You're reading from Microsoft Security Operations Analyst Exam Ref SC-200 Certification Guide Manage, monitor, and respond to threats using Microsoft Security Stack for securing IT systems

Product type Paperback

Published in Mar 2022

Publisher Packt

ISBN-13 9781803231891

Length 288 pages

Edition 1st Edition

Tools

Microsoft Sentinel

Concepts

Cybersecurity

Authors (2):

Trevor Stuart

Joe Anich

View More author details

Table of Contents (19) Chapters

Preface

1. Section 1 – Exam Overview and Evolution of Security Operations

2. Chapter 1: Preparing for Your Microsoft Exam and SC-200 Objectives FREE CHAPTER

3. Chapter 2: The Evolution of Security and Security Operations

4. Section 2 – Implementing Microsoft 365 Defender Solutions

5. Chapter 3: Implementing Microsoft Defender for Endpoint

6. Chapter 4: Implementing Microsoft Defender for Identity

7. Chapter 5: Understanding and Implementing Microsoft Defender for Cloud (Microsoft Defender for Cloud Standard Tier)

8. Section 3 – Familiarizing Yourself with Alerts, Incidents, Evidence, and Dashboards

9. Chapter 6: An Overview: Microsoft Defender for Endpoint Alerts, Incidents, Evidence, and Dashboards

10. Chapter 7: Microsoft Defender for Identity, What Happened, Alerts, and Incidents

11. Chapter 8: Microsoft Defender for Office – Threats to Productivity

12. Chapter 9: Microsoft Defender for Cloud Apps and Protecting Your Cloud Apps

13. Section 4 – Setting Up and Connecting Data Sources to Microsoft Sentinel

14. Chapter 10: Setting Up and Configuring Microsoft Sentinel

15. Section 5 – Hunting Threats within Microsoft 365 Defender and Microsoft Sentinel

16. Chapter 11: Advanced Threat Hunting, Microsoft 365 Defender Portal, and Sentinel

17. Chapter 12: Knowledge Check

18. Other Books You May Enjoy

Chapter 11: Advanced Threat Hunting, Microsoft 365 Defender Portal, and Sentinel

To me, advanced threat hunting is one of the most exciting parts of the Microsoft 365 (M365) Defender portal as it involves diving into data with Kusto – I mean, that's what we all came for, right? I'm kidding, but seriously, I could spend all day learning queries to pull what I want, learning what data is there as a whole, and figuring out what's normal and what's not.

We have lots planned for this chapter, including covering higher-level areas such as the basics of Kusto queries, advanced hunting in the M365 Defender portal and Microsoft Sentinel, and leveraging some of its additional hunting features, such as Livestream, notebooks, and bookmarks. The focus is to make sure you have what you need for the exam, but at the same time, we've been trying to provide more than that so that you can be as successful as possible in the real world as you get started in the M365...

The rest of the chapter is locked

You're reading from Microsoft Security Operations Analyst Exam Ref SC-200 Certification Guide Manage, monitor, and respond to threats using Microsoft Security Stack for securing IT systems

Table of Contents (19) Chapters

Chapter 11: Advanced Threat Hunting, Microsoft 365 Defender Portal, and Sentinel

Unlock this book and the full library FREE for 7 days

Authors (2)

Personalised recommendations for you