Microsoft Security
SC-5004 Defend against cyberthreats with Microsoft Defender XDR
Detect, investigate and stop attacks with Microsoft Defender XDR.
1 dayIntermediate6 modulesSC-5004
About this course
Detect, investigate and stop attacks with Microsoft Defender XDR. During one hands-on day you will manage incidents in the Defender portal, deploy Defender for Endpoint and onboard devices, tune alerts and automated investigation and remediation, and investigate compromised devices, with lab exercises in which you mitigate simulated attacks.
Curriculum
6 modules
- Use the Microsoft Defender portal
- Manage incidents
- Investigate incidents
- Manage and investigate alerts
- Manage automated investigations
- Use the action center
- Explore advanced hunting
- Investigate Microsoft Entra sign-in logs
- Understand Microsoft Secure Score
- Analyze threat analytics
- Analyze reports
- Configure the Microsoft Defender portal
- Create your environment
- Understand operating systems compatibility and features
- Onboard devices
- Manage access
- Create and manage roles for role-based access control
- Configure device groups
- Configure environment advanced features
- Configure advanced features
- Configure alert notifications
- Manage alert suppression
- Manage indicators
- Configure advanced features
- Manage automation upload and folder settings
- Configure automated investigation and remediation capabilities
- Block at risk devices
- Use the device inventory list
- Investigate the device
- Use behavioral blocking
- Detect devices with device discovery
- Configure the Microsoft Defender XDR environment
- Deploy Microsoft Defender for Endpoint
- Mitigate Attacks with Microsoft Defender for Endpoint
Who it's for
Security operations analysts and incident responders working in the Microsoft Defender portal.
Before you start
- Experience using the Microsoft Defender portal
- Basic understanding of Microsoft Defender for Endpoint
- Basic understanding of Microsoft Sentinel
- Experience using Kusto Query Language (KQL) in Microsoft Sentinel
Related courses
More in Microsoft Security →FoundationSC-900T00
Microsoft Security, SC-900T00 Introduction to Microsoft Security, Compliance, and Identity, and Identity Fundamentals: SC-900 Exam Prep
Microsoft Security
View course →AdvancedSC-100T00
SC-100T00 Microsoft Cybersecurity Architect
Microsoft Security
View course →IntermediateSC-200
SC-200: Defend Against Cyberthreats with Microsoft's Security Operations Platform
Microsoft Security
View course →IntermediateSC-300T00
SC-300T00 Microsoft Identity and Access Administrator
Microsoft Security
View course →IntermediateSC-401
SC-401 Protect sensitive information with Microsoft Purview in the AI era
Microsoft Security
View course →IntermediateSC-5001
SC-5001 Configure SIEM security operations using Microsoft Sentinel
Microsoft Security
View course →Let's plan your next step together.
Tell us the course or certification you have in mind and we'll send the outline, upcoming dates, fees and private-team options.