SC-200: Create detections and perform investigations using Microsoft Sentinel

  • Learning Path
  • 8 Modules

At a glance

Detect previously uncovered threats and rapidly remediate threats with built-in orchestration and automation in Microsoft Sentinel. This learning path aligns with Exam SC-200: Security Operation Analyst.

Prerequisites

  • Understand how to use KQL in Microsoft Sentinel like you could learn from learning path SC-200: Create queries for Microsoft Sentinel using Kusto Query Language (KQL)
  • Understand how data is connected to Microsoft Sentinel like you could learn from learning path SC-200: Connect logs to Microsoft Sentinel

Modules in this learning path

Threat detection with Microsoft Sentinel analytics

In this module, you learned how Microsoft Sentinel Analytics can help the SecOps team identify and stop cyber attacks.

Automation in Microsoft Sentinel

By the end of this module, you'll be able to use automation rules in Microsoft Sentinel to automated incident management.

Threat response with Microsoft Sentinel playbooks

This module describes how to create Microsoft Sentinel playbooks to respond to security threats.

Security incident management in Microsoft Sentinel

Learn about security incidents, incident evidence and entities, incident management, and how to use Microsoft Sentinel to handle incidents.

Identify threats with Behavioral Analytics

Learn how to use entity behavior analytics in Microsoft Sentinel to identify threats inside your organization.

Data normalization in Microsoft Sentinel

By the end of this module, you're able to use Advanced Security Information Model (ASIM) parsers to identify threats inside your organization.

Query, visualize, and monitor data in Microsoft Sentinel

This module describes how to query, visualize, and monitor data in Microsoft Sentinel.

Manage content in Microsoft Sentinel

By the end of this module, you'll be able to manage content in Microsoft Sentinel.