Planning and implementing Microsoft Sentinel (SIEM & SOAR)
- Référence M55610A
- Durée 3 jour(s)
Modalité pédagogique
Aller à:
Modalité pédagogique
La formation est disponible dans les formats suivants:
-
Classe inter à distance
Depuis n'importe quelle salle équipée d'une connexion internet, rejoignez la classe de formation délivrée en inter-entreprises.
-
Classe inter en présentiel
Formation délivrée en inter-entreprises. Cette méthode d'apprentissage permet l'interactivité entre le formateur et les participants en classe.
-
Intra-entreprise
Cette formation est délivrable en groupe privé, et adaptable selon les besoins de l’entreprise. Nous consulter.
Demander cette formation dans un format différent
Résumé
Haut de pageThis 3 day hands on course helps you get ramped up with Microsoft Sentinel and provide hands-on practical experience for product features, capabilities, and scenarios.
During the course you will deploy a Microsoft Sentinel workspace and ingest pre-recorded data to simulate scenarios that showcase various Microsoft Sentinel features.
Updated July 2026
Company Events
These events can be delivered exclusively for your company at our locations or yours, specifically for your delegates and your needs. The Company Events can be tailored or standard course deliveries.
Prochaines dates
Haut de pagePublic
Haut de pageThis course is aimed at IT professionals and Azure administrators that have some experience administering and configuring Azure, but want to gain an insight into implementing Microsoft’s SIEM/SOAR solution, Microsoft Sentinel.
Objectifs de la formation
Haut de pageThis course covers the following topics:
- Overview of Microsoft Sentinel
- KQL
- Data Connectors
- Analytics Rules
- Incident Management
- Hunting
- Watchlists
- Threat Intelligence
Programme détaillé
Haut de pageModule 1: Overview of Microsoft Sentinel
- Overview of Microsoft Sentinel
- Data ingestion methods
- Microsoft Sentinel for MSSPs
- User and Entity Behaviour Analytics
- Fusion
- Notebooks
- Management & Automation Tools
- Logs & Costs
Module 2: KQL
- Importance of KQL across Azure
- The User Interface (demo)
- The standard KQL Structure
- Common KQL Commands
Module 3: Data Connectors
- Manage content in Microsoft Sentinel
- Connect data to Microsoft Sentinel using data connectors
- Connect Microsoft services to Microsoft Sentinel
- Connect Microsoft 365 Defender to Microsoft Sentinel
- Connect Windows hosts to Microsoft Sentinel
- Connect Common Event Format logs to Microsoft Sentinel
- Connect syslog data sources to Microsoft Sentinel
- Connect threat indicators to Microsoft Sentinel
Module 4 – Analytics Rules
- Threat detection with Microsoft Sentinel analytics
- Automation in Microsoft Sentinel
- Threat response with Microsoft Sentinel playbooks
Module 5 – Incident Management
- Incident management Overview
- User and Entity Behaviour Analytics
- Data normalization in Microsoft Sentinel
- Query, visualize, and monitor data
Module 6 – Hunting
- Threat hunting concepts
- Threat hunting with Microsoft Sentinel
- Use Search jobs in Microsoft Sentinel
- Hunt for threats using notebooks
Module 7 – Watchlists
- Prioritize incidents
- Import business data
- Reduce Alert Fatigue
- Enrich Event Data
Module 8 – Threat Intelligence
- Threat Intelligence Overview
- Threat Intelligence in Microsoft Sentinel
Pré-requis
Haut de pageCandidates should have foundational knowledge of Azure administration and basic experience with security operations concepts. Familiarity with Microsoft Azure services and networking concepts is recommended
