Microsoft Sentinel Hands-on-Training For Beginners

Kick off your Azure Sentinel journey by learning the basics in this beginner hands-on course, with a warm welcome and thanks for your support.

Log into Azure, navigate to resource groups, and create a new resource group named Azure Sentinel Training Lab in Australia East. Review and create to run validation and finalize deployment.

Deploy an Azure Log Analytics workspace to enable Sentinel, using the Azure portal to create a Log Analytics workspace in the Sentinel Training Lab resource group, and validate before deployment.

Learn how to install and deploy the Microsoft sentinel training lab solution, configure the training workspace and resource group, and understand deployment times from five to thirty minutes.

Apply Sentinel rbac at the resource group level to assign roles such as reader, responder, and contributor, detailing who can view, manage incidents, edit analytic rules, and configure data connectors.

Learn to use Azure Sentinel data connectors to ingest logs from diverse sources via Content Hub, install and connect the Azure Activity Data Connector, troubleshoot connectivity, and configure diagnostics.

Set up the Microsoft Threat Intelligence connector in Sentinel and link Pulse Dive to ingest threat indicators such as IPs, domains, URLs, and file hashes for real-time threat context.

Explore sentinel analytic rule types, including scheduled, near real-time, fusion, and anomaly rules. See how machine learning behavior analytics and threat intelligence enhance detections.

Create a near real-time rule in Microsoft Sentinel by configuring an NRT query rule, enabling analytics, incident settings, and saving a validated rule for near real-time alerts.

Enable the fusion rule in Microsoft Sentinel by using the fusion template in the analytics blade, then create, review, and save the multi-stage attack detection rule for the lab.

Create ML behavior analytics rules for RDP and SSH in Microsoft Sentinel using templates, enable them, and allow seven days to build a normal activity profile before they kick in.

Learn to conduct Azure Sentinel threat hunting with predefined queries, templates, and hunts, perform automation, investigation, and remediation, and escalate findings into incidents for SoC analysis.

Enable UEBA in Azure Sentinel, link Entra ID, and build baseline profiles to detect unusual user and entity behavior; create and promote custom anomaly rules into production.

Learn how to delete a Microsoft Sentinel workspace in this beginners hands-on training module efficiently.