Microsoft Sentinel Course With Hands On Sims For Beginners

Learn how to expertly administer Microsoft Sentinel (including SOAR and SIEM) with hands on experience!

What you'll learn

Learn the concepts and perform hands on activities needed to master Microsoft Sentinel (SOAR and SIEM)

Gain a tremendous amount of knowledge involving Microsoft Sentinel (SOAR and SIEM)

Learn using hands on simulations on how to manage Microsoft Sentinel (SOAR and SIEM)

Learn how to set up your own test lab for practicing the concepts!

Requirements

Willingness to put in the time and practice the steps shown in the course

Description

We really hope you'll agree, this training is way more than the average course on Udemy! Have access to the following:Training from an instructor of over 20 years who has trained thousands of people and also a Microsoft Certified TrainerLecture that explains the concepts in an easy to learn method for someone that is just starting out with this materialInstructor led hands on and simulations to practice that can be followed even if you have little to no experienceTOPICS COVERED INCLUDING HANDS ON LECTURE AND PRACTICE TUTORIALS:IntroductionWelcome to the courseUnderstanding the Microsoft EnvironmentFoundations of Active Directory DomainsFoundations of RAS, DMZ, and VirtualizationFoundations of the Microsoft Cloud ServicesDONT SKIP: The first thing to know about Microsoft cloud servicesDONT SKIP: Azure AD is now renamed to Entra IDQuestions for John ChristopherPerforming hands on activitiesDONT SKIP: Using Assignments in the courseCreating a free Microsoft 365 AccountGetting your free Azure creditUnderstanding and setting up a Microsoft Sentinel WorkspaceOverview of Microsoft SentinelConfiguring a Microsoft Sentinel workspaceManaging roles regarding SentinelManaging log types, log retention, and data storage in SentinelWorking with data connectors and ingestion in Microsoft SentinelMicrosoft Sentinel data source identificationSetting up connectors for ingesting data into Microsoft SentinelConnecting Sentinel with Microsoft 365 Defender and Defender for CloudCommon Event Format (CEF) and Syslog event collectionsWindows Security Event Collection setup in Microsoft SentinelManaging threat intelligence connectors in Microsoft SentinelWorking with custom log tablesUsing analytics rules in Microsoft SentinelUnderstanding analytics rules in Microsoft SentinelFusion rule configurationSecurity analytics rulesWorking with scheduled query rules in Microsoft SentinelCustom scheduled query rulesWorking with near-real-time (NRT) analytics rulesContent hub analytics rulesWatchlists in Microsoft SentinelThreat indicators in Microsoft SentinelClassification, normalization & security orchestration automated response (SOAR)Working with using entities for classifying and analyzing dataAdvanced Security Information Model(ASIM) queries with Microsoft SentinelASIM parser managementUsing automation rulesUsing playbooks in Microsoft SentinelAutomation rule triggering using analytic rulesAlert and incident playbook triggeringDealing with Incidents and Workbooks for analyzes and interpretation of dataIncident generation in Microsoft SentinelUnderstanding the concepts of triaging incidents in SentinelMicrosoft Sentinel incident investigationHow to respond to Microsoft Sentinel incidentsMulti-workspace incident investigationWorkbook template customization and managementImplementing custom workbooks in Microsoft SentinelWorking with advanced visualizationsThreat hunting and entity behavior analytics in Microsoft SentinelMITRE ATT&CK attack vectors in Microsoft SentinelUsing hunting queries from the content galleryHunting query customizationData investigations with hunting bookmarksUsing Livestream to monitor hunting queriesHow archived log data can be retrieved in Microsoft SentinelSearch job management in Microsoft SentinelEntity Behavior Analytics settingsEntity page investigation of threatsAnomaly detection analytics rules in Microsoft SentinelConclusionCleaning up your lab environmentGetting a Udemy certificateBONUS Where do I go from here?

Overview

Section 1: Introduction

Lecture 1 Welcome to the course!

Lecture 2 Understanding the Microsoft Environment

Lecture 3 Foundations of Active Directory Domains

Lecture 4 Foundations of RAS, DMZ, and Virtualization

Lecture 5 Foundations of the Microsoft Cloud Services

Lecture 6 DONT SKIP: The first thing to know about Microsoft cloud services

Lecture 7 DONT SKIP: Azure AD is now renamed to Entra ID

Lecture 8 Questions for John Christopher

Section 2: Performing hands on activities

Lecture 9 DONT SKIP: Using Assignments (Simulations) in the course

Lecture 10 Creating a free Microsoft 365 Account

Lecture 11 Getting your free Azure credit

Section 3: Understanding and setting up a Microsoft Sentinel Workspace

Lecture 12 Overview of Microsoft Sentinel

Lecture 13 Configuring a Microsoft Sentinel workspace

Lecture 14 Managing roles regarding Sentinel

Lecture 15 Managing log types, log retention, and data storage in Sentinel

Section 4: Working with data connectors and ingestion in Microsoft Sentinel

Lecture 16 Microsoft Sentinel data source identification

Lecture 17 Setting up connectors for ingesting data into Microsoft Sentinel

Lecture 18 Connecting Sentinel with Microsoft 365 Defender and Defender for Cloud

Lecture 19 Common Event Format (CEF) and Syslog event collections

Lecture 20 Windows Security Event Collection setup in Microsoft Sentinel

Lecture 21 Managing threat intelligence connectors in Microsoft Sentinel

Lecture 22 Working with custom log tables

Section 5: Using analytics rules in Microsoft Sentinel

Lecture 23 Understanding analytics rules in Microsoft Sentinel

Lecture 24 Fusion rule configuration

Lecture 25 Security analytics rules

Lecture 26 Working with scheduled query rules in Microsoft Sentinel

Lecture 27 Custom scheduled query rules

Lecture 28 Working with near-real-time (NRT) analytics rules

Lecture 29 Content hub analytics rules

Lecture 30 Watchlists in Microsoft Sentinel

Lecture 31 Threat indicators in Microsoft Sentinel

Section 6: Classification, normalization & security orchestration automated response (SOAR)

Lecture 32 Working with using entities for classifying and analyzing data

Lecture 33 Advanced Security Information Model(ASIM) queries with Microsoft Sentinel

Lecture 34 ASIM parser management

Lecture 35 Using automation rules

Lecture 36 Using playbooks in Microsoft Sentinel

Lecture 37 Automation rule triggering using analytic rules

Lecture 38 Alert and incident playbook triggering

Section 7: Dealing with Incidents and Workbooks for analyzes and interpretation of data

Lecture 39 Incident generation in Microsoft Sentinel

Lecture 40 Understanding the concepts of triaging incidents in Sentinel

Lecture 41 Microsoft Sentinel incident investigation

Lecture 42 How to respond to Microsoft Sentinel incidents

Lecture 43 Multi-workspace incident investigation

Lecture 44 Workbook template customization and management

Lecture 45 Implementing custom workbooks in Microsoft Sentinel

Lecture 46 Working with advanced visualizations

Section 8: Threat hunting and entity behavior analytics in Microsoft Sentinel

Lecture 47 MITRE ATT&CK attack vectors in Microsoft Sentinel

Lecture 48 Using hunting queries from the content gallery

Lecture 49 Hunting query customization

Lecture 50 Data investigations with hunting bookmarks

Lecture 51 Using Livestream to monitor hunting queries

Lecture 52 How archived log data can be retrieved in Microsoft Sentinel

Lecture 53 Search job management in Microsoft Sentinel

Lecture 54 Entity Behavior Analytics settings

Lecture 55 Entity page investigation of threats

Lecture 56 Anomaly detection analytics rules in Microsoft Sentinel

Section 9: Conclusion

Lecture 57 Cleaning up your lab environment

Lecture 58 Getting a Udemy certificate

Lecture 59 BONUS Where do I go from here?

IT people interested in learning a tremendous amount about Microsoft Sentinel (SOAR and SIEM)