SC-5001 Configure SIEM security operations using Microsoft Sentinel

Course Overview

Get started with Microsoft Sentinel security operations by configuring the Microsoft Sentinel workspace, connecting Microsoft services and Windows security events to Microsoft Sentinel, configuring Microsoft Sentinel analytics rules, and responding to threats with automated responses.

Course Outline

1 - Create and manage Microsoft Sentinel workspaces

Plan for the Microsoft Sentinel workspace
Create a Microsoft Sentinel workspace
Manage workspaces across tenants using Azure Lighthouse
Understand Microsoft Sentinel permissions and roles
Manage Microsoft Sentinel settings
Configure logs

2 - Connect Microsoft services to Microsoft Sentinel

Plan for Microsoft services connectors
Connect the Microsoft Office 365 connector
Connect the Microsoft Entra connector
Connect the Microsoft Entra ID Protection connector
Connect the Azure Activity connector

3 - Connect Windows hosts to Microsoft Sentinel

Plan for Windows hosts security events connector
Connect using the Windows Security Events via AMA Connector
Connect using the Security Events via Legacy Agent Connector
Collect Sysmon event logs

4 - Threat detection with Microsoft Sentinel analytics

What is Microsoft Sentinel Analytics?
Types of analytics rules
Create an analytics rule from templates
Create an analytics rule from wizard
Manage analytics rules

5 - Automation in Microsoft Sentinel

Understand automation options
Create automation rules

6 - Configure SIEM security operations using Microsoft Sentinel

< Back to Course Search

Class Dates & Times

Class times are listed Eastern time

This is a 1-day class

Class dates not listed.
Please click here to contact us for available dates and times.

The classes listed are available to all United Training customers and does not reflect, in any way,
the availability or support of technology within the University of Maine System.