Microsoft Security Operations Analyst Training
This course trains security professionals to investigate, respond to, and hunt for threats using Microsoft's primary security tools: Microsoft Sentinel (SIEM/SOAR), Microsoft Defender XDR, and Microsoft Defender for Cloud. You will master Kusto Query Language (KQL) for detection and reporting, and learn to reduce organizational risk by rapidly remediating active attacks and advising on improvements to threat protection practices.
Microsoft Security Operations Analyst (SC-200)
Course Overview
- Mitigate threats across endpoints, identity, email, and cloud apps using the Microsoft Defender XDR suite.
- Configure and utilize Microsoft Sentinel (SIEM) for log ingestion, alert creation, and incident investigation.
- Perform advanced threat hunting using Kusto Query Language (KQL) and specialized Sentinel tools.
- Manage and mitigate risks related to information protection, data loss, and insider threats using Microsoft Purview.
- Understand and utilize Microsoft Security Copilot for faster threat analysis and response leveraging Generative AI.
Course Outline
- Module 1: Mitigate threats using Microsoft Defender XDR
- Introduction to Microsoft Defender XDR threat protection
- Mitigate incidents using Microsoft Defender
- Remediate risks with Microsoft Defender for Office 365
- Manage Microsoft Entra Identity Protection
- Safeguard your environment with Microsoft Defender for Identity
- Secure your cloud apps and services with Microsoft Defender for Cloud Apps
- Module 2: Mitigate threats using Microsoft Security Copilot
- Fundamentals of Generative AI
- Describe Microsoft Security Copilot
- Describe the core features of Microsoft Security Copilot
- Describe the embedded experiences of Microsoft Security Copilot
- Explore use cases of Microsoft Security Copilot
- Module 3: Mitigate threats using Microsoft Purview
- Respond to data loss prevention alerts using Microsoft 365
- Manage insider risk in Microsoft Purview
- Search and investigate with Microsoft Purview Audit
- Investigate threats with Content search in Microsoft Purview
- Module 4: Mitigate threats using Microsoft Defender for Endpoint
- Protect against threats with Microsoft Defender for Endpoint
- Deploy the Microsoft Defender for Endpoint environment
- Implement Windows security enhancements with Microsoft Defender for Endpoint
- Perform device investigations in Microsoft Defender for Endpoint
- Perform actions on a device using Microsoft Defender for Endpoint
- Perform evidence and entities investigations
- Configure and manage automation
- Configure alerts and detections
- Utilize Vulnerability Management
- Module 5: Mitigate threats using Microsoft Defender for Cloud
- Plan for cloud workload protections
- Connect Azure assets to Microsoft Defender for Cloud
- Connect non-Azure resources
- Manage cloud security posture
- Explain cloud workload protections
- Remediate security alerts
- Module 6: Create queries for Microsoft Sentinel using KQL
- Construct KQL statements
- Analyze query results
- Build multi-table statements
- Work with data in Microsoft Sentinel using KQL
- Module 7: Configure your Microsoft Sentinel environment
- Introduction to Microsoft Sentinel
- Create and manage Sentinel workspaces
- Query logs
- Use watchlists
- Utilize threat intelligence
- Integrate Microsoft Defender XDR with Sentinel
- Module 8: Connect logs to Microsoft Sentinel
- Connect data using data connectors
- Connect Microsoft services
- Connect Microsoft Defender XDR
- Connect Windows hosts
- Connect Common Event Format logs
- Connect syslog data sources
- Connect threat indicators
- Module 9: Create detections and perform investigations using Microsoft Sentinel
- Threat detection with analytics
- Automation in Sentinel
- Threat response with playbooks
- Security incident management
- Identify threats with Behavioral Analytics
- Data normalization in Microsoft Sentinel
- Query, visualize, and monitor data in Microsoft Sentinel
- Manage content in Microsoft Sentinel
- Module 10: Perform threat hunting in Microsoft Sentinel
- Explain threat hunting concepts in Microsoft Sentinel
- Threat hunting with Microsoft Sentinel
- Use Search jobs in Microsoft Sentinel
- Hunt for threats using notebooks in Microsoft Sentinel
Intended Audience
Security Operations Analysts, Security Engineers, and other professionals focused on threat management, monitoring, and incident response within the Microsoft security ecosystem.
Prerequisites
- Microsoft Azure
- Microsoft 365 services and workloads
- Active Directory Domain Services (AD DS)
- PowerShell and Kusto Query Language (KQL)
Follow-On Courses
Related training topics
Justify your training
Use this sample request letter — copy it into an email to your manager and personalize the bracketed details to make the case for the time and budget.
Sample training request letter
Subject: Request for Defensive Cyber & Blue Teaming training from Applied Technology Academy
[Decision Maker Name],
I'm writing to request time and budget approval to complete Applied Technology Academy's course, Microsoft Security Operations Analyst Training. The information below outlines how this training benefits our organization, the tasks I'll be able to perform after completing it, and relevant cost and funding details.
Course Description
This course trains security professionals to investigate, respond to, and hunt for threats using Microsoft's primary security tools: Microsoft Sentinel (SIEM/SOAR), Microsoft Defender XDR, and Microsoft Defender for Cloud. You will master Kusto Query Language (KQL) for detection and reporting, and learn to reduce organizational risk by rapidly remediating active attacks and advising on improvements to threat protection practices. Applied Technology Academy is an award-winning, SBA-certified woman-owned training provider (est. 2008) whose instructors are active practitioners; the course is hands-on with virtual labs and a learn-by-doing methodology.
Course Objectives
Once I've completed the course, I'll have hands-on, job-ready skills in defensive cyber & blue teaming that I can apply immediately to our work.
Expected Organizational Benefits
After completing this course, I will be better equipped to apply these skills directly to our projects, reduce our reliance on outside expertise, strengthen our team's capabilities, and share what I learn with colleagues.
Expected Cost & Funding
Course fee: [request an itemized quote at the link below]. Applied Technology Academy supports multiple funding paths that may reduce or cover this cost: GSA MAS purchasing and government purchase orders, military credentialing funding (Army CA, AF COOL, CG COOL), VA GI Bill and VR&E, ATA Flexible Spending, and student financing. Private team cohorts are available if colleagues should attend with me.
Conclusion
This training provides practical, hands-on experience I can apply immediately to strengthen our work in defensive cyber & blue teaming. Additional course information is available at https://appliedtechnologyacademy.com/microsoft-training/microsoft-security-operations-analyst-training/.
Thank you for your consideration,
[Your Name]
Related Defensive Cyber & Blue Teaming courses
Design training around your team, not the other way around.
Talk to a training advisor about private cohorts, funding paths and program management.