Configure SIEM Security Operations using Microsoft Sentinel

This course teaches how to start with Microsoft Sentinel security operations by configuring the workspace.

Not yet scheduled

- No location

1 day

445 (excl. VAT)

Description

Get started with Microsoft Sentinel security operations by configuring the Microsoft Sentinel workspace, connecting Microsoft services and Windows security events to Microsoft Sentinel, configuring Microsoft Sentinel analytics rules, and responding to threats with automated responses.

! Note

You need to have your own Azure subscription.

You need an Azure subscription to complete the exercises. If you don't have an Azure subscription, create a free account and add a subscription before you begin. If you're a student, you can take advantage of the Azure for students offer.

Prerequisites Fundamental understanding of Microsoft Azure Basic understanding of Microsoft Sentinel Experience using Kusto Query Language (KQL) in Microsoft Sentinel

You will study at your own pace in our training center, guided by a certified trainer.

Prior Knowledge

No specific prior knowledge required.

Subjects

Create and manage Microsoft Sentinel workspaces

Describe Microsoft Sentinel workspace architecture
Install Microsoft Sentinel workspace
Manage a Microsoft Sentinel workspace

Connect Microsoft services to Microsoft Sentinel

Connect Microsoft service connectors
Explain how connectors auto-create incidents in Microsoft Sentinel

Connect Windows hosts to Microsoft Sentinel

Connect Azure Windows Virtual Machines to Microsoft Sentinel
Connect non-Azure Windows hosts to Microsoft Sentinel
Configure Log Analytics agent to collect Sysmon events

Threat detection with Microsoft Sentinel analytics

Explain the importance of Microsoft Sentinel Analytics.
Explain different types of analytics rules.
Create rules from templates.
Create new analytics rules and queries using the analytics rule wizard.
Manage rules with modifications.

Automation in Microsoft Sentinel

Explain automation options in Microsoft Sentinel
Create automation rules in Microsoft Sentinel