Implementing and Administering Microsoft Sentinel
1h 44mIntermediate2023-12-11
Authors
Pete Zerger
Consultant, Author, Speaker, Leader, Microsoft MVP
Course details
Microsoft Sentinel is a next-generation, cloud-native security event and information management (SEIM) system that provides real-time analysis of security alerts generated for your cloud and on-premises resources. By leveraging built-in machine learning from the security analytics experts at Microsoft, Sentinel effectively detects threats while automating threat response using orchestration and built-in or custom security playbooks. In this course, join Pete Zerger as he guides you through the implementation and configuration of Microsoft Sentinel. Discover how to connect key services and threat intelligence resources to Sentinel; investigate cases; create security playbooks to set automated threat responses to issues; and leverage search and query tools to hunt for threats.
Skills covered
Azure SentinelMicrosoft Entra ID (Azure Active Directory)Cloud AdministrationNetwork AdministrationCloud PlatformsNetwork and System AdministrationCloud ComputingMicrosoftOne-Off
Concepts
Introduction
- Need a central point of analysis for security events
- What you should know
- Lab setup
Introduction and Concepts
- Sentinel feature flyover
- Onboarding Microsoft Sentinel
- Kusto query language quickstart
Configuring Microsoft Sentinel
- Connecting Microsoft services
- Connecting external services
- Integrating threat intelligence
Threat Detection, Investigation, and Response
- Detecting threats
- Investigating incidents
- Responding to threats using automation
- Security orchestration, automation, and response (SOAR)
- UEBA and machine learning
Advanced Threat Hunting Scenarios
- Threat hunting basics
- Hunting with bookmarks
- Hunting with notebooks
- Workbooks and dashboards
- Integrating with Microsoft Defender and Purview
Conclusion
- Next steps