SC-200: Microsoft Security Operations Analyst

Explore how growing complexity across people, cloud, endpoints, mobile, ics/ot, and IoT drives security challenges, while shortages, sophisticated threats, automation gaps, data deluge, and noisy alerts shape operations.

Explore the role of a security operations center, covering threat intelligence, threat hunting, log management, threat detection, incident response, root cause investigation and forensics to reduce the attack surface.

Examine the three-tier SoC model, from automation handling commodity malware to tier one, tier two, and tier three analysts, including proactive threat hunting and forensics.

Follow the NIST incident response process from preparation through post-incident activity, outlining detection and analysis, containment and eradication, and recovery steps for SOCs.

Explore EDR, XDR, SIEM, and SOAR within the Microsoft ecosystem, including Defender for Endpoint, Defender XDR, Sentinel, and automated incident response with Logic Apps.

Blue teams monitor, respond, and hunt threats with edr, xdr, siem, and soar. Red teams test vulnerabilities and simulate adversaries, while purple teaming unites them to strengthen security posture.

Define cyber threats with the NIST definition: any incident that could impact operations, assets, or individuals through an information system, including unauthorized access, destruction, disclosure, modification, or denial of service.

Explore cyber threat intelligence within the broader concept of intelligence. Understand how threat intelligence focuses on adversaries and their tactics, techniques, and procedures in cyber contexts.

Define cyber threat intelligence as knowledge about adversaries' motivations, intentions, and methods gathered to defend enterprise assets using tactics, techniques, and procedures for threat-informed defense.

Define threats, vulnerabilities, and risks, and show how a threat actor exploits a vulnerability to cause downtime, confidentiality breaches, or integrity violations, with risk equal to impact times likelihood.

Explore threat informed defense by aligning cyber threat intelligence with your mission, identifying threat actors, motivations, and TTPs, and strengthening detection and protection.

Explore tactics, techniques, and procedures (TTPs) as a progression from high level threat actor objectives to detailed actions, including sub techniques and how they differ from the mitre framework.

Learn to distinguish indicators of compromise and indicators of attack, where IOCs detect artifacts like file hashes and domains, while IoAs analyze attacker behavior and intent to drive threat-informed defense.

the pyramid of pain ranks defender-detectable artifacts by the difficulty attackers face changing them, from hashes and ips to tools and ttps, urging focus on detecting ttps

Explore enterprise paid tools, open-source osint, and social media as CTI sources, using Microsoft Defender Threat Intelligence, CrowdStrike, VirusTotal, Shodan, and social platforms for IOCs and TTPs.

Vulnerabilities are weaknesses in information systems, security procedures, or implementation that threat sources can exploit, including software, people, hardware, and physical controls, not limited to CVEs.

Explore the common vulnerabilities and exposures (CVE) framework, how CVE IDs are assigned and described, and how CVSS scores measure impact, illustrated by a Google Chrome vulnerability CVE-2009-2935.

Explore how CVSS scores rank vulnerabilities with CVSS versions 2 and 3, and CVE IDs, guiding prioritization while considering asset criticality and not relying solely on scores.

Explore how cloud computing relies on five properties: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service, enabling fast provisioning, scalable resources, and usage-based billing.

Explore public, private, multicloud, and hybrid cloud models using examples from Azure, AWS, and GCP, plus on-premise options like Azure Stack, AWS Outposts, and Google Anthos.

Explore how the Azure global backbone connects data centers worldwide through fiber, subsea cables, and edge sites to deliver high performance, fault tolerance, and disaster recovery.

Understand the shared responsibility model across on premises, IaaS, PaaS, and SaaS in Azure, with security duties split between customer and provider and shifting by service type.

Organize Azure resources with the resource hierarchy: management groups, subscriptions, and resource groups. Group resources by lifecycle to optimize security and governance.

Explore Azure subscription types, including free and student options, and understand how pay as you go and enterprise agreements differ in cost and usage.

Demystify the relationship between Entra ID tenants and Azure subscriptions by showing that tenants are identity providers. Subscriptions host Azure resources, and avoid the misconception that subscriptions are tenants.

Zero trust is a security strategy and mindset, not a single product. It enforces explicit verification, least-privileged access, just-in-time access, and assume breach to minimize blast radius.

Explore the Microsoft security cosmos, focusing on cloud security, SOC, and cyber threat intelligence, and see how defender XDR and Sentinel secure multi-cloud and on-prem resources.

Defend the classic attack chain from phishing to data exfiltration using defender for office, defender for endpoint, defender for identity protection, and defender for cloud apps.

Explore the MITRE ATT&CK framework to understand adversarial tactics and techniques, core adversary knowledge, and how threat-informed defense uses tactics, techniques, and procedures to defend against known attacks.

Map the pyramid of pain to MITRE's ttp framework, aligning tactics, techniques and sub techniques with MITRE attack, noting that hash values and IP addresses are outside attack's focus.

Examine the three big matrices—enterprise, mobile, and ICS—and their submatrices, including Windows, Linux, macOS, Azure AD (entry id), O365, Google Workspaces, networks, containers, and iOS/Android.

Explore the Mitratech framework’s tactics and the 14 enterprise tactics in the attack kill chain, from reconnaissance to impact.

Explore how the middle attack framework’s 201 techniques map to tactics, with examples like active scanning, scheduled tasks, masquerading, brute force, account discovery via PowerShell, and encrypted C2 channel.

Explore detailed sub techniques that map to tactics and techniques, with examples like vulnerability scanning, spear phishing attachments, and dll injection.

Explore tactics, techniques, and sub techniques in the attack framework, showing why adversaries act and how they achieve objectives via the execution tactic, command and scripting interpreter, and Python.

Identify key data sources to collect telemetry and support detecting adversary activity, including network traffic, web application firewall logs, and on-premises network logs, aligned with the MITRE ATT&CK framework.

Identify detections and high-level strategies for adversary tps, focusing on reconnaissance, active scanning, and vulnerability scanning with CIM rule alerts from WAF logs.

Learn how mitigations use preventative configurations to reduce the attack surface, minimize data exposure, and prioritize upfront controls over detections, including privileged account management for escalation threats.

Explore how threat groups are defined by related behavior and tracked with different vendor naming conventions, such as apt 41 (Mandiant), Fancy Bear, and Midnight Blizzard, highlighting cross-vendor naming differences.

Software in attack refers to tools or malware used by adversaries, linked to techniques, groups, and campaigns, including built-in or publicly available software like PowerShell.

Campaigns are intrusion activities conducted over a specific period with common targets and objectives. They are large, orchestrated operations, often by nation-state actors or organized crime groups, not single breaches.

Explain how groups, tactics, objectives, and motivations relate. Show how groups leverage Mimikatz to enable techniques and sub techniques, and how data sources drive detections and reveal campaigns.

Explore the MITRE ATT&CK enterprise matrix, navigate tactics, techniques, and subtechniques, compare enterprise, mobile, and ICS matrices, and learn mitigations, detections, data sources, and CTI insights.

Learn how to get a Microsoft 365 E5 trial license and assign it to a user to enable Defender XDR features.

Learn to create your free azure subscription by choosing between free and pay as you go, providing your personal details, then log in to portal.azure.com to start building in azure.

Demonstrate installing VirtualBox to host Kali Linux. Download VirtualBox from the resources, select Windows as your OS, run the executable, and complete the installation with default settings.

Install Kali Linux with VirtualBox, import the Kali image, and fine-tune the virtual machine by increasing RAM and cores. Log in as Kali and start the VM to attack infrastructure.

Configure Kali Linux keyboard layout by opening the settings manager, adding your keyboards (German and US), and adjusting priority with the up and down arrows.

Install the tor browser on kali with sudo apt update and sudo apt install -y tor, then launch tor browser launcher to download and verify the signature for defender testing.

Create an Azure resource group for Defender for Cloud demos, name it MDC demo, select East US, and finalize to serve as the logical container for resources.

Enable all defender for cloud plans in your subscription to unlock demos, noting the cost implications. Configure settings where available and verify protection across CSPM, servers, databases, storage, and containers.

Create sample alerts in Defender for Cloud for a chosen subscription and plans, then see them reflected in the incidence queue in Defender XDR after a brief delay.