Microsoft Sentinel

Explore how growing complexity across people, cloud, endpoints, IoT, and networks drives tougher cyber security, and examine challenges like talent gaps, automation gaps, data deluge, disjoint tools, and noisy alerts.

Explore the core functions of a security operations center, including threat intelligence, indicators of compromise, threat hunting, log management, threat detection, and incident response to reduce the attack surface.

Explain the three-tier soc model, where automation handles routine tasks; tier one tackles commodity malware, tier two tackles advanced threats, and tier three performs proactive threat hunting and forensics.

The incident response process, based on the NIST guide, begins with preparation, then detection and analysis, containment and eradication, recovery, and finally post-incident activity to apply lessons learned.

Explore EDR, XDR, SIEM, and SOAR and how Microsoft Defender and Sentinel deliver behavior-based protection and centralized log correlation. Automate incident response with Logic Apps to streamline SoC operations.

Purple teaming merges blue and red team efforts to enhance security posture, combining security monitoring and incident response with vulnerability assessments, penetration testing, social engineering, and adversary TTP simulations.

Define cyber threats per NIST as events that can harm operations, assets, or individuals through an information system, including unauthorized access, destruction, or denial of service.

Explore the distinctions between intelligence, threat intelligence, and cyber threat intelligence, clarifying how cyber threat intelligence focuses on adversaries and their tactics, techniques and procedures in cyber security.

Define cyber threat intelligence as knowledge about adversaries' motivations, intentions, and methods gathered to enhance enterprise defenses. Emphasize tactics, techniques, and procedures to understand threat actor behavior and strengthen soc.

Define threats, vulnerabilities, and risks in cybersecurity and explain how threat actors exploit vulnerabilities, causing downtime, confidentiality breaches, or data integrity loss, with risk combining impact and likelihood.

Align threat informed defense with your mission by identifying which threat actors target your industry, their motivations, and the tactics, techniques, and procedures they use to tailor detection and protection.

Explore tactics, techniques and procedures (TTPs) in cyber threat intelligence, distinguishing high-level adversary objectives from concrete techniques and detailed procedures, including reconnaissance, scanning, and vulnerability scanning.

Compare IOCs and IOAs, clarifying evidence of compromise versus attacker intent and behavior, with examples as file hashes and domains, and show how CIM, EDR, and XDR enable threat defense.

The pyramid of pain ranks attackers' effort to change indicators from hashes, IPs, and domains up to tools and TTPs, guiding defenders to focus on detecting TTPs.

Explore cti sources across enterprise paid tools, open-source osint, and social media, highlighting examples like Microsoft Defender Threat Intelligence, CrowdStrike, VirusTotal, Shodan, and Twitter insights for threat actors.

Discover how five cloud properties—on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service—drive fast deployment, scalable resources, and transparent billing.

Define public, private, multi, and hybrid cloud with Azure, AWS, and GCP as examples. Show how enterprises blend these offerings across data centers and public clouds.

Explore the Azure global backbone, detailing data centers, regions, fiber and subsea cables, edge sites, and peering connections to ensure performance, fault tolerance, and disaster recovery.

Explore the shared responsibility model across on premises, iaas, paas, and saas in Azure and other clouds, showing how responsibilities shift from customer to provider.

Explore the Azure resource hierarchy, from management groups and subscriptions to resource groups, and learn how resources like virtual machines and storage are grouped by lifecycle for governance and billing.

Explore Azure subscription types: free credits for 30 days, 12-month service freebies, and student credits for 12 months with no credit card, plus pay-as-you-go and enterprise agreement models.

Understand how Entra ID tenants act as identity providers for user identities that access Azure resources in subscriptions and resource groups. Avoid treating subscriptions or resource groups as tenants.

Create your free Azure subscription by entering personal details and choosing between free or pay as you go options, then log in to portal.azure.com to start building in Azure.

Explore zero trust as a security strategy and mindset, emphasizing explicit verification, just-in-time and just-enough access, and assume breach to limit blast radius and protect data.

Explore the Microsoft Security Cosmos with a focus on cloud security and CTI, using Defender XDR across identity, endpoints, apps, email, and cloud, plus copilot for security.

Map a classic attack kill chain from phishing to data exfiltration and show how Defender for Office, Endpoint, Identity, Cloud Apps, XDR, Sentinel, and Copilot defend each stage.

Microsoft Sentinel is a cloud native sim and pay-as-you-go Azure service that runs exclusively in Azure, ingests data from many sources, and enables threat detection, investigation, and response.

Learn how Microsoft Sentinel operates as a software as a service on Azure, with Microsoft handling infrastructure, OS, and patches, while you focus on data ingestion, devices, and identities.

Ingest logs from Azure, AWS, GCP, Alibaba, and on premises into Log Analytics via connectors; use Sentinel for incidents, analytics rules, notebooks, hunting, and playbooks, with Microsoft threat intel included.

Create your Azure tenant by signing up for an Azure account via Start Free to receive $200 Azure credit, then follow the course sections to explore Sentinel demos.

Identify the deployment prerequisites for Microsoft Sentinel by confirming an active Azure tenant and subscription, understanding resource groups, and provisioning a log analytics workspace as the Sentinel backbone.

Create an Azure resource group by selecting a subscription, naming the group, choosing a region, and completing validation to provision the resource group and view its attributes.

Create and deploy a log analytics workspace within a new resource group to support Microsoft Sentinel deployment. Provide subscription, select east region, validate, and complete setup to enable Sentinel deployment.

Create a Sentinel workspace by adding it to an existing log analytics workspace, deploy it, and start a free first-month trial with up to ten gigabytes per day.

Deploy sentinel and understand Azure rbac to assign built in roles such as contributor and responder to users, resource groups, subscriptions, and enforce least privilege.

Explore Sentinel RBAC roles—reader, Sentinel responder, central contributor, playbook operator, and Logic App contributor—covering view data and incidents, rule creation, data connectors, and incident management.

Demonstrates how to assign Azure RBAC roles for Sentinel by creating a role assignment in a resource group's access control, selecting Central Contributor, and adding a user or service principal.

Learn how log analytics acts as the backbone for Microsoft Sentinel and Azure monitoring, enabling data ingestion and KQL querying in a log analytics workspace.

Explore the log analytics dedicated cluster, a premium option with a customer log box, double encryption, and availability zones, while noting a 500 gb per day ingestion minimum to switch.

Explore how to view a log analytics workspace in Microsoft Sentinel, inspect resource metadata, and run pre-provisioned queries on ingested tables such as the threat intelligence indicator.

Deploy Sentinel in the Azure ecosystem, use log analytics as the data backbone, and onboard data via connectors—pre-built options for Entra, M365 Defender, Defender for Cloud, or custom connectors.

Explore typical siem data sources across application, network, operating system, and cloud control planes, including SAP access logs, ServiceNow, Azure Firewall, Windows events, and Defender for Cloud.

Explore the content hub in Microsoft Sentinel, where data connectors are integrated into solutions with analytics rules, hunting queries, and workbooks.

Install a threat intelligence solution in Sentinel, configure the taxi connector for Pulse Dive, and ingest IOCs with hourly polling using an API key.

Verify threat intelligence log ingestion by validating logs via data connectors, viewing threat intelligence indicators in the query editor, and confirming events such as a high-risk domain like notionformula.ru.

Install the Entra ID (Azure Active Directory) connector in the content hub, enable audit logs in Sentinel, and ensure workspace permissions or assign the Microsoft Sentinel contributor role.

Verify that the Entra ID data connector ingested audit log events, then confirm in log analytics by running audit logs and inspecting the new user event under target resources.

Ingest security event logs from VMs across two subscriptions into Sentinel using the Azure Monitor agent and data collection rules, while routing observability logs to a log analytics workspace.

Provision a Windows virtual machine and install the Windows Security Events solution in Sentinel, configure an Azure Monitor Agent Connector (AMA) data collection rule, and verify logs in Log Analytics.

Set up a sentinel workspace, ingest data with a data connector, and develop analytic rules to produce alerts and incidents through correlation, while using automation to respond.

Create detections in Microsoft Sentinel using analytic rules written in KQL, with 500+ templates and a 512-rule per workspace limit across types like scheduled and near real time.

View analytic rules in the Microsoft Sentinel console, noting zero active rules, and explore rule templates from content hub for entra and threat intelligence, with data sources and rule details.

Explore scheduled rules in Microsoft Sentinel: analytic rules that run every hour with a lookback period within five minutes to fourteen days, and why they are the default rule type.

Create a scheduled analytic rule in Microsoft Sentinel to detect new user additions by querying audit logs for add user, with a five-minute schedule and zero threshold, enabling incidents.

Create a scheduled analytic rule in Microsoft Sentinel to detect new process creation from Windows Security Event Logs, running every five minutes and grouping alerts into incidents.

Explore Microsoft Sentinel near real-time rules (NRT) that run every minute for up-to-the-minute threat detections, with a 50-rule per workspace limit and a demo on using scheduled rules.

Create near real time rules in analytics, name the rule, copy the detection logic for the demo, enable grouping and incidents, review and save to view active rules in Sentinel.

Enable the fusion engine, a Microsoft analytic rule that detects advanced multi-stage attacks by correlating over 120 detections and scenarios across Microsoft data sources in Sentinel.

configure a fusion rule in Sentinel by selecting the fusion rule template advanced multi-stage attack detection, choose data sources, adjust inclusion and severity, and enable a single fusion rule.

Learn machine learning behavior analytics in Microsoft Sentinel, which flags unusual activity from rarely seen IPs or locations and new logins for RDP and SSH, after a seven-day baseline.

Enable behavior analytics rules for RDP and SSH in Microsoft Sentinel, build a seven-day baseline of normal activity to detect deviations and activate alerts.

Enable threat intelligence rules to alert on Defender threat intelligence indicators matching your event logs, delivering high-fidelity, early detections. Requires paid Defender threat intelligence; open-source intel does not trigger alerts.

Learn to create a threat intelligence rule in Sentinel using analytics and templates, review and activate it, using Defender threat intelligence IOCs.

Forward alerts from other Microsoft security services to create Sentinel incidents via this analytic rule, such as Defender for Endpoint alerts triggering incidents in Sentinel.

Create a Microsoft Sentinel incident for every Defender for Cloud alert using the Microsoft Incident Creation rule, forwarding any severity alerts with the Defender for Cloud forwarder.

Explore how to inspect the incident queue in Microsoft Sentinel, view open and active incidents, assign severity and ownership, and investigate or automate responses with playbooks and Teams channel collaboration.

Learn how ingestion delay affects Sentinel analytics by examining how delays between log creation and ingestion shift lookback windows, causing missed events, and counter it by increasing the lookup period.

Learn how to check ingestion delay across data sources in Sentinel using the workspace usage report, view latency per table, and understand how delays impact scheduled analytics.