Microsoft Security
SC-5001 Configure SIEM security operations using Microsoft Sentinel
Stand up a working SIEM in a single day.
1 dayIntermediate6 modulesSC-5001
About this course
Stand up a working SIEM in a single day. You will plan and create a Microsoft Sentinel workspace, connect Microsoft 365, Microsoft Entra and Windows hosts through data connectors, build analytics rules from templates to detect threats and automate your response, then bring it all together in a hands-on exercise.
Curriculum
6 modules
- Plan for the Microsoft Sentinel workspace
- Create a Microsoft Sentinel workspace
- Manage workspaces across tenants using Azure Lighthouse
- Understand Microsoft Sentinel permissions and roles
- Manage Microsoft Sentinel settings
- Configure logs
- Module assessment
- Plan for Microsoft services connectors
- Connect the Microsoft 365 connector
- Connect the Microsoft Entra connector
- Connect the Microsoft Entra ID Protection connector
- Connect the Azure Activity connector
- Module assessment
- Plan for Windows hosts security events connector
- Connect using the Windows Security Events via AMA Connector
- Connect using the Security Events via Legacy Agent Connector
- Collect Sysmon event logs
- Module assessment
- What is Microsoft Sentinel Analytics?
- Types of analytics rules
- Create an analytics rule from templates
- Create an analytics rule from wizard
- Manage analytics rules
- Understand automation options
- Create automation rules
- Module assessment
6Configure SIEM security operations using Microsoft Sentinel
Who it's for
Security operations analysts and engineers who already know Azure and write KQL queries.
Before you start
- Fundamental understanding of Microsoft Azure
- Basic understanding of Microsoft Sentinel
- Experience using Kusto Query Language (KQL) in Microsoft Sentinel
Related courses
More in Microsoft Security →FoundationSC-900T00
Microsoft Security, SC-900T00 Introduction to Microsoft Security, Compliance, and Identity, and Identity Fundamentals: SC-900 Exam Prep
Microsoft Security
View course →AdvancedSC-100T00
SC-100T00 Microsoft Cybersecurity Architect
Microsoft Security
View course →IntermediateSC-200
SC-200: Defend Against Cyberthreats with Microsoft's Security Operations Platform
Microsoft Security
View course →IntermediateSC-300T00
SC-300T00 Microsoft Identity and Access Administrator
Microsoft Security
View course →IntermediateSC-401
SC-401 Protect sensitive information with Microsoft Purview in the AI era
Microsoft Security
View course →IntermediateSC-5002
SC-5002 Secure Azure services and workloads with Microsoft Defender for Cloud regulatory compliance controls
Microsoft Security
View course →Let's plan your next step together.
Tell us the course or certification you have in mind and we'll send the outline, upcoming dates, fees and private-team options.