SC-200 Course Notes

This objective covers configuring Defender XDR notifications to ensure the right teams receive timely alerts based on defined criteria. Configure Microsoft Defender for Endpoint advanced features, rules, collection, and security policies to manage a security operations environment effectively. Manage automated investigation, response, and automatic attack disruption by leveraging the Action Center and incident experiences. This objective covers configuring Microsoft Sentinel automation rules to streamline incident handling by automating actions like status changes, owner assignment, and playbook execution. Rule order matters when multiple automation rules can act on the same incident. This objective covers creating and configuring Microsoft Sentinel playbooks, leveraging Azure Logic Apps workflows to automate security responses. Configure Microsoft Sentinel roles and data retention tiers to meet specific operational and cost requirements. Create workbooks to visualize Sentinel data and combine multiple data sources. This objective covers collecting Windows Security events using AMA, DCRs, and WEF to feed into Sentinel. Successful implementation relies on correctly configuring these components to ensure event visibility. This objective covers configuring and troubleshooting Syslog and CEF data collection through the Azure Monitor Agent (AMA). Successful ingestion relies on correctly configured data collection rules (DCRs) and a functioning transport path, ensuring events are forwarded, received, and processed. This objective covers collecting and processing Azure logs – specifically Activity logs, resource diagnostic logs, threat indicators, and custom logs – to provide a comprehensive security operational view within Microsoft Sentinel. Create and manage custom detections in Microsoft Defender XDR by leveraging advanced hunting queries. These detections automatically run scheduled queries, generating alerts based on matching results. Effective management requires careful consideration of query scope, scheduling, and response actions. Configure Sentinel analytics rules to detect threats by leveraging scheduled KQL queries, near-real-time detection, threat intelligence, anomaly detection, and entity mapping. Understand how these components integrate with MITRE ATT&CK for coverage and incident management.

• Incident notification rules focus on triggering alerts based on incident criteria (severity, device group), while action notification rules report response actions.

• Carefully consider the scope of each notification rule. Narrowly defined rules ensure relevant information reaches the correct teams.

Respond to security incidents by leveraging Microsoft Defender XDR's capabilities to investigate and manage complex attacks. This involves correlating alerts, understanding relationships across entities, and validating findings through investigation and simulation. Investigate Defender for Office 365 and Microsoft Purview threats by leveraging investigation surfaces to determine the full scope of an incident, including related emails, URLs, and delivery locations. Investigate Defender for Cloud alerts and Defender for Cloud Apps alerts by leveraging resource context, attack stage, and related signals. Validate alerts against expected business context before initiating governance actions. This objective covers investigating compromised identities using Entra ID Protection and Defender for Identity. Investigations require differentiating between user risk (likelihood of compromise) and sign-in risk (assessment of a specific authentication attempt). Successful investigation involves correlating evidence from multiple sources to determine the full extent of the compromise and appropriate remediation. Sentinel incidents provide a central hub for investigating and responding to threats, incorporating related alerts, entities, tasks, and analyst context. This objective covers utilizing the device timeline to investigate security incidents, including isolating devices, gathering forensic data, and verifying response actions. This objective covers responding to disrupted attacks by leveraging live response capabilities and forensic investigation techniques to gather and analyze endpoint evidence. The goal is to contain the threat and remediate the affected system while maintaining a clear audit trail. This objective covers using Microsoft Purview Audit, eDiscovery, and Graph activity logs to investigate security incidents within Microsoft 365. Effective investigation requires correlating these logs to understand the sequence of events.

• Incident Graph vs. Individual Alerts: The incident graph provides a holistic view of the attack, whereas individual alerts only represent isolated events. Relying solely on alerts obscures the broader attack story.

• Prioritize the Incident Graph: Always start with the incident graph to understand the relationships between entities before diving into individual artifacts.

This objective covers selecting the appropriate tables and applying KQL operators (where, project, summarize, join, extend, let) to effectively hunt for threats within Kusto. Efficiently narrowing the scope of the investigation is critical for performance and relevance. This objective covers creating and interpreting Advanced Hunting queries within Microsoft Defender XDR to investigate potential threats. A hunting query tests a hypothesis and should expose the entities, timestamps, and evidence needed for investigation. This objective covers utilizing Sentinel Graph to construct hunting graphs and perform blast-radius analysis, enabling analysts to investigate attack paths beyond initial alert data. A hunting graph represents entities and relationships so analysts can explore an attack path beyond a flat result set. Blast-radius analysis identifies assets and identities reachable or affected through observed relationships. Graph findings should lead to scoped queries or incident evidence rather than replace validation. This objective covers establishing a repeatable threat hunting process within Microsoft Sentinel by creating Sentinel hunting queries and configuring KQL jobs for proactive data analysis in the data lake. Utilize summary rules to create compact tables for rapid, repeated querying of high-volume data. Leverage Sentinel notebooks for in-depth Python-based investigation, visualization, and machine learning analysis, integrating with summary rule outputs for comprehensive threat hunting.

• `where` vs. `project`: `where` filters rows, while `project` selects columns. Use `where` to narrow the data set, and `project` to define the output columns.

• Start by identifying the table that contains the relevant event and entity data.