permissions, then enabling Microsoft Sentinel for log ingestion.

What You’ll Learn in This Module3:15
Deploy and prepare on-prem virtual machines (Windows 10 and Ubuntu 22.04 LTS) as sensors, configure networking and updates, and ready the Azure Monitor agent and log forwarding for Microsoft Sentinel.
Creating a Windows 10 Virtual Machine10:07
Create a Windows 10 VM in VMware using the enterprise ISO, configure hardware and bridged networking, install VMware tools, verify connectivity, enable remote desktop, and test a Sentinel event.
Creating a Ubuntu 22.04 LTS Virtual Machine8:45
Create an Ubuntu 22.04 LTS virtual machine in VMware Workstation with bridged networking. Update packages with apt and generate a Microsoft Sentinel test log to feed Microsoft Sentinel.
Wrap-Up1:26
Review module two outcomes: deploy Windows 10 and Ubuntu endpoints, enable RDP and SSH, apply updates, and prepare for Azure Monitor agent installation and log forwarding into Microsoft Sentinel.

What You’ll Learn in This Module3:03
Onboard Windows and Ubuntu VMs to Microsoft Sentinel by installing the Azure Monitor Agent, configuring Data Collection Rule, and validating ingestion to the Log Analytics workspace with heartbeat and syslog.
Installing AMA on Windows 10 Virtual Machine9:32
Onboard on-prem Windows 10 and Ubuntu VMs with Azure Arc, install Azure Monitor agent via onboarding script, link to data collection rule and endpoint, and stream logs to Azure Sentinel.
Configuring Data Collection Rule for Windows 10 Virtual Machine5:47
Configure data collection rules (DCRs) to specify logs and metrics from Windows 10 virtual machines and connect endpoints to Sentinel through the Azure Monitor agent and Log Analytics workspace.
Installing AMA on Ubuntu 22.04 LTS Virtual Machine4:04
Onboard an on-premises Ubuntu 22.04 lts VM to Azure Sentinel using the linux onboarding script, enabling Azure Arc to monitor syslog, authentication logs, and system telemetry.
Configuring Data Collection Rule for Ubuntu 22.04 LTS Virtual Machine8:08
Configure a data collection rule (DCR) for the Ubuntu 22.04 LTS VM to define data sources, collection methods, and delivery to the Log Analytics workspace for Microsoft Sentinel.
Wrap_Up1:14
Install the Azure Monitor agent on Windows and Linux VMs to collect telemetry. Link VMs to DCR, validate logs with KQL, and prepare Sentinel for real-time threat detection.

What You’ll Learn in This Module3:30
Enabling PowerShell Auditing2:07
Configure Windows auditing to track login, logoff, and special logon events for security monitoring and log them into Microsoft Sentinel via Azure Monitor Agent, enabling alerting and analysis.
Creating a Failed Analytic Rule11:29
Create a schedule analytic rule in Microsoft Sentinel using a KQL query on Windows events 4625 to detect more than three failed logins in five minutes, grouping into an incident.
Enabling PowerShell Block Logging5:44
Detect suspicious PowerShell activity with Microsoft Sentinel by enabling script block logging on Windows endpoints and using event ID 4104 to fuel Sentinel detection rules in Log Analytics.
Creating a Suspicious PowerShell Analytic Rule12:03
configure azure sentinel to collect the powershell operational log with a custom data collection rule, enabling real-time alerting on suspicious powershell activity via event id 4104 and a kql-based rule.
Creating a SSH Brute Force Analytic Rule8:29
Detect ssh brute force attempts on linux servers by creating a scheduled analytics rule in microsoft sentinel that counts failed ssh logins within five minutes.
Creating a Impossible Login Location Analytic Rule11:34
Configure a Microsoft Sentinel analytics rule to detect impossible login locations in Microsoft 365 by ingesting Entra ID sign-in logs and flagging multi-country logins within an hour.
Wrap-Up1:38

What You’ll Learn in This Module3:09
Automate incident responses in Microsoft Sentinel by building Logic Apps playbooks linked to analytics rules, automatically notifying teams and enabling actions like blocking users, quarantining devices, and threat intelligence enrichment.
Automation Blade2:20
Navigate to the automation blade in the Defender portal to view playbooks, Azure logic apps that run automatically when a trigger occurs and turn alerts into actions.
Creating a Playbook11:40
Create a playbook in Microsoft Sentinel with an incident trigger to automatically email the soc when a new incident is created, demonstrating end-to-end automation.
Connecting a Playbook3:13
Connect the playbook to an analytic rule so it runs automatically when incidents are created, driving real-time automated response and alerting the SOC team, and test in a lab.
Trigger and Test the Playbook1:14
Trigger and test the playbook in Microsoft Sentinel by simulating failed RDP logins on a Windows 10 VM, verify the incident alert, and confirm an email notification via Outlook.
Wrap-Up1:39
Automate incident response in a modern SOC by linking analytic rules to playbooks built with logic apps and testing automated responses.

Requirements

Basic understanding of IT or cybersecurity concepts (helpful but not mandatory).
Familiarity with Microsoft Azure or cloud environments is an advantage, though the course will guide you step-by-step.
Access to a computer with a stable internet connection — you’ll be setting up virtual machines and connecting to the Azure portal.
An active Microsoft account (you can create one for free) to activate the Azure free trial with $200 credits for 30 days.
Interest in hands-on learning! This course is designed to help you build and practice in your own Microsoft Sentinel environment — no prior Sentinel experience required.

Description

This comprehensive, hands-on course on Microsoft Sentinel: End-to-End SOC Implementation is designed to take learners from the very basics of setting up a Security Operations Center (SOC) environment to implementing advanced detection and automated response workflows. You will start by building a fully functional Sentinel environment in Microsoft Azure, deploying both Windows 10 and Ubuntu virtual machines as on-premises endpoints, and configuring them for log collection using Azure Monitor Agents (AMA) and Data Collection Rules (DCR).

Once the environment is ready, you will learn to ingest and analyze telemetry data using Kusto Query Language (KQL), gaining practical skills in monitoring heartbeat, syslog, and other important logs. You will then create custom Analytics Rules to detect real-world attack scenarios such as failed RDP logins, suspicious PowerShell executions, SSH brute-force attempts, and impossible location logins. The course will also cover how to validate incidents, review alerts, and understand the detection workflow in Sentinel.

Finally, the course teaches how to leverage the Automation blade and Playbooks to streamline responses, send alerts, and enrich incident data, enabling a full Detect-to-Respond cycle. By the end of this training, learners will have the confidence and practical knowledge to deploy, monitor, detect, and respond to security threats using Microsoft Sentinel, making it ideal for IT professionals, SOC analysts, and anyone seeking hands-on cloud security experience.

Who this course is for:

Aspiring Security Analysts who want to gain hands-on experience with Microsoft Sentinel and understand how modern SOCs operate.
IT Professionals or System Administrators looking to transition into cybersecurity or expand their skills in SIEM, log analysis, and incident response.
Cybersecurity Students or Beginners eager to build practical, job-ready skills using Microsoft Sentinel in a real-world environment.
SOC Analysts and Engineers who want to strengthen their understanding of Sentinel’s full workflow — from data collection to automated response.
Cloud Security Enthusiasts who want to explore Microsoft’s native security monitoring and automation capabilities.

Microsoft Sentinel: End-to-End SOC Implementation Training

What you'll learn

Explore related topics

Course content

Welcome and Getting Started3 lectures • 8min

Training Objectives7 lectures • 28min

Preparing Our On-Prem VM Machines4 lectures • 24min

Onboarding and Log Validation6 lectures • 32min

Threat Detection with Analytics Rules8 lectures • 57min

Automation and Playbook6 lectures • 23min

Requirements

Description

Who this course is for: