Microsoft Sentinel Mastery: SC-200, KQL, SIEM & Copilot 2026

Build SOC knowledge with NIST and SANS frameworks. Master the three-tier SOC model, detection-investigation-response workflows, and incident management best practices used by enterprise security teams

Understand the Security Operations Center as the nerve center of enterprise defensive security. Learn the SOC's relentless mission: monitor, detect, investigate, and respond to cybersecurity threats 24/7/365 because attackers operate when human analysts sleep. Master the four core SOC functions: monitoring (continuously observing security events), detection (identifying malicious activity), investigation (determining scope and impact), and response (containing, remediating, recovering). Explore SOC team structure including Tier-1 triage analysts, incident responders for escalated cases, threat hunters searching proactively, threat intelligence analysts tracking adversary TTPs, and SOC managers reporting metrics to leadership. Understand why alert fatigue is the biggest SOC challenge: the average SOC receives 11,000+ alerts daily but investigates <33%, meaning genuine threats hide in noise. Learn critical metrics: MTTD (Mean Time to Detect) measuring from threat start to detection, MTTR (Mean Time to Respond) measuring from detection to containment, false positive rate indicating detection quality, and analyst utilization showing whether team has capacity for proactive work. Discover why SOCs fail without proper tooling: manually reviewing alert queues doesn't scale, Tier-1 analysts get overwhelmed, investigations take hours instead of minutes, and incidents spin out of control before response begins.

Master the three-tier SOC architecture that multiplies your security team's effectiveness without proportional headcount increase. Understand Tier Zero as automated SIEM responses: playbooks disabling compromised accounts in seconds, blocking malicious IPs network-wide automatically, quarantining phishing emails across entire organization simultaneously. Learn Tier One as initial human triage: first responders reviewing incidents from the queue, determining whether they're genuine threats or false positives, gathering initial context, escalating confirmed incidents to Tier Two, or closing false alarms. Master Tier Two as deep investigation: senior analysts taking escalated incidents, reconstructing complete attack timelines, determining compromise scope, identifying all affected systems/accounts, executing containment playbooks. Discover Tier Three as expert hunting and strategic defense: most experienced security professionals proactively developing detection hypotheses, writing new KQL hunting queries, reviewing/tuning detection rules, conducting Red Team exercises validating coverage, deciding what new data sources to connect, and closing MITRE ATT&CK coverage gaps. See real-world case studies: commodity malware alert escalation from Tier Zero isolation → Tier One triage identifying malware loader → Tier Two tracing attack chain to phishing email and detecting C2 beaconing, containing in 40 minutes. Learn how this model scales: a 3-person team with good Tier Zero automation can operate with 10-person team effectiveness, because automation handles routine tasks and humans focus on judgment-requiring work.

Master the three pillars of SOC operations operating as continuous improvement cycles rather than linear sequences. Understand detection as the first pillar: signature-based rules matching known malicious indicators, KQL-based scheduled analytics detecting patterns, machine learning anomaly rules catching statistical deviations, Fusion engine correlating weak signals into high-confidence incidents. Learn investigation as the second pillar: reviewing generated incidents, determining if they're real threats, gathering evidence, exploring entity relationships, reconstructing attack timelines. Discover response as the third pillar: containing threats to prevent spread, remediating to remove attacker access, recovering systems to normal operations. See how lessons from each response cycle feed back into improved detection rules for the next incident, creating a continuously improving feedback loop. Master log management strategy: understand what to collect (security-critical data like auth events, endpoint telemetry, firewall logs), what tier to store at (Analytics tier for real-time alerting, Basic tier for hunting-only data, Data Lake for compliance archival), how long to retain (default 30 days free, compliance-driven retention 12 months+). Learn the incident investigation workflow: alert fires → incident created → analyst reviews alert + affected entities + MITRE ATT&CK context → runs related queries → adds bookmarks as evidence → documents findings in notes. Master bookmarks as evidence preservation: saving specific query results during hunting, annotating with investigation observations, linking to existing incidents or creating new ones, preserving evidence trails for formal reporting. Understand post-incident reviews as the improvement mechanism: conducting within 72 hours while details are fresh, analyzing why automated controls didn't prevent/detect faster, identifying specific rule improvements/architecture changes/training gaps to prevent recurrence, ensuring each post-mortem produces at least one concrete improvement to the Sentinel environment.

Master the NIST Incident Response Framework organizing incident response into four phases that become your operational playbook. Understand Phase One: Preparation (everything before incident occurs) including developing policies, training staff, configuring tools like Sentinel, establishing communication protocols. Learn Phase Two: Detection and Analysis (identifying and confirming incidents) including analytics rules firing, analysts triaging alerts, determining incident scope/severity, making escalation decisions. Master Phase Three: Containment, Eradication, Recovery (active response stopping attack) including containment (disabling accounts, isolating devices, blocking IPs), eradication (removing malware, closing attack vectors, revoking persistence), recovery (restoring systems from clean backups, resetting passwords, verifying attack closure). Discover Phase Four: Post-Incident Activity (lessons-learned review and improvements) including understanding why incident happened, analyzing why existing controls didn't prevent/detect faster, identifying concrete rule/playbook/architecture improvements, documenting improvements and training needs. Learn the SANS PICERL alternative model (Preparation, Identification, Containment, Eradication, Lessons Learned) with slightly different phase emphasis particularly isolating Identification as distinct checkpoint. Understand Incident Classification: Critical severity (active breach with significant ongoing damage requiring executive notification and all-hands response), High severity (confirmed threat with potential significant damage requiring escalation and rapid response), Medium severity (suspicious activity requiring investigation), Low severity (informational or minor events requiring routine review). Master incident response playbooks as pre-written step-by-step guides for specific incident types (ransomware response, credential compromise response, phishing response, cloud misconfiguration response) that tell analysts exactly what to do without requiring decision-making under pressure. Learn Tabletop Exercises as the practice mechanism: simulate incident scenarios in discussion format (not live technical response), walk team through playbook execution, identify gaps in procedures/communication/authority, update playbooks based on findings. Understand regulatory/legal dimensions: GDPR requires breach notification to supervisory authority within 72 hours, HIPAA requires notification within 60 days, many US state laws have their own requirements, legal counsel must be involved for significant incidents to ensure evidence preservation and proper notification.

Learn threat intelligence operationalization through ATT&amp;CK, TTPs, and threat actors. Master the Pyramid of Pain, intelligence sources (OSINT, MDTI, STIX/TAXII), and intelligence-driven defense strate

Master the foundational language of threat intelligence essential for every security professional. Understand threats as combinations of three elements: actor (entity that could cause harm), intent (their motivation—financial gain, espionage, disruption, hacktivism), and capability (technical ability to execute attacks). Learn vulnerabilities as weaknesses in systems/processes/controls that could be exploited (technical flaws, procedural gaps, human factors like insufficient training). Discover risk as the intersection of threat, vulnerability, and impact: risk = (likelihood of threat exploiting vulnerability) × (impact if exploitation succeeds). A critical vulnerability in a payment processing system storing sensitive data facing active nation-state attackers = high risk. Same vulnerability in isolated test system facing only script kiddies = low risk. Master Indicators of Compromise (IOCs) as forensic artifacts left by attacks: malicious IPs used for C2, domains for phishing, file hashes of malware, email addresses in spearphishing campaigns. Understand IOCs have short shelf life—attackers rotate infrastructure constantly, making IOC-based detection inherently reactive. Learn Indicators of Attack (IOAs) describing behavioral patterns of attacks in progress: process code injection into legitimate processes, service accounts authenticating from unusual locations, users downloading unusual data volumes. IOAs are harder to detect than IOCs but more powerful—attackers can change IPs and hashes, they can't easily change behavioral patterns. Explore the Pyramid of Pain ranking detection difficulty vs attacker pain: hash values (bottom—easy to detect, trivial to change), IP addresses (slightly harder for attacker to rotate), domain names (still relatively cheap to rotate), network artifacts (more expensive to change), host artifacts (significant attacker investment), tools (very expensive for attackers to replace), TTPs/Tactics/Techniques/Procedures (top—most painful, forces adversary to fundamentally rethink approach). Understand the implication: build your detection strategy around TTPs rather than IOCs because TTP detection survives adversary infrastructure rotation and tool changes. When you detect behavior-based on adversary techniques rather than specific indicators, your detection capability outlasts their infrastructure changes by months or years.

Understand that not all attackers are created equal—different actors have different capabilities, motivations, and methods requiring different defensive strategies. Master nation-state actors as government-sponsored hacking teams with objectives aligned to national interests: targeting government agencies, defense contractors, critical infrastructure, technology companies with valuable IP. Learn they have significant resources, sophisticated tools, long operational timelines (willing to spend months establishing persistence before acting), and use weather-themed naming (Midnight Blizzard = Russian SVR-linked group, Volt Typhoon = Chinese state-sponsored group focusing on critical infrastructure, Salt Typhoon = targeting telecommunications). Understand cybercriminal groups as financially motivated: running ransomware-as-service platforms letting affiliates deploy enterprise-grade attacks, operating like businesses with developers/operators/negotiators, targeting organizations that can pay significant ransoms and have valuable data to exfiltrate and insufficient security. Discover hacktivists as ideology-motivated: launching DDoS attacks targeting websites/services, executing website defacements, leaking documents they believe expose wrongdoing, typically less sophisticated than nation-state/criminal groups but unpredictably targeting based on current events. Learn insider threats as the most difficult to detect: malicious insiders intentionally abusing access for personal gain/revenge/espionage, negligent insiders causing unintended damage through poor security hygiene, compromised insiders whose credentials were stolen by external attackers operating using legitimate identity. Understand script kiddies and opportunistic attackers using freely available exploit tools, scanning internet for known vulnerabilities, exploiting whatever they find regardless of target relevance—high volume, low sophistication. Master threat actor attribution: determining which specific actor is behind an attack is both valuable (review their known TTPs, identify other environment presence, apply specific mitigations) and difficult (sophisticated actors use false flags, shared infrastructure, tools from other groups to obscure identity). Threat actor initial access vectors: phishing remains #1 across all actor categories, exploitation of public-facing applications (particularly web apps and VPN gateways), valid accounts via compromised credentials or credential stuffing, supply chain compromise through third-party software updates. Understand persistence mechanisms attackers establish after initial access: creating new admin accounts, adding malicious scheduled tasks, modifying registry run keys, installing web shells, using WMI subscriptions, establishing SSH backdoors. Learn lateral movement techniques: pass-the-hash using stolen credential hashes, pass-the-ticket using Kerberos tickets, remote service exploitation via RDP or PsExec, credential theft and reuse. Discover exfiltration and impact: data exfiltration often preceded by staging (collecting data from multiple systems, consolidating for movement), exfiltration typically over allowed protocols like HTTPS to blend with legitimate traffic, impact techniques including ransomware encryption, destructive malware, denial of service, defacement.

Master Tactics, Techniques, and Procedures (TTPs) as the operational translation layer between threat intelligence and detection engineering. Understand tactics as high-level adversary objectives at each attack stage (MITRE ATT&CK identifies fourteen tactics: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact). Learn tactics answer "what is the attacker trying to accomplish at this stage?" Discover techniques as specific methods achieving each tactic: under Credential Access tactic, techniques include OS Credential Dumping, Brute Force, Password Spraying, Kerberoasting, each producing detectable evidence in logs. Master sub-techniques as granular implementations: Brute Force has sub-techniques including Password Guessing, Password Spraying, Credential Stuffing, Password Cracking, each producing different log patterns requiring different detection rules. Understand procedures as group-specific implementations: the Wizard Spider threat group's specific procedure for using Cobalt Strike's named pipe technique differs from another group's approach, enabling highly targeted detection. Learn how to map Sentinel analytics rules to ATT&CK: every rule you create should be tagged with the tactic and technique it detects (enables incident enrichment showing analysts the technique immediately, powers the coverage matrix visualization showing which techniques have detection coverage and which are gaps). Master the ATT&CK coverage map in Sentinel: green cells indicate active detection rules covering the technique, orange cells indicate available Content Hub rules you haven't deployed, empty cells represent detection gaps where attackers could operate undetected. Use Purple Team exercises validating coverage: Red Team executes specific ATT&CK technique, Blue Team validates Sentinel detects it, when detection misses reveal gaps requiring rule fixes/new data sources/adjusted thresholds. Understand detection engineering as continuous process: ATT&CK framework updates regularly as new techniques documented, threat actors evolve TTPs over time, your environment changes as new systems added/old systems retired, effective detection engineering means regularly reviewing coverage gaps and closing them. Common TTP patterns appearing repeatedly in real investigations: Credential Access → Lateral Movement → Data Collection (classic data theft), phishing → PowerShell dropper execution → scheduled task persistence (classic ransomware setup), LDAP enumeration → Kerberoasting → privilege escalation → persistence (classic Active Directory attack).

Master threat intelligence source landscape from free open-source options through Microsoft's proprietary global threat intelligence. Explore Open Source Intelligence (OSINT) platforms: VirusTotal analyzing files/URLs against antivirus engines providing verdicts and behavior, AlienVault OTX (Open Threat Exchange) community-driven platform with millions of IOCs, AbuseIPDB tracking IP addresses for scanning/brute force/malicious activity, Shodan search engine for internet-connected devices revealing exposed infrastructure. Learn Microsoft Defender Threat Intelligence (MDTI) built on analyzing 65+ trillion security signals daily across Microsoft's global network: threat actor profiles, vulnerability intelligence, infrastructure intelligence (IP reputation, domain categorization), threat article analysis documenting specific campaigns. Understand free MDTI tier provides basic intelligence access, premium tier integrates directly with Sentinel providing full corpus. Explore commercial threat intelligence market: Recorded Future providing deep actor/ransomware/dark web intelligence, CrowdStrike Falcon Intelligence with actor-attributed intelligence, Mandiant Threat Intelligence from global incident response practice, ISAC (Information Sharing and Analysis Center) memberships providing industry-specific intelligence. Master STIX (Structured Threat Information eXpression) as standard data format representing threat intelligence objects: indicators (IPs, domains, hashes, URLs), threat actors, campaigns, malware families, vulnerabilities, courses of action, and relationships between them. Understand TAXII (Trusted Automated eXchange of Indicator Information) as transport protocol carrying STIX between systems: TAXII servers host collections that clients subscribe to and poll for updates. Learn Sentinel's TAXII data connector allowing you to specify any TAXII server URL and collection ID for automatic intelligence ingestion. Understand bi-directional STIX/TAXII in 2025: you can not only consume intelligence from external sources but export Sentinel indicators back to threat sharing platforms, enabling collaborative intelligence sharing and community defense. Master connecting threat intelligence to Sentinel: ThreatIntelligenceIndicator table stores imported indicators, Sentinel automatically correlates log data against active indicators generating TI Map alerts, you can write custom analytics rules joining indicators against your log tables for sophisticated correlation. Understand intelligence quality dimensions: accuracy (false positive rate of indicators), timeliness (how quickly new indicators added after activation), relevance (applicability to your industry/geography), context (how much supporting information accompanies each indicator). Build intelligence-driven detection program: threat intelligence identifies specific adversary group actively targeting your industry using specific TTPs, detection engineers map those TTPs to available data sources, write KQL analytics rules detecting behaviors, deploy rules to production, use hunting dashboard validating rules work against historical data, add rules to coverage map. Operate within threat intelligence lifecycle: requirements (define what intelligence you need), collection (gather raw data from sources), processing (normalize and format for analysis), analysis (interpret and produce actionable intelligence), dissemination (share with decision-makers), feedback (evaluate usefulness and refine process).

Master Azure infrastructure, shared responsibility models, and Microsoft Entra ID. Learn cloud security posture management, RBAC, conditional access, and Zero Trust foundations for Sentinel.

Understand the three cloud service models and how they affect security responsibility and Sentinel deployment. Master Infrastructure as a Service (IaaS) where you manage OS/applications/data but Microsoft manages infrastructure: Azure Virtual Machines, Azure Storage. Learn Platform as a Service (PaaS) where you develop applications without managing infrastructure: Azure App Service, Azure SQL Database. Discover Software as a Service (SaaS) where Microsoft delivers complete applications: Microsoft 365, Salesforce, ServiceNow. Understand the shared responsibility model: Microsoft responsible for infrastructure security increases from IaaS → PaaS → SaaS, your responsibility for security increases from SaaS → PaaS → IaaS. Explore Azure's global infrastructure: 60+ regions (geographic areas), availability zones (physically separate data centers within single region with independent power/cooling/networking), multiple compliance boundaries supporting data residency requirements. Learn how infrastructure decisions affect Sentinel: workspace region choice impacts data residency, latency for ingestion, feature availability. Master Azure subscription/resource group hierarchy: Entra ID tenant (identity directory) contains management groups and subscriptions, subscriptions are billing/access boundaries, resource groups are logical containers for related resources. Understand when deploying Sentinel: create dedicated resource group for Sentinel resources (Log Analytics Workspace, Logic App playbooks, automation accounts, Key Vault), apply RBAC at resource group level segregating Sentinel access from other Azure resources. Master Azure Monitor as core monitoring platform Sentinel is built on: ingests telemetry from Azure resources, VMs, applications, connected external systems, Log Analytics Workspace stores data Sentinel queries, Azure Monitor Agent collects logs from servers forwarding to workspace. Learn Azure Logic Apps as automation engine powering Sentinel playbooks: visual workflow builder connecting triggers/actions across hundreds of services, when Sentinel automation rules trigger a playbook they're launching a Logic App workflow. Understand Azure Role-Based Access Control (RBAC) for Sentinel: Microsoft Sentinel Reader (view-only), Responder (incident management without configuration changes), Contributor (full configuration access), Automation Contributor (playbook permissions). Master least-privilege principle: assign Responder role to most SOC analysts, Contributor to detection engineers only, read access to auditors. Learn Azure Key Vault as secure secrets management: never store API keys/credentials in playbooks, use Managed Identity for Logic App authentication eliminating credential storage, retrieve secrets from Key Vault at runtime via managed identity. Understand cost implications: IaaS VM + agent logging is cheapest ingestion, PaaS integrations via API are moderate cost, SaaS connectors vary by service, costs scale with data volume so storage tier selection (Analytics vs Basic vs Data Lake) directly impacts monthly bills.

Master the shared responsibility model showing exactly where Microsoft's security responsibility ends and yours begins. Understand in IaaS you own the OS upward: you're responsible for patching operating systems, configuring firewalls, hardening applications, protecting data stored on instances. Unpatched VM vulnerability in Azure = your responsibility, not Microsoft's. Learn in SaaS your responsibility narrows to identity/data/configuration: Microsoft manages Salesforce platform security, you manage who has access (identities), what data they access (data governance), how platform is configured (security settings). Understand misconfiguration as the leading cause of cloud breaches: publicly exposed storage accounts, overly permissive IAM policies, unencrypted data at rest, disabled audit logging, unrestricted outbound network access. Learn organizations move to cloud faster than they establish security hygiene, creating window of vulnerability where misconfigurations exist undetected. Master Microsoft Defender for Cloud as Cloud Security Posture Management (CSPM) solution: continuously assesses Azure environment against security best practices, Secure Score provides percentage metric indicating how well configured environment is, every recommendation includes resource identification and remediation guidance. Understand beyond posture assessment Defender for Cloud offers workload protection: Defender for Servers (EDR for Azure VMs and Arc-connected on-premises), Defender for Containers (Kubernetes protection), Defender for SQL (database attack detection), Defender for Storage (storage account anomaly detection). Learn how Defender for Cloud integrates with Sentinel: security recommendations and alerts flow into your incident queue through native connector, security findings become queryable data for correlation with other signals. Master Zero Trust principles in cloud context: verify explicitly through Conditional Access policies requiring MFA and compliant devices, use least privileged access through regular RBAC reviews, assume breach through comprehensive monitoring and logging. Understand identity as new security perimeter: if attacker compromises privileged Azure identity they access any resource that identity permits regardless of network location, identity security becomes highest-priority cloud investment. Master data security through encryption at rest/in transit and classification: understand data classification using Microsoft Purview enabling discovery/classification/protection policies across Microsoft ecosystem. Learn network security providing defense-in-depth: Network Security Groups control subnet/VM traffic, Azure Firewall provides managed stateful inspection, Private Endpoints allow services to be accessed over private networks rather than public internet, DDoS Protection defends against volumetric attacks. Understand compliance frameworks built-in to Defender for Cloud: ISO 27001, SOC 2, PCI DSS, HIPAA, CIS Azure Foundations Benchmark all have dashboard support showing compliance progress against each framework with detailed breakdowns by control area.

Master Microsoft Entra ID (formerly Azure Active Directory) as the identity foundation upon which Sentinel and entire Microsoft security ecosystem operates. Understand Entra ID is not just authentication service but comprehensive identity and access management platform: manages cloud identities for users/service accounts/applications, handles authentication via OAuth 2.0 and OpenID Connect, enforces authorization through Conditional Access and RBAC, provides Identity Protection using machine learning detecting risky sign-ins and compromised accounts. Learn Entra ID is critical Sentinel data source: sign-in logs capture every authentication event (user identity, source IP, geographic location, device information, authentication method, success/failure), audit logs capture all administrative changes (user creation/deletion, group membership changes, role assignments, app consent grants). Master tenant concept: Entra ID tenant is organizational boundary containing all identities and configurations for single organization, when you create Azure account a tenant is automatically created, tenant can contain multiple Azure subscriptions (each subscription belongs to exactly one tenant). Learn subscription/tenant relationship: you can have one tenant managing multiple subscriptions (typical for large enterprises), subscriptions are billing and access control boundaries, Sentinel workspace lives in specific subscription and resource group within tenant's hierarchy. Understand Conditional Access as policy engine making access decisions based on signals: user identity and group membership, device compliance status, network location, application being accessed, sign-in risk score from Identity Protection. Master Conditional Access policies: require MFA for any user accessing Sentinel from outside corporate network, block access entirely from geographic regions where organization has no business presence, require compliant device for access to Defender Portal. Learn Privileged Identity Management (PIM) as just-in-time privileged access: instead of permanently assigning high-privilege roles to users, PIM allows users to request temporary elevation for specific duration, request can require MFA and manager approval, elevated privileges automatically revoke after time period expires. Understand four Sentinel RBAC roles: Responder (manage incidents, run playbooks, but not configuration), Contributor (configure analytics rules and data connectors), Reader (read-only access), Automation Contributor (playbooks taking automated actions). Master implementing least-privilege: most daily SOC analysts get Responder role, detection engineers get Contributor, read-only access for auditors, Automation Contributor for managed identities used by playbooks. Learn service principals as application identities in Entra ID representing specific applications/automation processes rather than human user, Managed Identities as special service principals whose credentials managed automatically by Azure eliminating need to store/rotate credentials manually. Understand multi-tenant scenarios: MSSPs manage Sentinel across customer tenants, enterprises with subsidiaries manage Sentinel across subsidiary tenants, Azure Lighthouse enables cross-tenant delegation allowing managing tenant to operate resources in customer tenant without those resources leaving customer's control. Master Entra ID Identity Protection using machine learning: sign-in risk reflects probability specific sign-in wasn't performed by legitimate user based on unfamiliar location/anonymous IP/password spray characteristics/impossible travel, user risk reflects probability account is compromised based on accumulated risk signals including leaked credentials/malware-linked IPs/suspicious inbox rules. Learn audit logging captures administrative changes: user account creation/deletion, password resets, group membership changes, application registration, conditional access policy changes, role assignments—all available in Sentinel for investigation and compliance.

Master Sentinel's modern architecture: Defender Portal, Data Lake, Sentinel Graph. Plan Log Analytics workspaces, optimize pricing and retention, deploy production-ready Sentinel environments.

Master Sentinel's modern architecture built on three interconnected layers that define how the platform operates at enterprise scale. Understand the Log Analytics Workspace as data core: stores all ingested security telemetry (authentication logs, endpoint events, network traffic, cloud activity), uses Kusto engine (same as Azure Data Explorer) for storage/querying, every analytics rule/hunting query/workbook/UEBA computation runs against workspace data. Learn the Microsoft Defender Portal at security.microsoft.com as operational home for all security operations: replaces standalone Sentinel blade in Azure portal as recommended management interface, combines Sentinel SIEM capability with Defender XDR's endpoint/identity/email/cloud app protection into unified interface, single incident queue aggregates signals from all sources, Advanced Hunting provides unified query interface. Master the Sentinel Data Lake (introduced 2025) as architectural addition solving long-term storage economics: traditional Log Analytics storage optimized for fast querying carries cost making 12-36 month retention expensive, Data Lake provides lower-cost tier still queryable via KQL still integrating with AI workflows/Security Copilot, enables retroactive threat hunting across years of data without paying Analytics tier pricing for every gigabyte. Understand Sentinel Graph as connected security intelligence layer linking users/devices/alerts/behaviors/incidents: illuminates attack paths invisible when looking at individual alerts, maps relationships between entities enabling you to ask "what other systems has this compromised user accessed" or "which other users authenticated from this malicious IP address" automatically. Learn Analytics Rules as detection engine: scheduled rules run KQL on defined intervals, near real-time rules provide sub-one-minute detection for critical scenarios, Microsoft Security rules automatically create Sentinel incidents from Defender product alerts, machine learning anomaly rules detect statistical deviations from baselines, Fusion rules correlate low-fidelity signals into high-confidence multi-stage attacks. Master Playbooks as SOAR layer built on Azure Logic Apps: triggered by automation rules when incident conditions met, can disable accounts/block IPs/send Teams messages/open ServiceNow tickets/query threat intelligence/collect forensic evidence, each action requires appropriate permissions via Managed Identity. Understand UEBA as continuous behavioral baseline monitoring: models normal behavior for every user/entity across all data sources, scores deviations from baseline as anomalies with investigation priority score, Behaviors Layer (GA 2025) synthesizes raw events into human-readable summaries mapped to MITRE ATT&CK techniques. Learn Workbooks as visual intelligence for SOC: interactive dashboards built on Azure Monitor Workbooks, use KQL queries powered by security data, include metric tiles/charts/grids/maps for visualizing patterns, support parameters for dynamic filtering by time range/user/severity. Discover Content Hub as detection engineering library: 200+ solutions from Microsoft/community containing data connectors/analytics rules/workbooks/playbooks/hunting queries for specific vendors/use cases/frameworks, installing solution deploys complete integrated set enabling rapid coverage deployment without building from scratch.

Master workspace planning as critical foundation preventing expensive rework later. Understand workspace region selection impacts data residency, ingestion latency from sources, feature availability—choose region geographically close to your data sources while meeting residency requirements. Learn Sentinel pricing has two components: Log Analytics data ingestion charged per gigabyte (varies by region, approximately $2-3/GB in US), Sentinel surcharge on top of Log Analytics for analytics/UEBA/automation capabilities. Master pricing tiers: pay-as-you-go charges per gigabyte with no commitment (appropriate for variable workloads), capacity reservation (100-1000 GB/day) offers 25-65% discount for predictable volumes (production environments almost always save money with commitment). Understand log tiers: Analytics tier for security-critical data like authentication/endpoint telemetry/firewall logs (real-time queryable, runs analytics rules), Basic Logs tier (~1/8 Analytics cost) for high-volume lower-priority data like verbose app logs (queryable but slower, no analytics rules), Auxiliary Logs/Data Lake for compliance archival (queryable via async search jobs, lowest cost). Learn retention strategy: default 30 days free, additional retention up to 2 years charged per-GB-month, beyond 2 years data archives to Azure Storage or Data Lake. Understand data retention requirements vary by compliance framework: PCI DSS requires 12 months, government frameworks often require 3+ years, understanding requirements before deployment prevents later gaps. Master resource group design: create dedicated resource group for Sentinel resources (Log Analytics Workspace, Logic Apps, automation accounts, Key Vault) enabling RBAC at group level segregating Sentinel access. Learn naming conventions: use descriptive names like "law-sentinel-prod" or "sentinel-workspace-eastus", follow organizational standards for consistency enabling easy resource discovery. Understand pre-deployment permission requirements: Contributor role at subscription level to create resource groups/workspaces/Logic Apps, Log Analytics Contributor on workspace to enable Sentinel, User Access Administrator at resource group level to grant RBAC roles. Master data connector planning: connect in priority order (security-critical sources first), start with Microsoft first-party (Entra ID, Azure Activity, M365 Defender, Defender for Cloud), validate each connector works before adding next, connecting too many simultaneously creates noise management challenges. Learn networking considerations: most cloud connectors use public HTTPS (sufficient for most), high-security environments may require Private Link for workspace access over private networks, on-premises sources typically need log forwarder VM with agent forwarding logs to workspace. Build pre-deployment checklist: confirm Azure free account active, note tenant ID, decide deployment region, plan resource group name, confirm contributor access, confirm Entra ID diagnostic settings permissions available, bookmark Sentinel documentation.

Deploy your first production-ready Sentinel environment step-by-step in your free Azure account. Create resource group named "SentinelRG", create Log Analytics Workspace named "SentinelWorkspace" in chosen region, enable Microsoft Sentinel on workspace (takes 2-3 minutes). Access Sentinel in Defender Portal at security.microsoft.com (replaces standalone Azure portal Sentinel blade), navigate to Overview showing current incidents/data volume/rule counts/coverage statistics. Install Microsoft Sentinel Training Lab solution from Content Hub providing pre-populated sample data/analytics rules/workbooks/incidents for safe practice before live data arrives. Configure Entra ID diagnostic settings: navigate to Microsoft Entra ID → Diagnostic settings → add new setting named "SentinelEntraLogs", select AuditLogs/SignInLogs/NonInteractiveUserSignInLogs/ServicePrincipalSignInLogs, send to Log Analytics workspace, data flows within 15-30 minutes. Connect Microsoft Entra ID data connector: navigate to Data connectors → search Entra ID → configure to ingest all three log types. Verify ingestion by running KQL query: SigninLogs | take 10, confirms Entra ID authentication telemetry flowing. Set workspace retention to 90 days (free tier sufficient for lab), enable Sentinel Health monitoring providing alerts if connectors stop ingesting. Document everything: note workspace ID, tenant ID, verify all services connected, confirm you can see sample data in Logs blade. This lab establishes foundation for all subsequent labs—everything builds on this baseline Sentinel environment that you'll use to practice detection rules, playbooks, investigations, and advanced operations.

Connect 300+ data sources to Sentinel: Microsoft and third-party connectors. Master Azure Monitor Agent, Data Collection Rules, ASIM normalization, cost optimization strategies.

Master the complete landscape of Sentinel's 300+ data connectors covering Microsoft products, third-party vendors, cloud platforms, and custom integrations. Explore Microsoft first-party connectors delivering highest value in Microsoft-centric environments: Microsoft Entra ID (sign-in/audit/identity protection), Microsoft 365 Defender (unified Endpoint/Office/Identity/Cloud Apps alerts), Microsoft Defender for Cloud (CSPM and workload protection alerts), Azure Activity (all Azure management plane operations), Office 365 (Exchange/SharePoint/Teams audit logs). Understand Microsoft 365 Copilot connector (new 2025) providing visibility into AI assistant usage: detect Copilot misuse, monitor sensitive data exposure via prompts, track anomalous usage patterns suggesting compromised accounts. Master third-party connectors extending coverage beyond Microsoft: Palo Alto Networks firewalls, Cisco ASA/Meraki, Fortinet FortiGate, Check Point security products, AWS CloudTrail, Google Cloud Platform audit logs. Learn connector types: agent-based collection via Azure Monitor Agent or dedicated log forwarder, API-based ingestion polling source systems at intervals, push mechanisms where source sends data directly to Sentinel endpoint. Discover Codeless Connector Framework (CCF) for proprietary/niche sources: CCF Push (introduced 2025) eliminates manual infrastructure provisioning—describe connection in JSON config file, deploy, Sentinel provisions all necessary resources automatically. Master Azure Monitor Agent (AMA) as standard Windows/Linux collection mechanism: replaced legacy Log Analytics Agent in 2024, collects Windows Event Logs/Performance Counters/Linux Syslog/custom text logs, deployed via Azure Policy for at-scale coverage. Learn CEF and Syslog forwarders for network devices: firewall/IDS/NAC devices unable to install agents send logs to Linux forwarder VM via Syslog, forwarder runs AMA forwarding normalized logs to Sentinel. Understand Agentless SAP connector (GA 2025) for enterprise applications: SAP contains sensitive financial/HR/procurement/supply chain data, connector ingests SAP activity/security logs enabling SAP-specific attack detection. Discover Google Kubernetes Engine connector (GA 2026) bringing GKE cluster activity into Sentinel: organizations running containerized workloads in GKE can correlate GKE events with identity/endpoint signals in single investigation. Master Health and Troubleshooting: connectors that stop sending data create blind spots, use SentinelHealth table monitoring connector status, build analytics rule firing if critical source missing data >2 hours. Learn ASIM (Advanced Security Information Model) normalization: different sources represent same events differently, ASIM provides common schema so single analytics rule works across multiple data sources (Windows Security events, firewall logs, network telemetry all normalized to NetworkSession table enabling unified detection).

Transition your Sentinel environment from initial deployment to live security monitoring. Connect Azure Activity logs using Azure Policy assignment wizard: policy auto-configures diagnostic settings across all resources, logs begin flowing within 15-30 minutes, validate with query: AzureActivity | take 10. Connect Microsoft 365 Defender connector aggregating Endpoint/Identity/Office/Cloud Apps alerts: unified feed brings all Defender product signals into single queue, verify with query: SecurityAlert | where TimeGenerated > ago(1d). Validate Entra ID sign-in log quality by projecting key fields: verify UserPrincipalName contains real accounts, IPAddress shows actual IPs, Location shows city/country, ResultType shows success/failure codes. Understand validation goes beyond confirming data arrives—verify schema field population, check for unexpected null/empty patterns, confirm data freshness (recent timestamps not days old). Run Usage table analysis: Usage | where TimeGenerated > ago(7d) | summarise TotalGB = sum(Quantity)/1000 by DataType | sort by TotalGB desc shows ingestion volume by table, identifies which connectors are most active. Connect Office 365 connector bringing Exchange/SharePoint/Teams audit logs: enables phishing email detection, suspicious file access, Teams meeting recording misuse detection. Write cross-source correlation query demonstrating Sentinel's power: find users with >5 failed logins in 24 hours, then show their Azure management activity detecting if compromised credentials used for infrastructure attacks. Build connector health dashboard query: Setup monitoring alerts firing if any critical connector stops ingesting, prevents silent blind spots. By end of this lab you have multi-source data pipeline flowing, validated data quality, confirmed ingestion freshness, and baseline for measuring health—foundation for all downstream detection engineering.

Master Azure Monitor Agent (AMA) as replacement for legacy collection mechanism and Data Collection Rules (DCRs) as the configuration mechanism for agent-based log collection. Understand why AMA matters: replaces Log Analytics Agent (retired, no longer receiving security updates), provides better performance/flexibility, supports new platforms (Linux, macOS, Arc-connected on-premises). Learn DCR structure: data sources section defines what to collect (Windows Security Event channels, Linux Syslog facilities, performance counters, custom text logs), destinations section specifies where to send data (Log Analytics Workspace), data flows section maps sources to destinations. Master Windows Security event collection for Sentinel: most important channel is Security Event Log containing authentication/privilege/audit/process creation events, typical configuration collects all Security events at Audit level capturing everything enabled by Windows audit policies. Understand Syslog collection from Linux: highest priority facilities are auth/authpriv capturing authentication/authorization events, Linux sign-in attempts/sudo commands/auth failures all captured enabling Unix attack detection. Learn DCR transformation rules: pre-compute filtering/shaping/enrichment before data reaches workspace, drop known-clean events at collection time (never charged), rename/reshape fields, add calculated data. Master Azure Policy deployment: built-in policy "Configure Windows virtual machines to run Azure Monitor Agent" automatically installs AMA on any Windows VM in scope, policy remediation applies to existing non-compliant machines, new machines automatically brought into compliance. Understand log forwarder pattern for network devices: network security devices (firewalls, load balancers, NAC) unable to install agent send logs via Syslog/CEF to dedicated Linux forwarder VM, forwarder runs AMA forwarding normalized logs to Sentinel. Master Arc-connected servers extending Sentinel to on-premises: project on-premises Windows/Linux servers into Azure as managed resources, deploy AMA via same Azure Policy mechanisms, on-premises logs flow to Sentinel identically to cloud VMs. Learn custom log collection: proprietary application logs in custom formats configured via DCR to extract structured fields from unstructured text, enables monitoring of third-party applications without native log standardization. Master heartbeat monitoring: Heartbeat table contains record from each AMA every 60 seconds confirming agent running/connected, write query to identify offline systems: Heartbeat | summarise LastHeartbeat = max(TimeGenerated) by Computer | where LastHeartbeat < ago(1h). Understand AMA health critical for operational security: agents that stop sending silently create undetectable blind spots, proactive heartbeat monitoring prevents this visibility gap.

Master Sentinel cost management as critical operational discipline preventing budget surprises and false choices between security coverage and financial sustainability. Understand two-component cost structure: Log Analytics data ingestion costs (charged per-GB ingested), Sentinel surcharge on top (provides analytics rules, UEBA, automation capabilities). Learn pricing tiers: pay-as-you-go charges per-GB with no commitment (appropriate for variable/unpredictable volumes), capacity reservation (100-1000 GB/day tiers) offers 25-65% discount for known baseline (production environments almost always save money). Master Analytics tier ($2-3/GB approximate, region-dependent) for security-critical data: authentication logs, endpoint telemetry, network firewall events—data needed for real-time analytics rule processing. Understand Basic Logs tier (~1/8 Analytics cost) for high-volume lower-priority data: verbose application logs, network flow data, detailed endpoint traces—data you want to hunt/investigate but don't need real-time alerting. Learn Data Lake tier (lowest cost) for long-term archival: compliance-required retention (GDPR 12 months, government 3 years+) stored in economical tier. Build cost forecast before production deployment: estimate daily ingestion by source (Microsoft publishes typical per-user/per-device rates), sum volumes, apply tier-specific pricing, project monthly cost, compare against security value each source provides. Implement cost optimization: use DCR filtering dropping known-safe events at collection time (never charged), use workspace transformation rules post-ingestion filtering (slight delay but same effect), configure appropriate retention (don't keep data longer than compliance requires). Use Azure Cost Management for monitoring: set monthly budget, receive alerts when spending approaches limit, monthly reports showing cost breakdown by table/source enabling identification of expensive connectors. Understand cost-service trade-off: higher ingestion provides better detection coverage but increases expenses, mature organizations balance comprehensive visibility against budget constraints rather than attempting to ingest everything at maximum fidelity. Master retention planning: align retention with compliance requirements (PCI DSS 12 months, HIPAA 6 years in some circumstances, government frameworks varying), configure workspace retention matching longest requirement, archive beyond workspace retention to Auxiliary Logs or Data Lake, document retention policy with responsible party and annual review date. Prevent cost creep: review monthly reports, identify unexpected volume spikes investigating causes (misconfigured connectors, noisy data source, temporary incident investigation), make conscious data source decisions rather than connecting everything and dealing with cost later. Understand that cost management is not separate from security—organization that can't manage Sentinel costs loses budget to operate effectively, creating false choice between detection quality and financial responsibility. Design for value: smaller set of high-quality, well-understood data sources providing strong detection coverage more cost-effective than sprawling connector estate with 50% of data unqueried.

Create and manage analytics rules: Scheduled, NRT, Fusion, ML types. Master incident investigation workflows, entity pages, timelines. Build MITRE ATT&amp;CK-aligned detection coverage.

Master five distinct analytics rule types, each optimized for different detection scenarios and latency requirements. Understand Scheduled Analytics Rules as the workhorses: flexible KQL queries running on defined intervals (every 5 minutes to 14 days), lookback windows determining how far back query searches (typically matching query frequency for no gaps), alert thresholds triggering when query returns results, entity mapping connecting alerts to investigation context. Learn when scheduled rules appropriate: detecting patterns requiring time-windowed analysis (>10 failed logins within 15 minutes), behavioral correlations spanning multiple tables (user with failed logins also made admin change). Master Near Real-Time (NRT) rules for time-critical detection: process events as they arrive rather than polling schedule, deliver alerts within 60 seconds of triggering event, appropriate for high-impact scenarios (global admin account sign-in, new privileged role assignment, process injecting into system process). Understand NRT query complexity limitations: cannot use some aggregation functions available to scheduled rules, best for straightforward event-based detections where single event's data is sufficient for high-confidence determination. Learn Microsoft Security rules automatically promoting Defender product alerts to Sentinel incidents: configure alert source (Endpoint/Identity/Office/Cloud Apps), optionally filter by severity/alert name, matching alerts automatically become incidents. Master Fusion Rules using machine learning to correlate low-fidelity signals into high-confidence incidents: combines weak signals from multiple sources individually appearing benign into multi-stage attack detections, covers 80+ pre-defined attack scenarios automatically. Understand Fusion examples: single failed MFA alert + impossible travel + new OAuth app consent grant within 6 hours = account compromise incident. Discover Machine Learning Anomaly rules detecting statistical deviations from baselines: after 14-day learning period begin generating anomaly scores for users/hosts/applications based on behavior deviation, powerful for detecting "living off the land" attacks using legitimate tools/credentials. Learn anomaly rule trade-offs: require learning period before effective, may generate false positives during legitimate unusual activity (system migration, major config change), perfect complement to signature-based detection catching what rules cannot. Master alert grouping reducing queue noise: without grouping single brute-force attack generating 500 events over hour creates 500 incidents, grouping by entity produces one incident per attacker per hour. Understand entity mapping importance: map UserPrincipalName field to Account entity type enabling analyst to immediately access user's full history, UEBA profile, other alerts, related incidents through single click. Learn suppression duration preventing duplicate incidents: rule firing multiple times for same entity within specified period creates only one incident, prevents alert fatigue from repeated matches. Understand false positive tuning as continuous: review alert samples, identify patterns distinguishing false positives from true positives, add exclusion conditions to KQL, test query changes before deploying. Master high-quality detection rule characteristics: specific alert name explaining what happened (not generic rule reference), appropriate severity for actual risk, meaningful entity mapping, reasonable alert grouping, tuned thresholds minimizing false positives while maintaining true positive rate, clear documentation for future reference.

Build your first custom analytics rule from scratch establishing complete detection engineering workflow. Create scheduled analytics rule named "Suspicious Sign-In from Multiple Countries" with clear description explaining detection logic. Write KQL query: SigninLogs | where TimeGenerated > ago(1h) | summarise CountriesCount = dcount(Location), Countries = make_set(Location) by UserPrincipalName | where CountriesCount > 2 (detects users authenticating from >2 countries within one hour indicating credential sharing or compromise). Review query results confirming it returns expected data, note that in lab environment with limited activity may return empty results (expected). Configure alert enrichment adding custom details: include Countries list in alert providing immediate investigative context. Add entity mapping: UserPrincipalName to Account entity (connects incident to user's full history), IPAddress to IP entity (links to threat intelligence and other activity). Set query scheduling: run every 1 hour, lookback data from last 1 hour. Set alert threshold: generate alert when query results > 0 (meaningful since query itself already filters to suspicious activity). Configure event grouping: group all events into single alert per hour (prevents 10 alerts for 10 users in same hour creating queue noise). Enable incident creation: check "Create incidents from alerts", enable grouping by entity (Account), 1-hour grouping window. Deploy rule to production. Navigate to Analytics confirming rule appears in Active list with enabled status. First run occurs within minutes of deployment. Test rule by reviewing any generated incidents, open incident investigation page seeing incident title/severity/affected entities/alert count/MITRE ATT&CK techniques. Click "Investigate" to open investigation graph visualizing entity relationships. Use entity pages exploring full history of affected users. Add analyst notes documenting your assessment. Change incident status to Active. This lab transitions you from consuming Sentinel to building it—every detection rule, playbook, and configuration change you make going forward follows this same pattern you've now practiced end-to-end.

Master advanced investigation capabilities transforming raw alerts into clear attack narratives. Explore entity pages providing 360-degree views of users/hosts/IPs/applications: user pages showing sign-in history across locations/devices/applications, Azure resource activity, Office 365 usage, active incidents, UEBA risk scores, behavioral observations. Understand activity timelines as chronological event sequences: filter by time range and event type, review pre-incident activity identifying precursor events (initial access, reconnaissance, persistence) not captured by initial alert. Learn UEBA observations translating raw anomaly events into human-readable behavioral insights: "this user authenticated from country they've never accessed before", "this user's download volume is 10x their 90-day average", "this user accessed file share with no history accessing". Master investigation priority scores combining anomaly signals into single triage metric: guides analyst attention toward highest-risk entities first. Discover Security Copilot integration: click Copilot button generating plain-English incident summary synthesizing multiple alerts into coherent narrative—who was involved, what techniques used, what was accessed, what actions taken. Use investigation graph visualizing entity relationships: expand IP address nodes showing all users authenticating from it, expand user nodes showing all systems accessed, use Expand button discovering connected entities automatically. Learn bookmarking during investigation: save specific log entries as evidence, add notes explaining significance, link bookmarks to incidents preserving investigation trail. Master threat intelligence context: when investigation involves suspicious IP, threat intelligence integration immediately shows if known C2 server/Tor exit node/compromised host. Understand escalation workflows: during investigation recognize findings warranting immediate escalation (data exfiltration confirmed, privileged account compromise, nation-state TTP pattern), trigger escalation playbook notifying senior leadership. Learn incident closure discipline: classify every closed incident (True Positive = confirmed malicious, False Positive = legitimate activity incorrectly flagged, Benign Positive = suspicious technically but harmless in context, Undetermined = couldn't fully resolve). Document findings in incident notes creating investigation record for audit trail.

Master Kusto Query Language fundamentals and advanced threat hunting. Learn joins, time-series analysis, complex correlations. Write production-grade KQL for proactive defense.

Master Kusto Query Language as the fundamental technical skill enabling advanced Sentinel operations. Understand basic query structure: table name | pipe transformation operators creating processing pipeline. Master where operator for filtering: where TimeGenerated > ago(1d) reduces data to last 24 hours (critical for performance), where UserPrincipalName == "user@domain.com" filters to specific user, where ResultType != 0 filters to failed authentication events. Learn project operator selecting specific columns: project TimeGenerated, UserPrincipalName, IPAddress, Location, ResultType produces clean output with only relevant fields. Master extend operator adding computed columns: extend Hour = hourofday(TimeGenerated) enables time-based analysis, extend IsAnomaly = (DownloadVolume > Baseline) marks rows for filtering. Understand summarise operator aggregating data: summarise count by UserPrincipalName counts events per user, summarise dcount(IPAddress) by UserPrincipalName shows unique IPs per user, summarise make_set(Location) by UserPrincipalName collects all locations into array. Master join operator correlating tables: join kind=inner on UserPrincipalName finding matching rows in both tables, join kind=leftouter preserving all left table rows with optional right table matches. Learn union operator combining results: union SigninLogs, AuditLogs searches both tables simultaneously, union kind=outer includes all rows from both tables. Understand let statement for variables: let SuspectUsers = SigninLogs | where ResultType != 0 | summarise count by UserPrincipalName | where count > 10 defines variable reusable in same query. Master parse operator extracting structured data from strings: parse Message with * "User " Username " * " extracts username from formatted log. Learn aggregate functions: count() counts rows, dcount() counts distinct values, sum() totals numeric column, avg() calculates average, max()/min() find extremes, make_set() collects distinct values into array, make_list() collects all values including duplicates. Understand time functions: ago(1d) = now minus 1 day, startofday() rounds to midnight, startofweek() rounds to week start, format for time math. Master top/sort operators: top 10 by count descending shows 10 rows with highest count, sort by TimeGenerated asc sorts chronologically. Learn the crucial performance principle: always start with time filter limiting data volume, filter early and aggressively before complex operations, project unnecessary columns, structure queries so expensive operations work on smallest possible datasets.

Write five progressively complex threat hunting queries building real investigative capability.

• Query 1: Brute Force Detection: SigninLogs | where TimeGenerated > ago(1d) | where ResultType != 0 | summarise FailedAttempts = count(), UniqueIPs = dcount(IPAddress) by UserPrincipalName, bin(TimeGenerated, 1h) | where FailedAttempts > 20 | order by FailedAttempts desc. Identify users with >20 failed logins per hour distinguishing distributed attacks (many IPs) from targeted (single IP).

• Query 2: Impossible Travel: SigninLogs | where TimeGenerated > ago(1d) | where ResultType == 0 | project TimeGenerated, UserPrincipalName, IPAddress, Location | order by UserPrincipalName, TimeGenerated | serialize | extend PrevLocation = prev(Location), PrevTime = prev(TimeGenerated), PrevUser = prev(UserPrincipalName) | where PrevUser == UserPrincipalName | extend TimeDiff = datetime_diff('minute', TimeGenerated, PrevTime) | where TimeDiff < 60. Find users authenticating from two countries within one hour indicating compromise/credential sharing.

• Query 3: After-Hours Admin Activity: AzureActivity | where TimeGenerated > ago(7d) | where ActivityStatusValue == "Success" | extend HourOfDay = hourofday(TimeGenerated) | where HourOfDay < 7 or HourOfDay > 19 | where OperationNameValue contains "write" or OperationNameValue contains "delete" | summarise count by Caller, OperationNameValue. Detect administrative changes outside business hours suggesting insider threat/compromised credentials.

• Query 4: New Admin Accounts: AuditLogs | where TimeGenerated > ago(7d) | where OperationName == "Add member to role" | extend TargetUser = tostring(TargetResources[0].displayName), Role = tostring(TargetResources[0].modifiedProperties[0].newValue) | where Role contains "Admin" | project TimeGenerated, InitiatedBy, TargetUser, Role. Find new privileged account creation outside approved provisioning—high-fidelity persistence indicator.

• Query 5: Data Exfiltration Patterns: OfficeActivity | where TimeGenerated > ago(7d) | where Operation == "FileDownloaded" or Operation == "FileSyncDownloadedFull" | summarise DownloadCount = count(), UniqueFiles = dcount(SourceFileName) by UserId, bin(TimeGenerated, 1d) | where DownloadCount > 100 | order by DownloadCount desc. Detect users downloading unusual file volumes suggesting data staging before exfiltration. For each significant finding save a Bookmark: select suspicious rows, click "Add Bookmark", give descriptive title, add investigation notes, select MITRE ATT&CK techniques. Create a Hunting Session: name it "Investigation of [Topic]", describe hypothesis, set relevant tactics. After accumulating bookmarks, promote the most significant to formal Incidents, triggering full SOC investigation workflow. This lab teaches the complete threat hunting lifecycle: form hypothesis → write query → find evidence → bookmark findings → escalate to incident.

Build Security Orchestration, Automation, Response capabilities. Master automation rules and Logic App playbooks. Learn natural language Playbook Generator for rapid automation.

Master the distinction between lightweight automation rules and full-featured playbooks, learning when each is appropriate. Understand automation rules as lightweight fast-path automation: trigger on incident creation/update/status change, execute in milliseconds with no external dependencies, limited action types (change severity, change status, assign incident, add tags, suppress incident, run playbook). Master automation rule appropriate scenarios: automatically assigning High-severity incidents to on-call analyst (saves manual assignment), closing known false positive patterns from legitimate administrative activity, running playbook on critical rule types, adding tags for categorization. Learn automation rules as the vast majority of automation scenarios—simple, fast, no maintenance overhead. Discover playbooks as complex response automation built on Azure Logic Apps: connect to hundreds of services enabling integrations impossible with automation rules (disabling accounts, blocking IPs, sending Teams messages, creating ServiceNow tickets, running forensic collection, querying threat intelligence). Understand playbook trigger types: Incident trigger (passes full incident object with alerts/entities/metadata), Alert trigger (fires on individual alert, lighter payload), Entity trigger (run against specific entity on-demand or automatically). Master Managed Identity for secure authentication: Logic App authenticates to other Azure services using Managed Identity rather than storing credentials, no credential rotation overhead, clean audit trail. Learn Common Playbook Patterns to Deploy First: Credential Compromise Response (disable account, revoke sessions, notify manager, add comment), Phishing Email Response (delete email from recipients, block sender domain, find affected recipients, send safety guidance), Malicious IP Response (block in firewall, add to watchlist, find all systems communicating with it, add findings to incident). Understand automation governance: for high-impact playbooks implement approval workflow where playbook requests approval via Teams Adaptive Card before executing disruptive action, if approved within window action proceeds, if denied or times out playbook closes without action with documented denial. Master testing playbooks safely: use test mode parameter checking for specific tag before executing disruptive action, validate playbook works against test incidents before deploying, review Logic Apps run history confirming every step succeeded. Learn playbook troubleshooting: authentication errors indicate Managed Identity lacking required RBAC roles, connector errors indicate API authentication failure, timeout errors indicate slow downstream systems. Understand playbook ROI: initial investment in building/testing playbook repaid the first time it executes correctly at 2 AM on Saturday when no analyst monitoring, response time reduction from hours to seconds multiplies with every production incident. Recognize automation/incident response orchestration as highest-value security investment per hour invested: small automation improvement multiplied across hundreds/thousands of annual incidents produces enormous total time savings.

Build your first production-grade automation playbook integrating Sentinel incidents with external systems. Create Logic App with incident trigger: navigate to Automation → Playbooks → Create → select "Playbook with incident trigger", name it "Notify-Incident-Email". Enable system-assigned Managed Identity on Logic App: go to Azure portal → Identity → System Assigned → On, note Object ID. Assign RBAC role to Managed Identity: Sentinel workspace → Access Control (IAM) → Add role assignment → select Microsoft Sentinel Automation Contributor → assign to Notify-Incident-Email Managed Identity. Add email action to playbook: search Office 365 Outlook → Send email V2, configure To field with your email, Subject field with dynamic content incident title (click lightning bolt selecting Incident Title), Body field with incident severity/status/alerts/description from dynamic content. Add Sentinel comment action: search Microsoft Sentinel → Add comment to incident V3, map Incident ARM ID from trigger, comment message = "Automated notification email sent to SOC team on [timestamp]". Save playbook. Test playbook by creating test incident setting severity to High, confirm email received within 60 seconds, verify incident comment added. Create automation rule triggering the playbook: navigate to Automation → Automation rules → Create → name "Auto-Notify-MediumPlus-Incidents", condition: Incident severity ≥ Medium, action: Run playbook → select Notify-Incident-Email. Every new high-severity incident now automatically sends email notification and documents action in incident notes. Review Logic Apps run history showing execution log of every playbook run: click failed runs to see specific error messages enabling rapid troubleshooting. Explore Natural Language Playbook Generator: describe what you want playbook to do in English ("When High severity incident created, post message to Teams channel with incident details and direct link"), Copilot generates working Logic App workflow with documentation. This lab demonstrates complete automation workflow: design response action → build playbook → test thoroughly → integrate with automation rule → validate end-to-end → document for team.

Design Sentinel workbooks for SOC dashboards and compliance reporting. Configure UEBA, investigate anomalies, build AI-powered detection rules powered by machine learning.

Master Sentinel Workbooks as visual intelligence for SOC leadership and analyst operations. Understand Workbooks as interactive dashboards powered by KQL queries visualizing security data: not static screenshots but live data refreshing automatically. Master Workbook components: Metric tiles displaying single numbers (open incidents, closed incidents, mean response time), Line charts showing trends over time, Bar charts comparing volumes across categories, Pie charts showing proportions, Maps visualizing geographic data, Grids displaying tabular query results with sortable columns, Text blocks for documentation. Learn parameter concept: time-range picker (1 hour / 1 day / 1 week / 30 days), severity selector (High / Medium / Low), analyst selector filtering by owner, tactic selector filtering by MITRE tactic. Build Workbook for different audiences: SOC Operations (daily analyst use) showing open incident queue, incident trends, analyst workload, connector health at a glance; Management Summary (weekly leadership) showing incident closure rate, top threat categories, mean time to respond, data connector status; Compliance Audit (regulatory review) showing access control changes, user activity, retention periods, indicator coverage. Master conditional formatting making status immediately obvious: green indicator = connector healthy, yellow = degraded, red = offline enabling 5-second scan vs reading detailed metrics. Deploy Workbooks from Content Hub: 80+ built-in templates covering common data sources, customize by modifying queries/parameters/layout. Design principles: one metric per tile capturing complete thought at a glance, color coding for instant recognition, parameters enabling self-service filtering, clear titles explaining what each visualization represents. Create custom Workbook: start from blank, add metric tile querying SecurityIncident where Status == "Active" (shows open incidents), add line chart showing incident trend over past month binned by day, add grid showing active incidents with columns for severity/owner/created date, add time range parameter filtering all queries. Share Workbook: save to shared workspace making accessible to entire team, export as ARM template for version control, pin specific tiles to Azure Dashboard for at-a-glance visibility without opening full Workbook. Measure Workbook adoption: when team stops asking "how many open incidents?" because Workbook answers it at a glance, adoption is working. Update Workbooks as organization evolves: add new metrics as they become important, remove stale metrics as they stop providing value, adjust drill-down depth based on user feedback.

Master User and Entity Behavior Analytics as AI-powered detection complementing signature-based rules. Understand UEBA fundamental principle: all users/entities have normal behavioral patterns, deviations from personal baseline indicate anomaly/compromise even when individual actions appear innocent. Learn UEBA builds behavioral baselines across four dimensions: User behaviors (what hours they sign in, from which locations, to which applications, data access volumes), Device/Host behaviors (typical network connections, process execution patterns, file access), IP Address behaviors (historical users/devices from that location, expected geographic context), Application behaviors (typical user/behavior patterns for that application). Master baseline construction: UEBA analyzes 14 days of historical data understanding normal behavior, then continuously scores current actions against established baseline. Understand Investigation Priority Score combining multiple anomaly signals: high score indicates user warrants investigation priority, dynamically updates as new signals arrive. Learn UEBA detection examples: user signing in from country they've never accessed from, user downloading unusually large data volume, user accessing file share they've never accessed, user making administrative changes at 3 AM (if normal hours are 9-5), user authenticating from multiple countries within physically impossible timeframe. Master UEBA Behaviors Layer (GA 2025) synthesizing raw anomaly events: instead of presenting individual anomalous log entries, Behaviors Layer summarizes as human-readable text—"This user performed 10 successful authentications to resources they've never accessed before in this location", "This user's download volume is 15x their baseline today". Understand UEBA integration with incident investigation: entity pages show Investigation Priority Score prominently, UEBA Observations tab shows specific behavioral anomalies detected, timeline shows when anomalies occurred. Learn UEBA for insider threat detection: malicious insiders with legitimate access generate anomalous patterns (mass file downloads before resignation, access to systems outside their role), negligent insiders create anomalies through poor security practices, compromised insiders show authentication/access pattern deviations. Master UEBA false positives: legitimate travel generates impossible travel alerts (manage via travel exemptions), system migrations generate access anomalies (temporary exclusions), legitimate projects create access pattern changes (baseline adjustment). Understand UEBA role in Zero Trust verification: continuous verification of user/entity behavior ensuring deviations trigger investigation even though individual actions might pass signature checks.

Enable User and Entity Behavior Analytics and conduct simulated insider threat investigation. Enable UEBA in Sentinel: navigate to Configuration → Entity Behavior → toggle User and Entity Behavior Analytics to Enabled, select Entra ID and Defender for Endpoint as data sources, click Apply (begins building baselines immediately). Understanding baseline building: meaningful anomaly data requires 7-14 days accumulation in production environments, lab environment has pre-staged behavioral data enabling immediate practice. Navigate to Entity Behavior → Users viewing user list ranked by Investigation Priority Score. Click highest-scoring user opening entity page showing 360-degree view: Investigation Priority Score at top with sparkline showing score history, active incidents/alerts associated with user, location anomaly card showing this user signed in from country they've never accessed from (baseline shows 90% UK activity, today from Singapore), access anomaly card showing access to sensitive file shares they've never accessed, time anomaly card showing activities at 3 AM when baseline shows 9-5 business hours. Query BehaviorAnalytics table: BehaviorAnalytics | where TimeGenerated > ago(7d) | where ActivityInsights has any ("Anomalous") | sort by InvestigationPriority descending | project TimeGenerated, UserPrincipalName, ActivityType, ActivityInsights, InvestigationPriority (see raw anomaly data). Create UEBA-powered analytics rule: new scheduled rule "High Priority UEBA Anomaly", query BehaviorAnalytics with filter InvestigationPriority > 500, set severity High, run every 4 hours, enable incident creation, save rule. When rule fires create test incident, investigate using entity page and investigation graph, see full behavioral context. Add watchlist of privileged admins (5 test accounts), modify analytics rule to fire only when anomalous user is privileged admin (using _GetWatchlist function joining watchlist), rule now targets highest-risk users. Build UEBA Summary Workbook: metric tile showing count of users with Investigation Priority > 500, bar chart showing anomaly counts by ActivityType, grid showing top 10 highest-priority users with Investigation Priority/ActivityInsights columns, add time-range parameter. Run simulated insider threat scenario: testuser@lab.local downloaded 500 MB from SharePoint in 2-hour window outside business hours following unusual IP sign-in, review BehaviorAnalytics for this user seeing multiple anomaly flags, Investigation Priority should exceed 700 (critical category). Document findings: this user shows classic insider threat pattern (off-hours access, unusual location, mass data download), would recommend manager contact, account monitoring, forensic investigation.

Build three production-quality Workbooks serving different stakeholder needs. Workbook 1: SOC Operations Dashboard for daily analyst use. Create new Workbook, add time range parameter defaulting to last 24 hours, add metric tile showing Open Incidents (SecurityIncident where Status == "Active" | count), add metric tile showing New Incidents in selected time range, add metric tile showing Mean Time to Respond calculated from CreatedTime vs CloseTime for closed incidents. Add line chart binning incidents by hour, colored by severity showing whether incident volume rising/falling and if composition shifting toward more serious alerts. Add stacked bar chart grouping by MITRE tactic showing which attack patterns most active this week (use top 5 tactics + Other category for readability). Add grid showing analyst workload: SecurityIncident grouped by Owner with columns for open incident count, closed count this period, average response time, sorted by open count descending showing overloaded analysts in red (>20 open). Save as "SOC Operations Dashboard", share with team. Workbook 2: Management Summary Workbook for weekly leadership. New Workbook defaulting to 7-day time range. Add metric tiles for Total Incidents, Closed Incidents, Closure Rate percentage. Add line chart showing 4-week trend putting current week in historical context. Add table showing top 5 threat actors/attack categories detected this week with incident count. Add connector health summary with green/yellow/red status for each data source. Keep layout clean—leaders scan dashboards, they don't read them. Workbook 3: Compliance Audit Dashboard for ISO 27001/SOC 2. Structure around five control areas. Access Monitoring: query AuditLogs for RoleManagement operations showing role assignment changes with actor/target/role/timestamp, SigninLogs for privileged admin sign-in events. Anomaly Detection: summarise count of UEBA anomalies by type, show Investigation Priority score distribution. Incident Response: SecurityIncident metrics showing creation/assignment/closure timelines. Data Retention: query workspace configuration confirming retention periods meet policy. Threat Intelligence: show active indicator count, last 7-day match count, coverage by indicator type. Export Workbooks as ARM templates: Workbook editor → Edit → Advanced Editor → copy JSON → save as "workbook-name.json" in Git repository for infrastructure-as-code deployment. Pin important tiles to Azure Dashboard for wall-screen monitoring. This lab produces three complete Workbooks you can deploy to any Sentinel workspace via ARM template.