SC-5001 Configure SIEM security operations using Microsoft Sentinel

Introduction:

Get started with Microsoft Sentinel security operations by configuring the Microsoft Sentinel workspace, connecting Microsoft services and Windows security events to Microsoft Sentinel, configuring Microsoft Sentinel analytics rules, and responding to threats with automated responses.

Objectives:

Course Outline:

1 – Create and manage Microsoft Sentinel workspaces

Plan for the Microsoft Sentinel workspace
Create a Microsoft Sentinel workspace
Manage workspaces across tenants using Azure Lighthouse
Understand Microsoft Sentinel permissions and roles
Manage Microsoft Sentinel settings
Configure logs

2 – Connect Microsoft services to Microsoft Sentinel

Plan for Microsoft services connectors
Connect the Microsoft Office 365 connector
Connect the Microsoft Entra connector
Connect the Microsoft Entra ID Protection connector
Connect the Azure Activity connector

3 – Connect Windows hosts to Microsoft Sentinel

Plan for Windows hosts security events connector
Connect using the Windows Security Events via AMA Connector
Connect using the Security Events via Legacy Agent Connector
Collect Sysmon event logs

4 – Threat detection with Microsoft Sentinel analytics

What is Microsoft Sentinel Analytics?
Types of analytics rules
Create an analytics rule from templates
Create an analytics rule from wizard
Manage analytics rules

5 – Automation in Microsoft Sentinel

Understand automation options
Create automation rules

6 – Configure SIEM security operations using Microsoft Sentinel

Enroll in this course

$695.00

Select a start date for your 1 Day course

EventDates

2024-08-02 09:00:00_2024-08-02 17:00:00
2024-10-10 09:00:00_2024-10-10 17:00:00
2024-12-09 09:00:00_2024-12-09 17:00:00

Clear

Questions About This Course?

Need Help Finding The Right Training Solution?

Our training advisors are here for you.