Discover Classes. Earn 10% Rewards.

Microsoft Security Operations Analyst

Unlock the skills to investigate, respond to, and hunt for cyberthreats using Microsoft Sentinel, Microsoft Defender for Cloud, and Microsoft 365 Defender. Gain proficiency in mitigating risks and configuring security solutions with hands-on training tailored for Security Operations Analysts. Prepare for the SC-200 exam while mastering threat management and incident response techniques.

  • Intermediate
  • 18 and older
  • $1,995
  • Earn 10% Rewards
  • Price Lock
  • Online Classroom
  • 27 hours over 4 sessions

Express Checkout – $1,995


Proceed to Checkout

No Booking Fees. Lowest Price Guaranteed. Earn 10% Rewards.

Give as a Gift

Start Dates (6)

  • $1,995
  • 27 hours over 4 sessions
2 left
Book
Show all 4 sessions
  • Mon, Jun 10 at 10:00am - 4:45pm
  • Tue, Jun 11 at 10:00am - 4:45pm
  • Wed, Jun 12 at 10:00am - 4:45pm
  • Thu, Jun 13 at 10:00am - 4:45pm
2 left
Book
Show all 4 sessions
  • Mon, Jul 08 at 10:00am - 4:45pm
  • Tue, Jul 09 at 10:00am - 4:45pm
  • Wed, Jul 10 at 10:00am - 4:45pm
  • Thu, Jul 11 at 10:00am - 4:45pm
2 left
Book
Show all 4 sessions
  • Mon, Aug 05 at 10:00am - 4:45pm
  • Tue, Aug 06 at 10:00am - 4:45pm
  • Wed, Aug 07 at 10:00am - 4:45pm
  • Thu, Aug 08 at 10:00am - 4:45pm
2 left
Book
Show all 4 sessions
  • Tue, Sep 03 at 10:00am - 4:45pm
  • Wed, Sep 04 at 10:00am - 4:45pm
  • Thu, Sep 05 at 10:00am - 4:45pm
  • Fri, Sep 06 at 10:00am - 4:45pm
2 left
Book
Show all 4 sessions
  • Mon, Sep 30 at 10:00am - 4:45pm
  • Tue, Oct 01 at 10:00am - 4:45pm
  • Wed, Oct 02 at 10:00am - 4:45pm
  • Thu, Oct 03 at 10:00am - 4:45pm
Showing 15 of 6

Class Description

Description

What you'll learn in this cybersecurity training:

Learn how to investigate, respond to, and hunt for threats using Microsoft Sentinel, Microsoft Defender for Cloud, and Microsoft 365 Defender. In this course you will learn how to mitigate cyberthreats using these technologies. Specifically, you will configure and use Microsoft Sentinel as well as utilize Kusto Query Language (KQL) to perform detection, analysis, and reporting. The course was designed for people who work in a Security Operations job role and helps learners prepare for the exam SC-200: Microsoft Security Operations Analyst.

Audience Profile
The Microsoft Security Operations Analyst collaborates with organizational stakeholders to secure information technology systems for the organization. Their goal is to reduce organizational risk by rapidly remediating active attacks in the environment, advising on improvements to threat protection practices, and referring violations of organizational policies to appropriate stakeholders.

Responsibilities include threat management, monitoring, and response by using a variety of security solutions across their environment. The role primarily investigates, responds to, and hunts for threats using Microsoft Sentinel, Microsoft Defender for Cloud, Microsoft 365 Defender, and third-party security products. Since the Security Operations Analyst consumes the operational output of these tools, they are also a critical stakeholder in the configuration and deployment of these technologies.

Job role: Security Engineer

Preparation for exam: SC-200

Skills gained
• Explain how Microsoft Defender for Endpoint can remediate risks in your environment
• Administer a Microsoft Defender for Endpoint environment
• Configure Attack Surface Reduction rules on Windows devices
• Perform actions on a device using Microsoft Defender for Endpoint
• Investigate domains and IP addresses in Microsoft Defender for Endpoint
• Investigate user accounts in Microsoft Defender for Endpoint
• Configure alert settings in Microsoft 365 Defender
• Explain how the threat landscape is evolving
• Conduct advanced hunting in Microsoft 365 Defender
• Manage incidents in Microsoft 365 Defender
• Explain how Microsoft Defender for Identity can remediate risks in your environment
• Investigate DLP alerts in Microsoft Defender for Cloud Apps
• Explain the types of actions you can take on an insider risk management case
• Configure auto-provisioning in Microsoft Defender for Cloud Apps
• Remediate alerts in Microsoft Defender for Cloud Apps
• Construct KQL statements
• Filter searches based on event time, severity, domain, and other relevant data using KQL
• Extract data from unstructured string fields using KQL
• Manage a Microsoft Sentinel workspace
• Use KQL to access the watchlist in Microsoft Sentinel
• Manage threat indicators in Microsoft Sentinel
• Explain the Common Event Format and Syslog connector differences in Microsoft Sentinel
• Connect Azure Windows Virtual Machines to Microsoft Sentinel
• Configure Log Analytics agent to collect Sysmon events
• Create new analytics rules and queries using the analytics rule wizard
• Create a playbook to automate an incident response
• Use queries to hunt for threats
• Observe threats over time with livestream

Prerequisites
• Basic understanding of Microsoft 365
• Fundamental understanding of Microsoft security, compliance, and identity products
• Intermediate understanding of Windows 10
• Familiarity with Azure services, specifically Azure SQL Database and Azure Storage
• Familiarity with Azure virtual machines and virtual networking
• Basic understanding of scripting concepts.Your course includes:

COURSE OUTLINE

Module 1: Mitigate threats using Microsoft 365 Defender
Analyze threat data across domains and rapidly remediate threats with built-in orchestration and automation in Microsoft 365 Defender. Learn about cybersecurity threats and how the new threat protection tools from Microsoft protect your organization’s users, devices, and data. Use the advanced detection and remediation of identity-based threats to protect your Azure Active Directory identities and applications from compromise.
Lessons
• Introduction to threat protection with Microsoft 365
• Mitigate incidents using Microsoft 365 Defender
• Remediate risks with Microsoft Defender for Office 365
• Microsoft Defender for Identity
• Protect your identities with Azure AD Identity Protection
• Microsoft Defender for Cloud Apps
• Respond to data loss prevention alerts using Microsoft 365
• Manage insider risk in Microsoft 365

Module 2: Mitigate threats using Microsoft Defender for Endpoint
Implement the Microsoft Defender for Endpoint platform to detect, investigate, and respond to advanced threats. Learn how Microsoft Defender for Endpoint can help your organization stay secure. Learn how to deploy the Microsoft Defender for Endpoint environment, including onboarding devices and configuring security. Learn how to investigate incidents and alerts using Microsoft Defender for Endpoint. Perform advanced hunting and consult with threat experts. You will also learn how to configure automation in Microsoft Defender for Endpoint by managing environmental settings. Lastly, you will learn about your environment's weaknesses by using Threat and Vulnerability Management in Microsoft Defender for Endpoint.
Lessons
• Protect against threats with Microsoft Defender for Endpoint
• Deploy the Microsoft Defender for Endpoint environment
• Implement Windows security enhancements
• Perform device investigations
• Perform actions on a device
• Perform evidence and entities investigations
• Configure and manage automation
• Configure for alerts and detections
• Utilize Threat and Vulnerability Management

Module 3: Mitigate threats using Microsoft Defender for Cloud
Use Microsoft Defender for Cloud, for Azure, hybrid cloud, and on-premises workload protection and security. Learn the purpose of Microsoft Defender for Cloud and how to enable it. You will also learn about the protections and detections provided by Microsoft Defender for Cloud for each cloud workload. Learn how you can add Microsoft Defender for Cloud capabilities to your hybrid environment.
Lessons
• Plan for cloud workload protections using Microsoft Defender for Cloud
• Workload protections in Microsoft Defender for Cloud
• Connect Azure assets to Microsoft Defender for Cloud
• Connect non-Azure resources to Microsoft Defender for Cloud
• Remediate security alerts using Microsoft Defender for Cloud

Module 4: Create queries for Microsoft Sentinel using Kusto Query Language (KQL)
Write Kusto Query Language (KQL) statements to query log data to perform detections, analysis, and reporting in Microsoft Sentinel. This module will focus on the most used operators. The example KQL statements will showcase security related table queries. KQL is the query language used to perform analysis on data to create analytics, workbooks, and perform hunting in Microsoft Sentinel. Learn how basic KQL statement structure provides the foundation to build more complex statements. Learn how to summarize and visualize data with a KQL statement provides the foundation to build detections in Microsoft Sentinel. Learn how to use the Kusto Query Language (KQL) to manipulate string data ingested from log sources.
Lessons
• Construct KQL statements for Microsoft Sentinel
• Analyze query results using KQL
• Build multi-table statements using KQL
• Work with string data using KQL statements

Module 5: Configure your Microsoft Sentinel environment
Get started with Microsoft Sentinel by properly configuring the Microsoft Sentinel workspace. Traditional security information and event management (SIEM) systems typically take a long time to set up and configure. They're also not necessarily designed with cloud workloads in mind. Microsoft Sentinel enables you to start getting valuable security insights from your cloud and on-premises data quickly. This module helps you get started. Learn about the architecture of Microsoft Sentinel workspaces to ensure you configure your system to meet your organization's security operations requirements. As a Security Operations Analyst, you must understand the tables, fields, and data ingested in your workspace. Learn how to query the most used data tables in Microsoft Sentinel.
Lessons
• Introduction to Microsoft Sentinel
• Create and manage Microsoft Sentinel workspaces
• Query logs in Microsoft Sentinel
• Use watchlists in Microsoft Sentinel
• Utilize threat intelligence in Microsoft Sentinel

Module 6: Connect logs to Microsoft Sentinel
Connect data at cloud scale across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds to Microsoft Sentinel. The primary approach to connect log data is using the Microsoft Sentinel provided data connectors. This module provides an overview of the available data connectors. You will get to learn about the configuration options and data provided by Microsoft Sentinel connectors for Microsoft 365 Defender.
Lessons
• Connect data to Microsoft Sentinel using data connectors
• Connect Microsoft services to Microsoft Sentinel
• Connect Microsoft 365 Defender to Microsoft Sentinel
• Connect Windows hosts to Microsoft Sentinel
• Connect Common Event Format logs to Microsoft Sentinel
• Connect syslog data sources to Microsoft Sentinel
• Connect threat indicators to Microsoft Sentinel

Module 7: Create detections and perform investigations using Microsoft Sentinel
Detect previously uncovered threats and rapidly remediate threats with built-in orchestration and automation in Microsoft Sentinel. You will learn how to create Microsoft Sentinel playbooks to respond to security threats. You'll investigate Microsoft Sentinel incident management, learn about Microsoft Sentinel events and entities, and discover ways to resolve incidents. You will also learn how to query, visualize, and monitor data in Microsoft Sentinel.
Lessons
• Threat detection with Microsoft Sentinel analytics
• Security incident management in Microsoft Sentinel
• Threat response with Microsoft Sentinel playbooks
• User and entity behavior analytics in Microsoft Sentinel
• Query, visualize, and monitor data in Microsoft Sentinel

Module 8: Perform threat hunting in Microsoft Sentinel
In this module, you'll learn to proactively identify threat behaviors by using Microsoft Sentinel queries. You'll also learn to use bookmarks and livestream to hunt threats. You will also learn how to use notebooks in Microsoft Sentinel for advanced hunting.
Lessons
• Threat hunting concepts in Microsoft Sentinel
• Threat hunting with Microsoft Sentinel
• Hunt for threats using notebooks in Microsoft Sentinel

Remote Learning

This course is available for "remote" learning and will be available to anyone with access to an internet device with a microphone (this includes most models of computers, tablets). Classes will take place with a "Live" instructor at the date/times listed below.

Upon registration, the instructor will send along additional information about how to log-on and participate in the class.

Refund Policy

Cancellation / Reschedule by Student

Because we must schedule rooms, ship course materials, assign instructors and provision computer resources well in advance, it is important students alert us ASAP with any cancel/reschedule requests.

Please note the following policies:

  • If requested 16 or more calendar days before the class
    • Cancellation requests made in this timeframe are eligible for refund less 5% cancellation fee.
    • Reschedule requests made in this timeframe will be accommodated if availability exists and will be processed at no additional charge.
  • If requested 15 calendar days or less before the class
    • Cancellation or Reschedule requests made by the student 15 calendar days or less before the class starts will be charged 100% the course fee and are not entitled to a refund.

Substitutions

  • If you are unable to attend your class, a substitute who meets the course prerequisites may attend in your place at no additional charge for the original class title, date and location. If you cannot find a substitute, you will be subject to the class cancellation policy.

Make-up Policy

Students are permitted one (1) Make-Up opportunity to attend an instructor-led class that was paid for but not previously attended for no additional charge.

  • Make-Up class registrations are subject to availability and are not entitled to refund.
  • Students may not reschedule a Make-up class registration.
  • Any no shows or cancellations forfeit their one Make-up opportunity.

Additionally, ONLC reserves the right to retire courses due to lack of demand. Retired classes are not available for Make-Up.

In the event that an instructor or the school needs to cancel at the last minute, students will receive a refund less a 5% non-refundable registration fee.

In any event where a customer wants to cancel their enrollment and is eligible for a full refund, a 5% processing fee will be deducted from the refund amount.

Reviews of Classes at ONLC Training Centers (7)

Benefits of Booking Through CourseHorse

  • Booking is safe. When you book with us your details are protected by a secure connection.
  • Lowest price guaranteed. Classes on CourseHorse are never marked up.
  • This class will earn you 19950 points. Earn 10% back in reward points!

Questions & Answers (0)

Get quick answers from CourseHorse and past students.

Similar Classes

ONLC Training Centers

ONLC Training Centers was founded in 1983 when Jim Palic and Andy Williamson left their positions as mainframe programmers with the Dupont Company to start one of the industry's first computer training companies.

Over thirty years and still growing, ONLC Training Centers is one of the the largest privately...

Read more about ONLC Training Centers

CourseHorse Approved

This school has been carefully vetted by CourseHorse and is a verified Online educator.

ONLC Training Centers

Give This Course as a Gift Card

  • Thousands of classes
  • No expiration
  • Unique and memorable gifts for any occasion
  • Personalized
  • Explore a passion, gain a new skill, discover a new hobby, engage in a memorable experience
  • Instant delivery
  • Lock in a price with the Inflation Buster Gift Card Price Adjuster™

Buy a Gift Card

Book this Class as a Group Event

Booking this class for a group? Find great private group events

Or see all Professional Group Events

Explore group events and team building activities ranging from cooking, art, escape rooms, trivia, and more.

  • Price Lock Guarantee

    Secure your booking now and we'll match any price drop within 48 hours across all booking platforms, ensuring you never miss out on savings!

  • Earn 10% Reward Points

    Maximize your savings with every purchase. Unlock rewards on every transaction, ensuring you get the most value out of your experience!

  • No Added Fees

    Enjoy hassle-free transactions without worrying about additional charges. With us, what you see is what you pay - no surprises!

  • Curated Courses

    Discover a curated selection of courses handpicked by experts in the field. Dive into quality content that suits your learning needs and interests!

CourseHorse Gift Cards

  • Creative & unique gift for any occasion
  • Thousands of classes & experiences
  • No expiration date
  • Instant e-delivery (or choose a date)
  • Add a personalized message
  • Lock in a price with the Inflation Buster Gift Card Price Adjuster™
Buy a Gift Card
gift card with the CourseHorse logo gift card with the CourseHorse logo
Loading...