Microsoft Sentinel SC-200 : Zero to Hero Course

Microsoft Sentinel is a cloud-native siem that collects data from diverse sources to detect and investigate threats with built-in machine learning, then automates response via playbooks and Azure Logic Apps.

Understand the architecture of sentinel, including data connectors, a log analytics workspace, Kusto query language, and built-in workbooks for threat hunting, incident management, and threat intelligence.

Learn prerequisites for setting up Sentinel, including an Azure subscription, a subscription ID, and contributor or owner access to create a log analytics workspace on the resource group or subscription.

Create a personal Azure portal account on portal.azure.com, start the free trial, and complete verification with your details to access Azure services before charges begin after the 30-day trial.

Set up Microsoft Sentinel by creating a resource group and a log analytics workspace, deploy the Sentinel workspace, and install the training lab solution with a 31 days free trial.

Take a guided tour of the Microsoft Sentinel dashboard, exploring the new and old overviews, incidents, alerts, data connectors, analytics, logs, hunting, notebooks, and automation features.

Create a new user in the Azure portal, assign the security admin role, and grant access on the Sentinel resource group and Log Analytics workspace using role-based access control.

Assign and remove roles in microsoft sentinel to grant reader access at the resource group and workspace levels, showing how security admins control incidents and hunting permissions.

Explore content hub and data connectors in azure sentinel; install log4j2 solution with analytics rules, hunting queries, watch list, and playbooks, then see how connectors link sentinel to log sources.

Install the Azure activity data connector in Microsoft Sentinel, configure diagnostic settings to send logs to a Central India Log Analytics workspace, and verify connectivity with a test resource group.

Install and connect Microsoft Defender XDR to Microsoft Sentinel, enable Azure Activity Logs, configure data connectors and analytics rules, and explore Defender for Cloud options and licensing notes.

Plan and enable VM logs by setting up four labs (two Windows, two Linux), deploy agents and data collection rules, and enable logs across multiple VMs in one click.

Create two Azure virtual machines (Windows and Linux) within a resource group, selecting size, standard HDD or premium SSD, and spot discount, then configure Linux SSH keys.

Create a data collection rule in log analytics to collect windows event logs and linux syslog from the VMs and route to the Sentinel workspace.

Enable Linux VM logs in Sentinel by configuring the data collection rule and Linux log source, then verify logs and their severity in the Sentinel logs.

Discover KQL basics for querying log analytics in Microsoft Sentinel, and learn to run, save, share, and export queries, including using threat intelligence indicators and security events tables.

Enable analytics rules in Microsoft Sentinel by following a step by step guide in the Content Hub, choosing Azure Activity analytics rules, configuring logic, scheduling, and alerts.

Create a custom analytics rule in Microsoft Sentinel by configuring a scheduled query rule, writing a syslog-based query to detect root access, and saving to generate alerts and incidents.

Learn how threat intelligence powers Microsoft Sentinel by using threat indicators or IOCs, sources like open CTIs and MISP, and how to upload or bulk import indicators via data connectors.

Install the threat intelligence content hub in Microsoft Sentinel, then enable the data connectors and analytics rules. Explore Defender threat intelligence and configure connectors to ingest indicators and log sources.

See how Defender-based threat intelligence indicators grow over time, configure a threat intelligence source, and import indicators with a template, while previewing 38 analytics rules and import errors.

Demonstrates importing bulk indicators from JSON and CSV templates, naming sources, and using manage imports to verify JSON is fully imported and CSV appears after refresh.

Add a single IOC in threat intelligence by using the add new option, detailing a domain, malware website tag, confidence, time window, and kill chain phase.

Explore how Microsoft Sentinel uses kql kusto query language to search logs, understand common and defender xdr tables, and locate table names in log analytics to support investigations.

Identify, investigate, and respond to security incidents to minimize impact and restore operations quickly. Master the incident management cycle—identify, respond, resolve, and learn—plus ownership, monitoring, tracking, and communication.

Investigate high-severity incidents in Microsoft Sentinel from scratch, triage alerts, research Solorigate indicators, and block malicious domains and IPs while updating threat intelligence for leadership.

Investigate medium severity incidents in Microsoft Sentinel by following SOP-driven workflows, analyzing events and host IPs, and tracing root-user activity, including suspicious inbox rules and compromised email indicators.

Investigate low severity incidents by reviewing full details, examining IPs and events in the timeline, and confirming actions with IAM engineers on account disablement by an administrator.

Create automation rules in Microsoft Sentinel to automatically close incidents when created, using conditions on incident provider and analytics tool name, with actions like change status and run the playbook.

Explore threat hunting in Microsoft Sentinel within the SOC workflow, using hypothesis-driven queries, validate findings against data, and take action; leverage new hunt options, live streams, and bookmarks across logs.

Learn to run hunting queries in Microsoft Sentinel and create a new hunting rule for double file extension using regex, including query design and entity mapping.

Learn how Microsoft Sentinel enables security orchestration, automation and response (SOAR) to automate recurring enrichment, remediation, and automatically close benign-positive incidents using automation rules.

Create and automate incident rules in Microsoft Sentinel using soar, set triggers on creation, apply conditions, run playbooks, and assign owners to streamline triage.