Microsoft Sentinel Hands-on-Training For Beginners

Kick off your Azure Sentinel journey by learning the basics in this beginner hands-on course, with a warm welcome and thanks for your support.

Log into Azure, navigate to resource groups, and create a new resource group named Azure Sentinel Training Lab in Australia East. Review and create to run validation and finalize deployment.

Deploy an Azure Log Analytics workspace to enable Sentinel, using the Azure portal to create a Log Analytics workspace in the Sentinel Training Lab resource group, and validate before deployment.

Learn how to set up Microsoft Sentinel by selecting or creating a workspace, adding it to Microsoft Sentinel, and starting a free trial for hands-on training in the console.

Learn how to install and deploy the Microsoft sentinel training lab solution, configure the training workspace and resource group, and understand deployment times from five to thirty minutes.

Apply Sentinel rbac at the resource group level to assign roles such as reader, responder, and contributor, detailing who can view, manage incidents, edit analytic rules, and configure data connectors.

Learn to use Azure Sentinel data connectors to ingest logs from diverse sources via Content Hub, install and connect the Azure Activity Data Connector, troubleshoot connectivity, and configure diagnostics.

Set up the Microsoft Threat Intelligence connector in Sentinel and link Pulse Dive to ingest threat indicators such as IPs, domains, URLs, and file hashes for real-time threat context.

Explore sentinel analytic rule types, including scheduled, near real-time, fusion, and anomaly rules. See how machine learning behavior analytics and threat intelligence enhance detections.

Create a scheduled query rule in the analytics blade to monitor audit logs for added users, set 5-minute automatic runs, zero threshold, and save.

Create a near real-time rule in Microsoft Sentinel by configuring an NRT query rule, enabling analytics, incident settings, and saving a validated rule for near real-time alerts.

Enable the fusion rule in Microsoft Sentinel by using the fusion template in the analytics blade, then create, review, and save the multi-stage attack detection rule for the lab.

Create ML behavior analytics rules for RDP and SSH in Microsoft Sentinel using templates, enable them, and allow seven days to build a normal activity profile before they kick in.

Create and configure an automation rule in Microsoft Sentinel to trigger on new user additions, set active status, high severity, assign an owner, and tag automated for ongoing incident analytics.

Create and update Azure Sentinel watch lists by importing a CSV of IP addresses and using IOCs in detection rules, with allow lists to reduce alerts.

learn to integrate an IP watchlist into Azure Sentinel by installing a high count by client IP and port rule from Content Hub, editing KQL, and enabling automated responses.

Learn to conduct Azure Sentinel threat hunting with predefined queries, templates, and hunts, perform automation, investigation, and remediation, and escalate findings into incidents for SoC analysis.

Discover how the mighty attack (Miter Attack) in Microsoft Sentinel maps threats, investigates attack paths, and uses analytics and rules to detect and defend against intrusions.

Enable UEBA in Azure Sentinel, link Entra ID, and build baseline profiles to detect unusual user and entity behavior; create and promote custom anomaly rules into production.

Explore basic KQL queries in Azure Sentinel logs to pull security incidents from the last 48 hours, then summarize by classification and render as bar or pie charts.

Learn how to delete a Microsoft Sentinel workspace in this beginners hands-on training module efficiently.

Complete the basic Azure Sentinel training to gain a foundational understanding and build on your new knowledge for future courses.