Microsoft Sentinel course with hands on sims for beginners

Overview

Learn how to expertly administer Microsoft Sentinel (including SOAR and SIEM) with hands on experience! What you'll learn:

Learn the concepts and perform hands on activities needed to master Microsoft Sentinel (SOAR and SIEM)Gain a tremendous amount of knowledge involving Microsoft Sentinel (SOAR and SIEM)Learn using hands on simulations on how to manage Microsoft Sentinel (SOAR and SIEM)Learn how to set up your own test lab for practicing the concepts!

We really hope you'll agree, this training is way more than the average course on Udemy! Have access to the following:

Training from an instructor of over 20 years who has trained thousands of people and also a Microsoft Certified TrainerLecture that explains the concepts in an easy to learn method for someone that is just starting out with this materialInstructor led hands on and simulations to practice that can be followed even if you have little to no experienceTOPICS COVEREDINCLUDINGHANDSONLECTUREANDPRACTICETUTORIALS:

IntroductionWelcome to the courseUnderstanding the Microsoft EnvironmentFoundations of Active Directory DomainsFoundations of RAS, DMZ, and VirtualizationFoundations of the Microsoft Cloud ServicesDONT SKIP:

The first thing to know about Microsoft cloud servicesDONT SKIP:

Azure AD is now renamed to Entra IDQuestions for John ChristopherPerforming hands on activitiesDONT SKIP:

Using Assignments in the courseCreating a free Microsoft 365 AccountGetting your free Azure creditUnderstanding and setting up a Microsoft Sentinel WorkspaceOverview of Microsoft SentinelConfiguring a Microsoft Sentinel workspaceManaging roles regarding SentinelManaging log types, log retention, and data storage in SentinelWorking with data connectors and ingestion in Microsoft SentinelMicrosoft Sentinel data source identificationSetting up connectors for ingesting data into Microsoft SentinelConnecting Sentinel with Microsoft 365 Defender and Defender for CloudCommon Event Format (CEF) and Syslog event collectionsWindows Security Event Collection setup in Microsoft SentinelManaging threat intelligence connectors in Microsoft SentinelWorking with custom log tablesUsing analytics rules in Microsoft SentinelUnderstanding analytics rules in Microsoft SentinelFusion rule configurationSecurity analytics rulesWorking with scheduled query rules in Microsoft SentinelCustom scheduled query rulesWorking with near-real-time (NRT) analytics rulesContent hub analytics rulesWatchlists in Microsoft SentinelThreat indicators in Microsoft SentinelClassification, normalization & security orchestration automated response (SOAR)Working with using entities for classifying and analyzing dataAdvanced Security Information Model(ASIM) queries with Microsoft SentinelASIM parser managementUsing automation rulesUsing playbooks in Microsoft SentinelAutomation rule triggering using analytic rulesAlert and incident playbook triggeringDealing with Incidents and Workbooks for analyzes and interpretation of dataIncident generation in Microsoft SentinelUnderstanding the concepts of triaging incidents in SentinelMicrosoft Sentinel incident investigationHow to respond to Microsoft Sentinel incidentsMulti-workspace incident investigationWorkbook template customization and managementImplementing custom workbooks in Microsoft SentinelWorking with advanced visualizationsThreat hunting and entity behavior analytics in Microsoft SentinelMITRE ATT&CK attack vectors in Microsoft SentinelUsing hunting queries from the content galleryHunting query customizationData investigations with hunting bookmarksUsing Livestream to monitor hunting queriesHow archived log data can be retrieved in Microsoft SentinelSearch job management in Microsoft SentinelEntity Behavior Analytics settingsEntity page investigation of threatsAnomaly detection analytics rules in Microsoft SentinelConclusionCleaning up your lab environmentGetting a Udemy certificateBONUS Where do I go from here?

Syllabus

• Introduction to Microsoft Sentinel
Overview of Cloud Security and SIEM
Understanding Microsoft Sentinel Architecture
Introduction to Key Features and Capabilities
• Setting Up Microsoft Sentinel
Getting Started with Azure Portal
Provisioning Microsoft Sentinel
Connecting Data Sources
• Data Collection and Management
Configuring Data Connectors
Normalizing and Analyzing Ingested Data
Understanding Log Analytics
• Writing and Managing Log Queries
Introduction to Kusto Query Language (KQL)
Writing Basic Queries
Advanced Query Techniques
• Creating and Managing Incidents
Understanding the Incident Lifecycle
Configuring Alert Rules
Using Automation to Enhance Incident Response
• Threat Detection and Response
Deploying Analytics Rules
Leveraging Machine Learning for Security Operations
Creating Hunting Queries
• Hands-On Simulations
Real-World Case Study Simulation
Interactive Labs: Simulating Threat Detection
Incident Management Simulation
• Integrating Microsoft Sentinel with Other Tools
Connecting with Azure Security Center
Integrating Third-Party Security Solutions
Leveraging APIs for Advanced Integration
• Monitoring and Optimizing Sentinel
Developing Monitoring Dashboards
Analyzing and Optimizing Performance
Understanding Cost Management
• Course Wrap-up
Best Practices in Security Operations
Final Project: Implementing Microsoft Sentinel in a Mock Environment
Resources and Next Steps for Continuous Learning

Taught by

John Christopher

Subjects

Information Security (InfoSec)