Category: SC-200

Section 15 – Hunt for threats using Microsoft Sentinel

Harri Jaakkonen
Posted by Harri Jaakkonen Posted on 24/09/2023 0 Comments on Section 15 – Hunt for threats using Microsoft Sentinel
Posted in Azure, Microsoft Sentinel, SC-200, Security, Study guide

Create custom hunting queries Like stated in the last part, all Gallery content has been Centralized to Content hub. You will see the following notification under Custom hunting rules. https://learn.microsoft.com/en-us/azure/sentinel/sentinel-content-centralize If you need inspiration based on MITRE Framework for your…

Continue Reading Section 15 – Hunt for threats using Microsoft Sentinel

Section 14 – Use Microsoft Sentinel workbooks to analyze and interpret data

Harri Jaakkonen
Posted by Harri Jaakkonen Posted on 17/09/2023 0 Comments on Section 14 – Use Microsoft Sentinel workbooks to analyze and interpret data
Posted in Azure, KQL, Microsoft Sentinel, SC-200, Security, Study guide

Activate and customize Microsoft Sentinel workbook templates When we are talking about templates, it’s important to see the following information, you will see this inside your Sentinel workspace. Once you Click on Continue, it will start the migration and show…

Continue Reading Section 14 – Use Microsoft Sentinel workbooks to analyze and interpret data

Section 13 – Mitigate threats using Microsoft Sentinel – Manage Microsoft Sentinel incidents

Harri Jaakkonen
Posted by Harri Jaakkonen Posted on 08/09/2023 0 Comments on Section 13 – Mitigate threats using Microsoft Sentinel – Manage Microsoft Sentinel incidents
Posted in Azure, Microsoft Sentinel, SC-200

Triage incidents in Microsoft Sentinel What is Triaging? The SOC’s initial level is triaging. Triaging incoming security situations and assessing their seriousness are the responsibilities of Tier 1 employees. This entails figuring out the incident’s origin, estimating its size, and…

Continue Reading Section 13 – Mitigate threats using Microsoft Sentinel – Manage Microsoft Sentinel incidents

Section 13 – Mitigate threats using Microsoft Sentinel – Configure Security Orchestration, Automation, and Response (SOAR)

Harri Jaakkonen
Posted by Harri Jaakkonen Posted on 11/06/2023 0 Comments on Section 13 – Mitigate threats using Microsoft Sentinel – Configure Security Orchestration, Automation, and Response (SOAR)
Posted in Azure, Defender, Identity, Microsoft Sentinel, SC-200, Security, Study guide

13th section starting and this time were are learning on automation, alerts and remediation. Configure automation rules By centrally managing automation rules for event management, users may streamline complicated incident orchestration procedures. Automation rules are triggered by the creation of…

Continue Reading Section 13 – Mitigate threats using Microsoft Sentinel – Configure Security Orchestration, Automation, and Response (SOAR)

Section 12 – Mitigate threats using Microsoft Sentinel – Perform data classification and normalization

Harri Jaakkonen
Posted by Harri Jaakkonen Posted on 28/05/2023 0 Comments on Section 12 – Mitigate threats using Microsoft Sentinel – Perform data classification and normalization
Posted in Azure, Azure Firewall, GitHub, KQL, Microsoft Sentinel, SC-200, Study guide

12th section starting with more Sentinel. This time we are classifying Entities, creating custom log in Log Analytics and parsing the content. So let’s do some designs and configurations. Classify and analyze data by using entities You can do the…

Continue Reading Section 12 – Mitigate threats using Microsoft Sentinel – Perform data classification and normalization

Section 11 – Mitigate threats using Microsoft Sentinel – Manage Microsoft Sentinel analytics rules

Harri Jaakkonen
Posted by Harri Jaakkonen Posted on 21/05/2023 0 Comments on Section 11 – Mitigate threats using Microsoft Sentinel – Manage Microsoft Sentinel analytics rules
Posted in Azure, Microsoft Sentinel, SC-200, Security, Study guide

11th section starting with more and more Sentinel. Already in this series we saw that how the different pieces are connected and helping you SOC teams to proactively work on threats. So let’s do some designs and configurations. Design and…

Continue Reading Section 11 – Mitigate threats using Microsoft Sentinel – Manage Microsoft Sentinel analytics rules

Section 10 – Mitigate threats using Microsoft Sentinel – Plan and implement the use of data connectors for ingestion of data sources

Harri Jaakkonen
Posted by Harri Jaakkonen Posted on 07/05/2023 0 Comments on Section 10 – Mitigate threats using Microsoft Sentinel – Plan and implement the use of data connectors for ingestion of data sources
Posted in Azure, Azure ARC, Azure Policy, Defender, Identity, Microsoft Sentinel, SC-200, Security, Study guide

And in this 10th section on my SC-200 study guide we will go through the following topics. Identify data sources to be ingested for Microsoft Sentinel On August 31, 2024, the Log Analytics agent is deprecated. You should begin preparing…

Continue Reading Section 10 – Mitigate threats using Microsoft Sentinel – Plan and implement the use of data connectors for ingestion of data sources

Section 9 – Mitigate threats using Microsoft Sentinel – Design and configure a Microsoft Sentinel workspace

Harri Jaakkonen
Posted by Harri Jaakkonen Posted on 30/04/2023 0 Comments on Section 9 – Mitigate threats using Microsoft Sentinel – Design and configure a Microsoft Sentinel workspace
Posted in Azure, Defender, SC-200, Security, Study guide

We are already at the 9th section on my study guide and this time we will start with Sentinel. First I want to point the Ninja training that Ofer Shezaf’s and him team has made for you. It was updated…

Continue Reading Section 9 – Mitigate threats using Microsoft Sentinel – Design and configure a Microsoft Sentinel workspace

Section 8.2 – Mitigate threats using Microsoft Defender for Cloud – Configure and respond to alerts and incidents in Microsoft Defender for Cloud

Harri Jaakkonen
Posted by Harri Jaakkonen Posted on 23/04/2023 0 Comments on Section 8.2 – Mitigate threats using Microsoft Defender for Cloud – Configure and respond to alerts and incidents in Microsoft Defender for Cloud
Posted in Azure, Defender, Identity, SC-200, Security, Study guide

And this is the second part of 8th section on my study guide and today we are looking at recommendations and the alerts and incidents it will create. Again by apologies to all that had to wait as I cut…

Continue Reading Section 8.2 – Mitigate threats using Microsoft Defender for Cloud – Configure and respond to alerts and incidents in Microsoft Defender for Cloud

Section 8.1 – Mitigate threats using Microsoft Defender for Cloud – Configure and respond to alerts and incidents in Microsoft Defender for Cloud

Harri Jaakkonen
Posted by Harri Jaakkonen Posted on 16/04/2023 0 Comments on Section 8.1 – Mitigate threats using Microsoft Defender for Cloud – Configure and respond to alerts and incidents in Microsoft Defender for Cloud
Posted in Azure, Defender, SC-200, Security, Study guide

Already in the 8th section on my study guide and today we are looking alerts, automation workflows and remediations. And because this is an huge section to cover, I will cut it in two different posts, my apologies for the…

Continue Reading Section 8.1 – Mitigate threats using Microsoft Defender for Cloud – Configure and respond to alerts and incidents in Microsoft Defender for Cloud