SC-5001: Configure SIEM security operations using Microsoft Sentinel

Course SC-5001: Configure SIEM security operations using Microsoft Sentinel

To obtain this Microsoft Applied Skills credential , students must demonstrate their ability to install and configure Microsoft Sentinel.

In this course you will learn how to work with Microsoft Sentinel security operations and configure the Microsoft Sentinel workspace, connect Microsoft services and Windows security events to Microsoft Sentinel, configure Microsoft Sentinel analysis rules, and respond to threats with automated responses.

Intermediate - Microsoft Sentinel - Security Engineer, Security Operations Analyst - Security

Objectives of the SC-5001 training

• Create and configure a Microsoft Sentinel workspace.
• Implementation of a Microsoft Sentinel content center solution
• Configuring analysis rules in Microsoft Sentinel
• Configuring automation in Microsoft Sentinel

Course content SC-5001

Module 1 Filtering network traffic with a network security group using the Azure Portal

• Azure Resource Group
• Azure Virtual Network
  
• How do network security groups filter network traffic?
  
• Application security groups
  
• Exercise: Creating a virtual network infrastructure

Module 2 Creating a Log Analytics workspace for Microsoft Defender for Cloud

• Collecting workload data with the Log Analytics agent
  
• Configuring the Log Analytics Agent and Workspace
  
• Exercise: Collecting workload data with the Log Analytics agent

Module 3 Configuring Azure Key Vault Networks

• Azure Key Vault Basics
  
• Recommended procedures for Azure Key Vault
  
• Azure Key Vault Security
  
• Configuring Azure Key Vault firewalls and virtual networks
  
• Exercise: Configuring Key Vault firewalls and virtual networks
  
• Introduction to temporary deletion of Azure Key Vault
  
• Virtual network service endpoints for Azure Key Vault
  
• Exercise: Configuring Azure Key Vault recovery with soft deletion and purge protection

Module 4 Connecting to an Azure SQL Server using a private Azure endpoint through the Azure Portal

• Azure Private Endpoint
  
• Azure Private Link
  
• Exercise: Implement a virtual machine to test connectivity privately and securely to the SQL server using the private endpoint

Prerequisites

It is recommended to be familiar with Microsoft security, compliance, and identity products; the Azure Portal; and Azure management, including role-based access control (RBAC).

Language

• Course: English / Spanish
  
• Labs: English / Spanish

Microsoft Applied Skills

This course is part of the Microsoft Applied Skills Credentials.

To obtain this Microsoft Applied Skills credential, students must demonstrate their ability to install and configure Microsoft Sentinel.

Applied Skills: Explore all credentials in one guide