الرئيسية/الدورات/أمن Microsoft/SC-200: Defend Against Cyberthreats with Microsoft's Securit…

أمن Microsoft

SC-200: Defend Against Cyberthreats with Microsoft's Security Operations Platform

اكشف التهديدات وحقّق فيها واستجب لها كمحلّل للعمليات الأمنية. خلال 4 أيام تدير الحوادث في بوابة Microsoft Defender

4 أياممتوسط59 وحدةSC-200Microsoft Certified: Security Operations Analyst Associate

نظرة عامة

اكشف التهديدات وحقّق فيها واستجب لها كمحلّل للعمليات الأمنية. خلال 4 أيام تدير الحوادث في بوابة Microsoft Defender، وتحمي البريد والهويات والتطبيقات السحابية بمنتجات Defender وEntra ID Protection، وتوظّف Security Copilot في عملك، وتحقّق في تنبيهات منع تسرّب البيانات والمخاطر الداخلية والتدقيق في Microsoft Purview، استعداداً لامتحان SC-200 وشهادة Security Operations Analyst Associate.

المنهاج

المحتوى التقني أدناه معروضٌ باللغة الإنجليزية كما ورد في منهاج الدورة، حفاظاً على دقّة المصطلحات.

59 وحدة

Explore Extended Detection & Response (XDR) response use cases
Understand Microsoft Defender XDR in a Security Operations Center (SOC)
Explore Microsoft Security Graph
Investigate security incidents in Microsoft Defender XDR
Module assessment

Use the Microsoft Defender portal
Manage incidents
Investigate incidents
Manage and investigate alerts
Manage automated investigations
Use the action center
Explore advanced hunting
Investigate Microsoft Entra sign-in logs
Understand Microsoft Secure Score
Analyze threat analytics
Analyze reports
Configure the Microsoft Defender portal
Module assessment

Automate, investigate, and remediate
Configure, protect, and detect
Simulate attacks

Review identity protection basics
Implement and manage user risk policy
Monitor, investigate, and remediate elevated risky users
Implement security for workload identities
Explore Microsoft Defender for Identity
Module assessment

Configure Microsoft Defender for Identity sensors
Review compromised accounts or data
Integrate with other Microsoft tools

Understand the Defender for Cloud Apps Framework
Explore your cloud apps with Cloud Discovery
Protect your data and apps with Conditional Access App Control
Walk through discovery and access control with Microsoft Defender for Cloud Apps
Classify and protect sensitive information
Detect Threats
Module assessment

Large language models (LLMs)
Prompts
AI agents
Module assessment

Get acquainted with Microsoft Security Copilot
Describe Microsoft Security Copilot terminology
Describe how Microsoft Security Copilot processes prompt requests
Describe the elements of an effective prompt
Describe how to enable Microsoft Security Copilot
Module assessment

Describe the features available in the standalone experience of Microsoft Security Copilot
Describe the features available in a session of the standalone experience
Describe workspaces
Describe the Microsoft plugins available in Microsoft Security Copilot
Describe the non-Microsoft plugins supported by Microsoft Security Copilot
Describe custom promptbooks
Describe knowledge base connections
Module assessment

Describe Copilot in Microsoft Defender XDR
Copilot in Microsoft Purview
Copilot in Microsoft Entra
Copilot in Microsoft Intune
Copilot in Microsoft Defender for Cloud (Preview)
Module assessment

Explore the first run experience
Explore the standalone experience
Explore Security Copilot workspaces
Configure the Microsoft Sentinel plugin
Enable a custom plugin
Explore file uploads as a knowledge base
Create a custom promptbook
Explore the capabilities of Copilot in Microsoft Defender XDR
Explore the capabilities of Copilot in Microsoft Purview
Explore the capabilities of Copilot in Microsoft Entra
Module assessment

Understand data loss prevention (DLP) alerts
Understand the DLP alert lifecycle
Configure DLP policies to generate alerts
Investigate DLP alerts in Microsoft Purview
Investigate DLP alerts in Microsoft Defender XDR
Investigate DLP alerts with Security Copilot and AI agents
Respond to DLP alerts
Module assessment

Understand insider risk alerts and investigations
Manage alert volume in insider risk management
Investigate and triage insider risk alerts in Microsoft Purview
Investigate insider risk alerts with Security Copilot and AI agents
Analyze alert context with the All risk factors tab
Investigate activity details with the Activity explorer tab
Review patterns over time with the User activity tab
Investigate insider risk alerts in Microsoft Defender XDR
Manage and take action on insider risk cases
Module assessment

Microsoft Purview Audit overview
Configure and manage Microsoft Purview Audit
Conduct searches with Audit (Standard)
Audit Microsoft Copilot for Microsoft 365 interactions
Investigate activities with Audit (Premium)
Export audit log data
Configure audit retention with Audit (Premium)
Module assessment

Understand eDiscovery and content search capabilities
Prerequisites for using eDiscovery in Microsoft Purview
Create an eDiscovery search
Conduct an eDiscovery search
Export eDiscovery search results
Module assessment

Practice security administration
Hunt threats within your network

Create your environment
Understand operating systems compatibility and features
Onboard devices
Manage access
Create and manage roles for role-based access control
Configure device groups
Configure environment advanced features
Module assessment

Understand attack surface reduction
Enable attack surface reduction rules
Module assessment

Use the device inventory list
Investigate the device
Use behavioral blocking
Detect devices with device discovery
Module assessment

Explain device actions
Run Microsoft Defender antivirus scan on devices
Collect investigation package from devices
Initiate live response session
Module assessment

Investigate a file
Investigate a user account
Investigate an IP address
Investigate a domain
Module assessment

Configure advanced features
Manage automation upload and folder settings
Configure automated investigation and remediation capabilities
Block at risk devices
Module assessment

Configure advanced features
Configure alert notifications
Manage alert suppression
Manage indicators
Module assessment

Understand vulnerability management
Explore vulnerabilities on your devices
Manage remediation
Module assessment

Explain Microsoft Defender for Cloud
Describe Microsoft Defender for Cloud workload protections
Enable Microsoft Defender for Cloud
Module assessment

Explore and manage your resources with asset inventory
Configure auto provisioning
Manual agent provisioning
Module assessment

Protect non-Azure resources
Connect non-Azure machines
Connect your AWS accounts
Connect your GCP accounts
Module assessment

Explore Secure Score
Explore Recommendations
Measure and enforce regulatory compliance
Understand Workbooks
Module assessment

Understand Microsoft Defender for servers
Understand Microsoft Defender for App Service
Understand Microsoft Defender for Storage
Understand Microsoft Defender for SQL
Understand Microsoft Defender for open-source databases
Understand Microsoft Defender for Key Vault
Understand Microsoft Defender for Resource Manager
Understand Microsoft Defender for DNS
Understand Microsoft Defender for Containers
Understand Microsoft Defender additional protections
Module assessment

Understand security alerts
Remediate alerts and automate responses
Suppress alerts from Defender for Cloud
Generate threat intelligence reports
Respond to alerts from Azure resources
Module assessment

Understand the Kusto Query Language statement structure
Use the search operator
Use the where operator
Use the let statement
Use the extend operator
Use the order by operator
Use the project operators
Module assessment

Use the summarize operator
Use the summarize operator to filter results
Use the summarize operator to prepare data
Use the render operator to create visualizations
Module assessment

Use the union operator
Use the join operator
Module assessment

Extract data from unstructured string fields
Extract data from structured string data
Integrate external data
Create parsers with functions
Module assessment

What is Microsoft Sentinel?
How Microsoft Sentinel works
When to use Microsoft Sentinel
Module assessment

Plan for the Microsoft Sentinel workspace
Create a Microsoft Sentinel workspace
Manage workspaces across tenants using Azure Lighthouse
Understand Microsoft Sentinel permissions and roles
Manage Microsoft Sentinel settings
Configure logs
Module assessment

Query logs in the logs page
Understand Microsoft Sentinel tables
Understand common tables
Understand Microsoft Defender XDR tables
Module assessment

Plan for watchlists
Create a watchlist
Manage watchlists
Module assessment

Define threat intelligence
Manage your threat indicators
View your threat indicators with KQL
Module assessment

Understand the benefits of integrating Microsoft Sentinel with Defender XDR
Explore the capability differences between Microsoft Defender XDR and Microsoft Sentinel portals
Onboarding Microsoft Sentinel to Microsoft Defender XDR
Explore Microsoft Sentinel features in Microsoft Defender XDR
Module assessment

Ingest log data with data connectors
Understand data connector providers
View connected hosts
Module assessment

Plan for Microsoft services connectors
Connect the Microsoft 365 connector
Connect the Microsoft Entra connector
Connect the Microsoft Entra ID Protection connector
Connect the Azure Activity connector
Module assessment

Plan for Microsoft Defender XDR connectors
Connect the Microsoft Defender XDR connector
Connect Microsoft Defender for Cloud connector
Connect Microsoft Defender for IoT
Connect Microsoft Defender legacy connectors
Module assessment

Plan for Windows hosts security events connector
Connect using the Windows Security Events via AMA Connector
Connect using the Security Events via Legacy Agent Connector
Collect Sysmon event logs
Module assessment

Plan for Common Event Format connector
Connect your external solution using the Common Event Format connector
Module assessment

Plan for syslog data collection
Collect data from Linux-based sources using syslog
Configure the Data Collection Rule for Syslog Data Sources
Parse syslog data with KQL
Module assessment

Plan for threat intelligence connectors
Connect the Defender Threat Intelligence connector
Connect the threat intelligence TAXII connector
Connect the threat intelligence Upload API connector
View your threat indicators with KQL
Module assessment

What is Microsoft Sentinel Analytics?
Types of analytics rules
Create an analytics rule from templates
Create an analytics rule from wizard
Manage analytics rules

Understand automation options
Create automation rules
Module assessment

What are Microsoft Sentinel playbooks?
Trigger a playbook in real-time
Run playbooks on demand

Understand incidents
Incident evidence and entities
Incident management

Understand behavioral analytics
Explore entities
Display entity behavior information
Use Anomaly detection analytical rule templates
Module assessment

Understand data normalization
Use ASIM Parsers
Understand parameterized KQL functions
Create an ASIM Parser
Configure Azure Monitor Data Collection Rules
Module assessment

Monitor and visualize data
Query data using Kusto Query Language
Use default Microsoft Sentinel Workbooks
Create a new Microsoft Sentinel Workbook

Use solutions from the content hub
Use repositories for deployment
Module assessment

Understand cybersecurity threat hunts
Develop a hypothesis
Explore MITRE ATT&CK
Module assessment

Explore creation and management of threat-hunting queries
Save key findings with bookmarks
Observe threats over time with livestream

Hunt with a Search Job
Restore historical data
Module assessment

Access Azure Sentinel data with external tools
Hunt with notebooks
Create a notebook
Explore notebook code
Module assessment

لمن هذه الدورة

محلّلو مراكز العمليات الأمنية ومختصو الأمن الذين يحمون بيئات Microsoft 365 وAzure.

قبل أن تبدأ

Basic understanding of Microsoft 365
Fundamental understanding of Microsoft security, compliance, and identity products
Intermediate understanding of Windows 10
Familiarity with Azure services, specifically Azure SQL Database and Azure Storage
Familiarity with Azure virtual machines and virtual networking
Basic understanding of scripting concepts.

الشهادة

الشهادة التي تؤهّلك لها

أمن Microsoft

Microsoft Certified: Security Operations Analyst Associate

SC-200

دورة واحدة

أمن Microsoft

يوم واحد

تفاصيل الدورة ←

لنرسم خطوتك التالية معاً.

أخبرنا بالدورة أو الشهادة التي تهمّك، ونرسل لك المنهاج والمواعيد القادمة والرسوم وخيارات التدريب الخاص لفريقك.

تحدّث إلى مستشار ←واتساب