Study workspace

Prepare for SC-200 with a reference that remembers your progress.

All nine learning paths now run in the new architecture. Select one to reveal its brief and modules.

09 / 09

Choose a learning path

0/404 units
02Microsoft Defender for Endpoint9 modules · 60 units · 5 hr 49 min · Deployment, attack surface reduction, investigations, response, automation, detections, and vulnerability management0/60 units complete−
Learning path 02 · Microsoft Defender for Endpoint ↗

9 modules · 60 units · 5 hr 49 min · Deployment, attack surface reduction, investigations, response, automation, detections, and vulnerability management

0%

Study focus

Endpoint readiness

Deploy, onboard, configure, and harden devices with Microsoft Defender for Endpoint.

Investigation and response

Investigate devices and evidence, take response actions, automate remediation, and tune detections.

9 modules · 60 units

Select one or more modules

Each click adds or removes a module from your workspace. Units remain closed until you open them.

08Configure for alerts and detections in Microsoft Defender for Endpoint0/7 units−
08

Module 8

Configure for alerts and detections in Microsoft Defender for Endpoint

Focus: alert-related features, notifications, tuning, and custom indicators.
0/7
01 / 07Introduction

Detection configuration should improve analyst signal quality without creating blind spots. The main controls are tenant features, email notification rules, alert tuning, and indicators.

Official moduleAlert and detection objectives
02 / 07Configure advanced features

Alert-related advanced features include Live Response, unsigned script execution, and custom network indicators. Custom indicators must be enabled before IP, URL, or domain allow/block rules can be enforced.

Official lessonDetection-related feature switches
03 / 07Configure alert notifications

Email notification rules select device scope, alert severity, recipients, organization name, tenant link, and optional device details. RBAC limits recipients and administrators to their device-group scope; only appropriately privileged administrators can create global rules.

  1. Create and name the rule.
  2. Select all devices or specific device groups.
  3. Select severity thresholds.
  4. Add recipients and send a test email.
  5. Save and periodically validate delivery.
Official lessonEmail notification rules
04 / 07Manage alert suppression

Alert tuning suppresses known benign patterns such as approved tools or processes. Rules can be enabled, disabled, edited, or deleted under Settings > Microsoft Defender XDR > Rules > Alert tuning. Changes can optionally release previously suppressed alerts.

Exam takeaway: tune a narrowly understood false-positive pattern—never suppress an alert category broadly just to reduce volume.
Official lessonAlert tuning rules
05 / 07Manage indicators

Indicators define allow, audit, warn, block, or block-and-remediate behavior according to entity type. Supported entities include file hashes, external IP addresses, URLs/domains, and certificates. Scope and expiration reduce operational risk.

IndicatorTypical actions / prerequisites
FileAllow, audit, warn, block execution, block and remediate; cloud protection and supported Defender AV required.
IP / URL / domainAllow, audit, warn, block; Network Protection and custom network indicators required. Internal IPs and CIDR ranges are not supported in the lesson.
CertificateAllow or block leaf certificates; requires supported AV and cloud protection.

Indicators are honored by cloud detection, endpoint prevention, and automated investigation. They can be created contextually, manually, or imported by CSV.

Official lessonIoC types, actions, and prerequisites
06 / 07Module assessment

Be ready to select the correct control: notification rule for awareness, alert tuning for a benign recurring pattern, or an indicator for explicit detection/prevention behavior.

Official assessmentAlerts and indicators knowledge check
07 / 07Summary and resources

Good detection engineering balances coverage and precision: notify the right responders, tune verified false positives, and scope time-bound indicators with documented intent.

Official moduleSummary and resources
End of learning pathMicrosoft Defender for Endpoint
↑