SC-5001: Configure SIEM security operations using Microsoft Sentinel

Course SC-5001: Configure SIEM security operations using Microsoft Sentinel

To earn this Microsoft Applied Skills credential , students must demonstrate their ability to install and configure Microsoft Sentinel.

In this course, you will learn how to work with Microsoft Sentinel Security Operations and configure the Microsoft Sentinel workspace, connect Microsoft services and Windows Security events to Microsoft Sentinel, configure Microsoft Sentinel analysis rules, and respond to threats with automated responses.

Intermediate - Microsoft Sentinel - Security Engineer, Security Operations Analyst - Security

SC-5001 Training Objectives

• Create and configure a Microsoft Sentinel workspace.
• Implementing a Microsoft Sentinel Content Hub Solution
• Configuring Analysis Rules in Microsoft Sentinel
• Configuring Automation in Microsoft Sentinel

SC-5001 Course Content

Module 1: Filtering network traffic with a network security group using the Azure portal

• Azure Resource Group
• Azure Virtual Network
  
• How Network Security Groups Filter Network Traffic
  
• Application Security Groups
  
• Exercise: Creating a virtual network infrastructure

Module 2: Creating a Log Analytics Workspace for Microsoft Defender for Cloud

• Collecting data from workloads with the Log Analytics agent
  
• Configuring the Log Analytics Agent and Workspace
  
• Exercise: Collecting Workload Data with the Log Analytics Agent

Module 3 Configuring Azure Key Vault Networks

• Azure Key Vault Basics
  
• Best practices for Azure Key Vault
  
• Azure Key Vault Security
  
• Configuring Azure Key Vault firewalls and virtual networks
  
• Exercise: Configuring Key Vault Firewall and Virtual Networks
  
• Introduction to Azure Key Vault soft delete
  
• Virtual network service endpoints for Azure Key Vault
  
• Exercise: Configuring Azure Key Vault recovery with soft delete and purge protection

Module 4: Connecting to an Azure SQL Server using an Azure Private Endpoint via the Azure Portal

• Azure Private Endpoint
  
• Azure Private Link
  
• Exercise: Deploy a virtual machine to privately and securely test connectivity to SQL Server using the private endpoint

Prerequisites

Familiarity with Microsoft security, compliance, and identity products; the Azure portal; and Azure management, including role-based access control (RBAC), is recommended.

Language

• Course: English / Spanish
  
• Labs: English / Spanish

Microsoft Applied Skills

This course is part of the Microsoft Applied Skills Credentials.

To earn this Microsoft Applied Skills credential, students must demonstrate their ability to install and configure Microsoft Sentinel.

Applied Skills: Explore all credentials in one guide