1. Introduction to Microsoft Defender XDR threat protection
In this module, you'll learn how to use the Microsoft Defender XDR integrated threat protection suite.
Click here to know more
2. Mitigate incidents using Microsoft 365 Defender
Learn how the Microsoft 365 Defender portal provides a unified view of incidents from the Microsoft 365 Defender family of products.
Click here to know more
3. Protect your identities with Microsoft Entra ID Protection
Use the advanced detection and remediation of identity-based threats to protect your Microsoft Entra identities and applications from compromise.
Click here to know more
4. Remediate risks with Microsoft Defender for Office 365
Learn about the Microsoft Defender for Office 365 component of Microsoft 365 Defender XDR.
Click here to know more
5. Safeguard your environment with Microsoft Defender for Identity
Learn about the Microsoft Defender for Identity component of Microsoft 365 Defender XDR.
Click here to know more
6. Secure your cloud apps and services with Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) that operates on multiple clouds. It provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyberthreats across all your cloud services. Learn how to use Defender for Cloud Apps in your organization.
Click here to know more
7. Fundamentals of Generative AI
In this module, you explore the way in which language models enable AI applications and services to generate original content based on natural language input. You also learn how generative AI enables the creation of copilots that can assist humans in creative tasks.
Click here to know more
8. Describe Microsoft Copilot for Security
Get acquainted with Microsoft Copilot for Security. You are introduced to some basic terminology, how Microsoft Copilot for Security processes prompts, the elements of an effective prompt, and how to enable the solution.
Click here to know more
9. Describe the core features of Microsoft Copilot for Security
Microsoft Copilot for Security has a rich set of features. Learn about available plugins, promptbooks, the ways you can export and share information from Copilot, and much more.
Click here to know more
10. Describe the embedded experiences of Microsoft Copilot for Security
Microsoft Copilot for Security is accessible directly from some Microsoft security products. This is referred to as the embedded experience. Learn about the scenarios supported by the Copilot embedded experience in Microsoft’s security solutions.
Click here to know more
11. Respond to data loss prevention alerts using Microsoft 365
As a Security Operations Analyst, you need to understand compliance related terminology and alerts. Learn how the data loss prevention alerts will help in your investigation to find the full scope of the incident.
Click here to know more
12. Manage insider risk in Microsoft Purview
Microsoft Purview Insider Risk Management helps organizations address internal risks, such as IP theft, fraud, and sabotage. Learn about insider risk management and how Microsoft technologies can help you detect, investigate, and take action on risky activities in your organization.
Click here to know more
13. Search and investigate with Microsoft Purview Audit
Enhance data security and compliance with Microsoft Purview Audit by configuring detailed audits, managing logs, and analyzing access patterns.
Click here to know more
14. Investigate threats with Content search in Microsoft Purview
This module examines how to search for content in the Microsoft Purview compliance portal using Content Search functionality, including how to view and export the search results, and configure search permissions filtering.
Click here to know more
15. Protect against threats with Microsoft Defender for Endpoint
Learn how Microsoft Defender for Endpoint can help your organization stay secure.
Click here to know more
16. Deploy the Microsoft Defender for Endpoint environment
Learn how to deploy the Microsoft Defender for Endpoint environment, including onboarding devices and configuring security.
Click here to know more
17. Implement Windows security enhancements with Microsoft Defender for Endpoint
Microsoft Defender for Endpoint gives you various tools to eliminate risks by reducing the surface area for attacks without blocking user productivity. Learn about Attack Surface Reduction (ASR) with Microsoft Defender for Endpoint.
Click here to know more
18. Perform device investigations in Microsoft Defender for Endpoint
Microsoft Defender for Endpoint provides detailed device information, including forensics information. Learn about information available to you through Microsoft Defender for Endpoint that will aid in your investigations.
Click here to know more
19. Perform actions on a device using Microsoft Defender for Endpoint
Learn how Microsoft Defender for Endpoint provides the remote capability to contain devices and collect forensics data.
Click here to know more
20. Perform evidence and entities investigations using Microsoft Defender for Endpoint
Learn about the artifacts in your environment and how they relate to other artifacts and alerts that will provide you insight to understand the overall impact to your environment.
Click here to know more
21. Configure and manage automation using Microsoft Defender for Endpoint
Learn how to configure automation in Microsoft Defender for Endpoint by managing environmental settings.
Click here to know more
22. Configure for alerts and detections in Microsoft Defender for Endpoint
Learn how to configure settings to manage alerts and notifications. You'll also learn to enable indicators as part of the detection process.
Click here to know more
23. Utilize Vulnerability Management in Microsoft Defender for Endpoint
Learn about your environment's weaknesses by using Vulnerability Management in Microsoft Defender for Endpoint.
Click here to know more
24. Plan for cloud workload protections using Microsoft Defender for Cloud
Learn the purpose of Microsoft Defender for Cloud and how to enable the system.
Click here to know more
25. Connect Azure assets to Microsoft Defender for Cloud
Learn how to connect your various Azure assets to Microsoft Defender for Cloud to detect threats.
Click here to know more
26. Connect non-Azure resources to Microsoft Defender for Cloud
Learn how you can add Microsoft Defender for Cloud capabilities to your hybrid environment.
Click here to know more
27. Manage your cloud security posture management
Microsoft Defender for Cloud, Cloud Security Posture Management (CSPM) provides visibility into vulnerable resources and provides hardening guidance.
Click here to know more
28. Explain cloud workload protections in Microsoft Defender for Cloud
Learn about the protections and detections provided by Microsoft Defender for Cloud with each cloud workload.
Click here to know more
29. Remediate security alerts using Microsoft Defender for Cloud
Learn how to remediate security alerts in Microsoft Defender for Cloud.
Click here to know more
30. Construct KQL statements for Microsoft Sentinel
KQL is the query language used to perform analysis on data to create analytics, workbooks, and perform hunting in Microsoft Sentinel. Learn how basic KQL statement structure provides the foundation to build more complex statements.
Click here to know more
31. Analyze query results using KQL
Learn how to summarize and visualize data with a KQL statement provides the foundation to build detections in Microsoft Sentinel.
Click here to know more
32. Build multi-table statements using KQL
Learn how to work with multiple tables using KQL.
Click here to know more
33. Work with data in Microsoft Sentinel using Kusto Query Language
Learn how to use the Kusto Query Language (KQL) to manipulate string data ingested from log sources.
Click here to know more
34. Introduction to Microsoft Sentinel
Traditional security information and event management (SIEM) systems typically take a long time to set up and configure. They're also not necessarily designed with cloud workloads in mind. Microsoft Sentinel enables you to start getting valuable security insights from your cloud and on-premises data quickly. This module helps you get started.
Click here to know more
35. Create and manage Microsoft Sentinel workspaces
Learn about the architecture of Microsoft Sentinel workspaces to ensure you configure your system to meet your organization's security operations requirements.
Click here to know more
36. Query logs in Microsoft Sentinel
As a Security Operations Analyst, you must understand the tables, fields, and data ingested in your workspace. Learn how to query the most used data tables in Microsoft Sentinel.
Click here to know more
37. Use watchlists in Microsoft Sentinel
Learn how to create Microsoft Sentinel watchlists that are a named list of imported data. Once created, you can easily use the named watchlist in KQL queries.
Click here to know more
38. Utilize threat intelligence in Microsoft Sentinel
Learn how the Microsoft Sentinel Threat Intelligence page enables you to manage threat indicators.
Click here to know more
39. Connect data to Microsoft Sentinel using data connectors
The primary approach to connect log data is using the Microsoft Sentinel provided data connectors. This module provides an overview of the available data connectors.
Click here to know more
40. Connect Microsoft services to Microsoft Sentinel
Learn how to connect Microsoft 365 and Azure service logs to Microsoft Sentinel.
Click here to know more
41. Connect Microsoft 365 Defender XDR to Microsoft Sentinel
Learn about the configuration options and data provided by Microsoft Sentinel connectors for Microsoft 365 Defender XDR.
Click here to know more
42. Connect Windows hosts to Microsoft Sentinel
One of the most common logs to collect is Windows security events. Learn how Microsoft Sentinel makes this easy with the Security Events connector.
Click here to know more
43. Connect Common Event Format logs to Microsoft Sentinel
Most vendor-provided connectors utilize the CEF connector. Learn about the Common Event Format (CEF) connector's configuration options.
Click here to know more
44. Connect syslog data sources to Microsoft Sentinel
Learn about the Syslog connector's configuration options which will enable you to parse Syslog data.
Click here to know more
45. Connect threat indicators to Microsoft Sentinel
Learn how to connect Threat Intelligence Indicators to the Microsoft Sentinel workspace using the provided data connectors.
Click here to know more
46. Threat detection with Microsoft Sentinel analytics
In this module, you learned how Microsoft Sentinel Analytics can help the SecOps team identify and stop cyber attacks.
Click here to know more
47. Automation in Microsoft Sentinel
By the end of this module, you'll be able to use automation rules in Microsoft Sentinel to automated incident management.
Click here to know more
48. Threat response with Microsoft Sentinel playbooks
This module describes how to create Microsoft Sentinel playbooks to respond to security threats.
Click here to know more
49. Security incident management in Microsoft Sentinel
Learn about security incidents, incident evidence and entities, incident management, and how to use Microsoft Sentinel to handle incidents.
Click here to know more
50. Identify threats with Behavioral Analytics
Learn how to use entity behavior analytics in Microsoft Sentinel to identify threats inside your organization.
Click here to know more
51. Data normalization in Microsoft Sentinel
By the end of this module, you'll be able to use ASIM parsers to identify threats inside your organization.
Click here to know more
52. Query, visualize, and monitor data in Microsoft Sentinel
This module describes how to query, visualize, and monitor data in Microsoft Sentinel.
Click here to know more
53. Manage content in Microsoft Sentinel
By the end of this module, you'll be able to manage content in Microsoft Sentinel.
Click here to know more
54. Explain threat hunting concepts in Microsoft Sentinel
Learn the threat hunting process in Microsoft Sentinel.
Click here to know more
55. Threat hunting with Microsoft Sentinel
In this module, you'll learn to proactively identify threat behaviors by using Microsoft Sentinel queries. You'll also learn to use bookmarks and livestream to hunt threats.
Click here to know more
56. Use Search jobs in Microsoft Sentinel
In Microsoft Sentinel, you can search across long time periods in large datasets by using a search job.
Click here to know more
57. Hunt for threats using notebooks in Microsoft Sentinel
Learn how to use notebooks in Microsoft Sentinel for advanced hunting.
Click here to know more