Microsoft Sentinel Skills

Name: Microsoft Sentinel Skills
Rating: 4.6 (7 reviews)

Security Information and Event Management (SIEM)

Created byStone River eLearning

Last updated 4/2023

English

What you'll learn

Understand the core features and capabilities of Microsoft Sentinel, including its data model, query language, and analytics capabilities.
Effectively monitor and detect security threats using Sentinel's built-in security analytics and threat intelligence features.
Configure data connectors to ingest and analyze security data from various sources, including cloud services and on-premises environments.
Automate incident response workflows using Sentinel's automation features, including playbooks and Logic Apps.

Course content

3 sections • 13 lectures • 5h 8m total length

Overview5:04
Explore Microsoft Sentinel's architecture, setup, and governance, including Log Analytics workspace, RBAC, cost management, and MITRE ATT&CK integration, with hands-on tasks and practical how-to guidance.
Prerequisites24:51
Discover prerequisites for deploying Microsoft Sentinel, including an Azure tenant and subscription, a Log Analytics workspace, data sources and connectors, budgeting, and a resource group with roles and permissions.
Roles & Permissions26:57
Plan and apply Azure role-based access control roles for Microsoft Sentinel using built-in and custom roles, scoped at the resource group to cover the Sentinel workspace and Log Analytics.
Costs & Billing26:19
Explore how to estimate and manage costs for Microsoft Sentinel using the pricing calculator, pay-as-you-go and commitment pricing, and cost management tools, including data ingestion, retention, and budgeting.

Discover & Deploy Out-of-the-box Content22:00
Explore the content hub in Microsoft Sentinel, discover out-of-the-box content from Microsoft and third-party vendors, and deploy workbooks, analytics rules, and playbooks to fast-track security operations.
Connect Threat Intelligence Platforms25:23
Learn to connect your threat intelligence platform to Microsoft Sentinel using the Graph Security API, including Azure AD app registration, permissions, and the data connector workflow.
Use Azure Monitor Workbooks26:46
Create Custom Analytics Rules23:14
Explore how to create custom analytics rules in Microsoft Sentinel to detect threats and drive incident response. Learn to use templates, scheduled and near real-time rules, and automated responses.
Create Anomaly Detection Analytics Rules25:20
Learn how to work with anomaly detection analytics rules in Microsoft Sentinel by using templates, duplicating to customize, and evaluating anomalies with logs and queries.
Enable User & Entity Behavior Analytics (UEBA)23:11
Enable UEBA in Microsoft Sentinel by turning it on, selecting data sources, and using the built-in workbook to visualize risky user behavior and anomalous activity.
Configure Multistage Attack Detection (Fusion) Rules24:26
Configure multistage attack detection fusion rules in Microsoft Sentinel to correlate anomalous behavior across sessions using a fusion engine powered by machine learning and the MITRE ATT&CK framework.

Requirements

While not required, experience with security technologies and tools, such as SIEM systems, threat intelligence platforms, and security analytics tools, can be beneficial for learners taking this course.

Description

The Microsoft Sentinel Skills Course is a comprehensive training program designed to provide learners with the knowledge and skills needed to effectively use Microsoft Sentinel, a cloud-native Security Information and Event Management (SIEM) system. The course is intended for security professionals, IT administrators, and anyone responsible for monitoring and responding to security incidents in an organization.

The course begins with an introduction to Sentinel and its key features, followed by a deep dive into the Sentinel data model, query language, and analytics capabilities. Learners will also learn how to use Sentinel to detect and respond to security threats, configure data connectors, and automate incident response workflows.

Other topics covered in the course include threat hunting, incident investigation, creating custom alerts and workbooks, and managing Sentinel at scale. The course also covers best practices for configuring and managing Sentinel in a production environment.

Throughout the course, learners will have access to hands-on labs and exercises designed to reinforce the concepts covered in the lectures. Upon completion of the course, learners will be well-equipped to use Microsoft Sentinel to monitor and protect their organization's digital assets.

The Microsoft Sentinel Skills Course is intended for security professionals, IT administrators, and anyone responsible for monitoring and responding to security incidents in an organization. The course is ideal for individuals who want to gain a deep understanding of Microsoft Sentinel, a cloud-native Security Information and Event Management (SIEM) system, and learn how to use it effectively to monitor and protect their organization's digital assets.

Who this course is for:

Security analysts and engineers
Security operations center (SOC) analysts and managers
IT administrators responsible for security
Cloud security architects and engineers
Cybersecurity professionals
Information security managers
Compliance and risk managers
IT managers and directors
Azure administrators and architects
Anyone interested in learning about Microsoft Sentinel and cloud-native security technologies.

Microsoft Sentinel Skills

What you'll learn

Explore related topics

Course content

Architecture4 lectures • 1hr 23min

Deployment2 lectures • 55min

How Do I?7 lectures • 2hr 50min

Requirements

Description

Who this course is for: