Overview
Master Microsoft Sentinel's security capabilities through hands-on experience with incident management, analytics rules, and automation. Learn to integrate data sources, utilize AI tools, and implement threat hunting for enhanced Azure protection.
Syllabus
-
- Introduction
-- In this module, we will set the stage for your learning journey into Microsoft Sentinel. You will be introduced to the course content, the structure of the lessons, and the role of the instructor. Additionally, you will gain a fundamental understanding of Microsoft Sentinel and its significance in the context of Azure security.
- Create and Manage Microsoft Sentinel
-- In this module, we will guide you through the steps required to create an Azure account and set up a resource group, which is essential for managing Microsoft Sentinel. You will also learn how to configure critical components like Log Analytics workspaces and Sentinel instances, while gaining insights into its main features like incident management, analytics rules, and automation.
- Data Connectors
-- In this module, we will explore how to configure data connectors in Microsoft Sentinel to integrate and collect data from various sources. You will learn to leverage the Content Hub for enhanced monitoring, and gain practical skills in integrating threat intelligence feeds to improve threat detection capabilities.
- Analytics Rule
-- In this module, we will introduce you to the analytics rules feature in Microsoft Sentinel. You will learn how to create custom analytics rules to automate threat detection and delve into advanced concepts such as multistage attack detection to enhance your security monitoring strategies.
- Incident Management
-- In this module, we will walk you through the incident management workflow in Microsoft Sentinel. You will learn how to trigger and investigate security incidents using tools like the Incident Dashboard and Investigation Map and understand how to draw conclusions from incidents to ensure timely and effective responses.
- Threat Hunting
-- In this module, we will introduce you to the practice of threat hunting in Microsoft Sentinel. You will learn how to use specialized dashboards and tools to actively search for threats and investigate known incidents, like SolarWinds, to understand how to identify potential vulnerabilities and compromised systems.
- Watchlists
-- In this module, we will teach you how to leverage Watchlists in Microsoft Sentinel to monitor specific entities and mitigate false positives in threat detection. You will learn how to create, update, and manage Watchlists, and use whitelisting techniques to improve the efficiency of your security monitoring.
- Workbooks
-- In this module, we will explore the role of workbooks in Microsoft Sentinel. You will learn how to create custom workbooks for visualizing security data, enabling you to analyze and report incidents and trends effectively to support decision-making.
- Automation
-- In this module, we will introduce you to Microsoft Sentinel's automation capabilities. You will learn how to create automation rules, streamline incident responses, and use the Playbook Designer to build custom workflows that integrate with your security processes.
- Microsoft Sentinel with ChatGPT
-- In this module, we will explore how to integrate ChatGPT with Microsoft Sentinel to enhance cybersecurity operations. You will learn to create playbooks, assign permissions, and automate SIEM workflows using AI-driven insights, enabling more efficient security management.
- Other Concepts
-- In this module, we will cover additional concepts within Microsoft Sentinel, including the Threat Intelligence Dashboard and Sentinel LightHouse. You will also dive into advanced analytical tools like Jupyter Notebooks and Kusto Query Language (KQL) to perform in-depth data analysis and custom queries.
- Conclusion
-- In this module, we will guide you through the process of deleting a Microsoft Sentinel environment for proper resource management. You will also receive final thoughts on the course and be encouraged to take the next steps in your cybersecurity learning journey.
Taught by
Tags
On-Demand
