Module 1 : Create and manage Microsoft Sentinel workspaces

Learn about the architecture of Microsoft Sentinel workspaces to ensure you configure your system to meet your organization's security operations requirements.

• • Introduction
• • Plan for the Microsoft Sentinel workspace
• • Create a Microsoft Sentinel workspace
• • Manage workspaces across tenants using Azure Lighthouse
• • Understand Microsoft Sentinel permissions and roles
• • Manage Microsoft Sentinel settings
• • Configure logs
• • Knowledge check
• • Summary and resources

Module 2: Connect Microsoft services to Microsoft Sentinel

• • Learn how to connect Microsoft 365 and Azure service logs to Microsoft Sentinel.
• • Introduction
• • Plan for Microsoft services connectors
• • Connect the Microsoft Office 365 connector
• • Connect the Microsoft Entra connector
• • Connect the Microsoft Entra ID Protection connector
• • Connect the Azure Activity connector
• • Knowledge check
• • Summary and resources

Module 3: Connect Windows hosts to Microsoft Sentinel

One of the most common logs to collect is Windows security events. Learn how Microsoft Sentinel makes this easy with the Security Events connector.

• • Introduction
• • Plan for Windows hosts security events connector
• • Connect using the Windows Security Events via AMA Connector
• • Connect using the Security Events via Legacy Agent Connector
• • Collect Sysmon event logs
• • Knowledge check
• • Summary and resources

Module 4: Threat detection with Microsoft Sentinel analytics

In this module, you learned how Microsoft Sentinel Analytics can help the SecOps team identify and stop cyber attacks.

• • Introduction
• • Exercise - Detect threats with Microsoft Sentinel analytics
• • What is Microsoft Sentinel Analytics?
• • Types of analytics rules
• • Create an analytics rule from templates
• • Create an analytics rule from wizard
• • Manage analytics rules
• • Exercise - Detect threats with Microsoft Sentinel analytics
• • Summary

Module 5: Automation in Microsoft Sentinel

By the end of this module, you'll be able to use automation rules in Microsoft Sentinel to automated incident management.

• • Introduction
• • Understand automation options
• • Create automation rules
• • Knowledge check
• • Summary and resources

Module 6: Configure SIEM security operations using Microsoft Sentinel

In this module, you learned how to configure SIEM security operations using Microsoft Sentinel.

• • Introduction
• • Exercise - Configure SIEM operations using Microsoft Sentinel
• • Exercise - Install Microsoft Sentinel Content Hub solutions and data connectors
• • Exercise - Configure a data connector Data Collection Rule
• • Exercise - Perform a simulated attack to validate the Analytic and Automation rules
• • Summary