Detect Threats
Monitor security events and detect suspicious activities using Microsoft Sentinel and Defender.
Master Microsoft Sentinel, Defender XDR, Defender for Cloud and KQL. Learn how to detect, investigate and respond to real-world cybersecurity threats.
Build job-ready cybersecurity operations skills using Microsoft's enterprise security ecosystem.
Explore how a sign-in alert can start an analyst’s investigation.
SigninLogs | where ResultType != "0" | summarize Attempts=count() by UserPrincipalName
The Microsoft Security Operations Analyst course prepares you to investigate, respond to and hunt cybersecurity threats using Microsoft Sentinel, Microsoft Defender XDR and Defender for Cloud.
You will learn how modern Security Operations Centres use Microsoft technologies to protect identities, endpoints, applications and cloud environments.
Develop the practical skills needed to work effectively in modern security operations environments.
Monitor security events and detect suspicious activities using Microsoft Sentinel and Defender.
Analyse alerts, investigate security incidents and identify the root cause of threats.
Use KQL and security intelligence to proactively search for threats across your environment.
Investigate and respond to threats across endpoints, identities, email and applications.
Improve SOC efficiency by automating repetitive security operations and response workflows.
Monitor and protect cloud resources using Microsoft Defender for Cloud.
Follow a practical learning path covering the core Microsoft technologies used by Security Operations Analysts.
Understand and use threat intelligence in security operations.
Investigate and respond to cross-domain threats.
Detect and investigate endpoint security threats.
Monitor and protect cloud workloads and resources.
Configure Microsoft's cloud-native SIEM platform.
Connect security data sources and collect logs.
Create detections and investigate security incidents.
Use Kusto Query Language to hunt security threats.
Automate SOC processes and threat response.
Manage, prioritise and respond to security incidents.
No matching modules. Try another topic.
Gain experience with Microsoft's integrated enterprise security ecosystem.
Cloud-native SIEM and security analytics.
Extended detection and response platform.
Endpoint threat detection and response.
Cloud security posture and workload protection.
Identity and access security monitoring.
Information protection and governance.
Security analytics and threat hunting queries.
AI-assisted security investigation.
Review the recommended audience, prerequisites and certification information before enrolling.
Exam details shown are from the supplied course information. Confirm current requirements with Microsoft before booking.
SC-200 develops practical skills relevant to security monitoring, incident response, threat hunting and Microsoft cloud security roles.
Speak with our training team and find the right SC-200 training option for your learning goals.
Complete the form and our team will contact you.
SC-200 focuses on the skills required to investigate, respond to and hunt cybersecurity threats using Microsoft security technologies.
Basic cybersecurity, networking, Windows and cloud knowledge is recommended before starting SC-200.
The training includes practical security operations exercises, KQL activities and Microsoft security technology scenarios.
Key technologies include Microsoft Sentinel, Defender XDR, Defender for Endpoint, Defender for Cloud, Microsoft Entra ID and KQL.
Relevant roles include SOC Analyst, Security Operations Analyst, Threat Hunter, Incident Responder and Security Engineer.
Develop practical Microsoft security skills and prepare for your SC-200 certification with SysCare.