SC-200T00: Microsoft Security Operations Analyst

Der Microsoft Security Operations Analyst arbeitet mit Stakeholdern des Unternehmens zusammen, um Informationstechnologiesysteme für das Unternehmen zu sichern. Ziel ist es, das organisatorische Risiko zu reduzieren, indem aktive Angriffe in der Umgebung schnell behoben werden, Verbesserungen der Bedrohungsschutzpraktiken empfohlen und Verstöße gegen organisatorische Richtlinien an geeignete Stakeholder weitergeleitet werden.
Jetzt beraten lassen

Physisch oder virtuell?

Nehmen Sie an einem unserer Standorte Frankfurt, München und Wien oder virtuell an unseren Klassenraumtrainings teil. Unter “Termin buchen” werden Ihnen alle Optionen angezeigt, zuerst sortiert nach Standort, dann nach Datum.

Der Microsoft Security Operations Analyst arbeitet mit Projektbeteiligten im Unternehmen zusammen, um IT-Systeme des Unternehmens zu schützen. Ihr Ziel ist es, Risiken für das Unternehmen zu verringern, indem sie aktive Angriffe in der Umgebung schnell abwehren, Empfehlungen zur Verbesserung der Bedrohungsschutzmethoden aussprechen und Verstöße gegen die Unternehmensrichtlinien an die zuständigen Stellen weiterleiten. Zu den Zuständigkeiten gehören das Verwalten und Überwachen von sowie das Reagieren auf Bedrohungen durch den Einsatz einer Vielzahl von Sicherheitslösungen in ihrer Umgebung. Zu den Aufgaben dieser Rolle gehört in erster Linie das Untersuchen, Reagieren und Suchen nach Bedrohungen mithilfe von Microsoft Sentinel, Microsoft Defender for Cloud, Microsoft 365 Defender und Sicherheitsprodukten von Drittanbietern. Da der Security Operations Analyst die operative Ausgabe dieser Tools nutzt, ist er auch ein wichtiger Stakeholder beim Konfigurieren und Bereitstellen dieser Technologien.
Grundkenntnisse über Microsoft 365 Grundlegendes Verständnis über Microsoft-Produkte zu Sicherheit, Compliance und Identität Fortgeschrittene Kenntnisse über Microsoft Windows Vertrautheit mit Azure-Diensten, insbesondere Azure SQL-Datenbank und Azure Storage Kenntnisse im Umgang mit virtuellen Azure-Computern und virtuellen Netzwerken Grundlegendes Verständnis der Konzepte zur Skripterstellung.

Wichtige Information

Dieses Training behandelt prüfungsrelevante Themen zum Examen: Microsoft Certified: Security Operations Analyst Associate

Was werden Sie in diesem Training erlernen?

Reduzieren der Bedrohungen mit Microsoft 365 Defender, Reduzieren Sie Bedrohungen mit Azure Defender, Reduzieren Sie Bedrohungen mithilfe von Azure Sentinel

Agenda

Introduction to Microsoft 365 threat protection
Investigate security incident in Microsoft 365 Defender
Explore Microsoft Security Graph
Understand Microsoft 365 Defender in a Security Operations Center (SOC)
Explore Extended Detection & Response (XDR) response use cases
Mitigate incidents using Microsoft 365 Defender
Configure the Microsoft 365 Defender portal
Analyze reports
Analyze threat analytics
Understand Microsoft Secure Score
Investigate Azure AD sign-in logs
Explore advanced hunting
Use the action center
Manage automated investigations
Manage and investigate alerts
Investigate incidents
Manage incidents
Use the Microsoft 365 Defender portal
Protect your identities with Azure AD Identity Protection
Investigate and remediate risks detected by Azure AD Identity Protection
Detect risks with Azure AD Identity Protection policies
Azure AD Identity Protection overview
Remediate risks with Microsoft Defender for Office 365
Simulate attacks
Configure, protect, and detect
Automate, investigate, and remediate
Introduction to Microsoft Defender for Office 365
Safeguard your environment with Microsoft Defender for Identity
Integrate with other Microsoft tools
Review compromised accounts or data
Configure Microsoft Defender for Identity sensors
Introduction to Microsoft Defender for Identity
Secure your cloud apps and services with Microsoft Defender for Cloud Apps
Detect Threats
Classify and protect sensitive information
Walk through discovery and access control with Microsoft Defender for Cloud Apps
Protect your data and apps with Conditional Access App Control
Explore your cloud apps with Cloud Discovery
Understand the Defender for Cloud Apps Framework
Respond to data loss prevention alerts using Microsoft 365
Investigate data loss prevention alerts in Microsoft Defender for Cloud Apps
Investigate data loss prevention alerts in Microsoft Purview
Describe data loss prevention alerts
Manage insider risk in Microsoft Purview
Create insider risk management notice templates
Manage insider risk management forensic evidence
Take action on insider risk alerts through cases
Investigate insider risk alerts
Knowledge check
Create and manage insider risk policies
Introduction to managing insider risk policies
Insider risk management overview
Investigate threats by using audit features in Microsoft 365 Defender and Microsoft Purview Standard
Use audit log searching to investigate common support issues
Export, configure, and view audit log records
Search the Unified Audit Log (UAL)
Start recording activity in the Unified Audit Log
Implement Microsoft Purview Audit (Standard)
Explore Microsoft Purview Audit solutions
Introduction to threat investigation with the Unified Audit Log (UAL)
Investigate threats using audit in Microsoft 365 Defender and Microsoft Purview (Premium)
Investigate compromised email accounts using Purview Audit (Premium)
Manage audit log retention policies
Implement Microsoft Purview Audit (Premium)
Explore Microsoft Purview Audit (Premium)
Introduction to threat investigation with Microsoft Purview Audit (Premium)
Investigate threats with Content search in Microsoft Purview
Search for and delete email messages
Configure search permissions filtering
Export the search results and search report
View the search results and statistics
Create a content search
Explore Microsoft Purview eDiscovery solutions
Protect against threats with Microsoft Defender for Endpoint
Hunt threats within your network
Practice security administration
Introduction to Microsoft Defender for Endpoint
Deploy the Microsoft Defender for Endpoint environment
Configure environment advanced features
Configure device groups
Create and manage roles for role-based access control
Manage access
Onboard devices
Understand operating systems compatibility and features
Create your environment
Implement Windows security enhancements with Microsoft Defender for Endpoint
Enable attack surface reduction rules
Understand attack surface reduction
Perform device investigations in Microsoft Defender for Endpoint
Detect devices with device discovery
Use behavioral blocking
Investigate the device
Use the device inventory list
Perform actions on a device using Microsoft Defender for Endpoint
Initiate live response session
Collect investigation package from devices
Run Microsoft Defender antivirus scan on devices
Explain device actions
Perform evidence and entities investigations using Microsoft Defender for Endpoint
Investigate a domain
Investigate an IP address
Investigate a user account
Investigate a file
Configure and manage automation using Microsoft Defender for Endpoint
Block at risk devices
Configure automated investigation and remediation capabilities
Manage automation upload and folder settings
Configure advanced features
Configure for alerts and detections in Microsoft Defender for Endpoint
Manage indicators
Manage alert suppression
Configure alert notifications
Configure advanced features
Utilize Vulnerability Management in Microsoft Defender for Endpoint
Manage remediation
Explore vulnerabilities on your devices
Understand vulnerability management
Plan for cloud workload protections using Microsoft Defender for Cloud
Enable Microsoft Defender for Cloud
Exercise – Microsoft Defender for Cloud interactive guide
Describe Microsoft Defender for Cloud workload protections
Explain Microsoft Defender for Cloud
Connect Azure assets to Microsoft Defender for Cloud
Manual log analytics agent provisioning
Configure auto provisioning
Explore and manage your resources with asset inventory
Connect non-Azure resources to Microsoft Defender for Cloud
Connect your GCP accounts
Connect your AWS accounts
Connect non-Azure machines
Protect non-Azure resources
Manage your cloud security posture management
Understand Workbooks
Measure and enforce regulatory compliance
Explore Recommendations
Explore Secure Score
Explain cloud workload protections in Microsoft Defender for Cloud
Understand Microsoft Defender additional protections
Understand Microsoft Defender for Containers
Understand Microsoft Defender for DNS
Understand Microsoft Defender for Resource Manager
Understand Microsoft Defender for Key Vault
Understand Microsoft Defender for open-source databases
Understand Microsoft Defender for SQL
Understand Microsoft Defender for Storage
Understand Microsoft Defender for App Service
Understand Microsoft Defender for servers
Remediate security alerts using Microsoft Defender for Cloud
Respond to alerts from Azure resources
Generate threat intelligence reports
Suppress alerts from Defender for Cloud
Remediate alerts and automate responses
Understand security alerts
Construct KQL statements for Microsoft Sentinel
Use the project operators
Use the order by operator
Use the extend operator
Use the let statement
Use the where operator
Use the search operator
Understand the Kusto Query Language statement structure
Analyze query results using KQL
Use the render operator to create visualizations
Use the summarize operator to prepare data
Use the summarize operator to filter results
Use the summarize operator
Build multi-table statements using KQL
Use the join operator
Use the union operator
Work with data in Microsoft Sentinel using Kusto Query Language
Create parsers with functions
Integrate external data
Extract data from structured string data
Extract data from unstructured string fields
Introduction
Introduction to Microsoft Sentinel
When to use Microsoft Sentinel
How Microsoft Sentinel works
What is Microsoft Sentinel?
Create and manage Microsoft Sentinel workspaces
Configure logs
Manage Microsoft Sentinel settings
Understand Microsoft Sentinel permissions and roles
Manage workspaces across tenants using Azure Lighthouse
Create a Microsoft Sentinel workspace
Plan for the Microsoft Sentinel workspace
Query logs in Microsoft Sentinel
Understand Microsoft 365 Defender tables
Understand common tables
Understand Microsoft Sentinel tables
Query logs in the logs page
Use watchlists in Microsoft Sentinel
Manage watchlists
Create a watchlist
Plan for watchlists
Utilize threat intelligence in Microsoft Sentinel
View your threat indicators with KQL
Manage your threat indicators
Define threat intelligence
Connect data to Microsoft Sentinel using data connectors
View connected hosts
Understand data connector providers
Ingest log data with data connectors
Connect Microsoft services to Microsoft Sentinel
Connect the Azure Activity connector
Connect the Azure Active Directory identity protection connector
Connect the Azure Active Directory connector
Connect the Microsoft Office 365 connector
Plan for Microsoft services connectors
Connect Microsoft 365 Defender to Microsoft Sentinel
Connect Microsoft Defender legacy connectors
Connect Microsoft Defender for IoT
Connect Microsoft Defender for Cloud connector
Connect the Microsoft 365 Defender connector
Plan for Microsoft 365 Defender connectors
Connect Windows hosts to Microsoft Sentinel
Collect Sysmon event logs
Connect using the Security Events via Legacy Agent Connector
Connect using the Windows Security Events via AMA Connector
Plan for Windows hosts security events connector
Connect Common Event Format logs to Microsoft Sentinel
Connect your external solution using the Common Event Format connector
Plan for Common Event Format connector
Connect syslog data sources to Microsoft Sentinel
Parse syslog data with KQL
Configure the Data Collection Rule for Syslog Data Sources
Collect data from Linux-based sources using syslog
Plan for syslog data collection
Connect threat indicators to Microsoft Sentinel
View your threat indicators with KQL
Connect the threat intelligence platforms connector
Connect the threat intelligence TAXII connector
Plan for threat intelligence connectors
Threat detection with Microsoft Sentinel analytics
Manage analytics rules
Create an analytics rule from wizard
Create an analytics rule from templates
Types of analytics rules
What is Microsoft Sentinel Analytics?
Automation in Microsoft Sentinel
Create automation rules
Understand automation options
Security incident management in Microsoft Sentinel
Incident management
Incident evidence and entities
Understand incidents
Exercise - Set up the Azure environment
Identify threats with Behavioral Analytics
Use Anomaly detection analytical rule templates
Display entity behavior information
Explore entities
Understand behavioral analytics
Data normalization in Microsoft Sentinel
Configure Azure Monitor Data Collection Rules
Create an ASIM Parser
Understand parameterized KQL functions
Use ASIM Parsers
Understand data normalization
Query, visualize, and monitor data in Microsoft Sentinel
Create a new Microsoft Sentinel Workbook
Use default Microsoft Sentinel Workbooks
Query data using Kusto Query Language
Monitor and visualize data
Exercise - Query and visualize data with Microsoft Sentinel Workbooks
Manage content in Microsoft Sentinel
Use repositories for deployment
Use solutions from the content hub
Explain threat hunting concepts in Microsoft Sentinel
Explore MITRE ATT&CK
Develop a hypothesis
Understand cybersecurity threat hunts
Threat hunting with Microsoft Sentinel
Observe threats over time with livestream
Save key findings with bookmarks
Explore creation and management of threat-hunting queries
Exercise setup
Use Search jobs in Microsoft Sentinel
Restore historical data
Hunt with a Search Job
Hunt for threats using notebooks in Microsoft Sentinel
Explore notebook code
Create a notebook
Hunt with notebooks
Access Azure Sentinel data with external tools
  • Group Exercise: Review Architecting on AWS core best practices
  • Lab 1: Securing Amazon S3 VPC Endpoint Communications
  • Group Exercise: Review Architecting on AWS core best practices
  • AWS Organizations for multi-account access and permissions
  • AWS SSO to simplify access and authentication across AWS accounts and third-party services
  • AWS Control Tower
  • Permissions, access, and authentication
  • Group Exercise: Review Architecting on AWS core best practices
  • Lab 1: Securing Amazon S3 VPC Endpoint Communications
  • Group Exercise: Review Architecting on AWS core best practices
  • Lab 1: Securing Amazon S3 VPC Endpoint Communications

Dein Training im Überblick

Dauer 4
Trainingssprache Deutsch
Trainingsart brainyCLASS (offen)

2.590,00 €

Startdatum und Ort wählen

Terminübersicht