Study workspace

Prepare for SC-200 with a reference that remembers your progress.

All nine learning paths now run in the new architecture. Select one to reveal its brief and modules.

09 / 09

Choose a learning path

0/404 units

01Microsoft Defender XDR6 modules · 53 units · Defender XDR, Defender for Office 365, Entra ID Protection, Defender for Identity, and Defender for Cloud Apps0/53 units complete+

02Microsoft Defender for Endpoint9 modules · 60 units · 5 hr 49 min · Deployment, attack surface reduction, investigations, response, automation, detections, and vulnerability management0/60 units complete+

03Microsoft Defender for Cloud6 modules · 48 units · 4 hr 17 min · Cloud security posture, multicloud onboarding, workload protection, alerts, and response0/48 units complete+

04Create queries for Microsoft Sentinel using KQL4 modules · 29 units · Query construction, aggregation, visualization, multi-table analysis, parsing, and reusable functions0/29 units complete+

05Configure your Microsoft Sentinel environment6 modules · 42 units · SIEM architecture, workspaces, logs, watchlists, threat intelligence, and unified SIEM/XDR0/42 units complete−

Learning path 05 · Configure your Microsoft Sentinel environment ↗

6 modules · 42 units · SIEM architecture, workspaces, logs, watchlists, threat intelligence, and unified SIEM/XDR

Study focus

Sentinel foundation

Understand the SIEM workflow and design workspaces, permissions, retention, and data tiers.

Security context

Use logs, watchlists, threat intelligence, and Defender XDR integration to support operations.

6 modules · 42 units

Select one or more modules

Each click adds or removes a module from your workspace. Units remain closed until you open them.

01Introduction to Microsoft Sentinel0/6 units+02Create and manage Microsoft Sentinel workspaces0/9 units+03Query logs in Microsoft Sentinel0/7 units−04Use watchlists in Microsoft Sentinel0/6 units+05Utilize threat intelligence in Microsoft Sentinel0/6 units+06Integrate Microsoft Defender XDR with Microsoft Sentinel0/8 units+

Module 3

Query logs in Microsoft Sentinel

Focus: query surfaces, Sentinel feature tables, common connector tables, and Defender XDR advanced hunting schemas.

0/7

01 / 07Introduction

Analysts must recognize where connected data is stored and which table best answers an investigation question. Table names, schemas, retention, and portal query surfaces determine what KQL can access.

Official moduleLog query objectives

02 / 07Query logs in the logs page

In the Defender portal, use Advanced hunting for interactive analytics-tier queries and Data lake exploration for long-term data. In the Azure portal, use Sentinel's Logs page and switch the editor from Simple to KQL mode when required.

The query window exposes tables and fields, saved and sample queries, result columns, export, alert-rule creation, and incident linking. Always select the intended workspace and time range before interpreting results.

Official lessonAdvanced hunting, lake exploration, and Logs

03 / 07Understand Microsoft Sentinel tables

Table	Purpose
`SecurityAlert`	Alerts created by analytics rules or ingested directly from connectors.
`SecurityIncident`	Incident records that group one or more alerts.
`ThreatIntelligenceIndicator`	Imported or manually created indicators such as IPs, domains, URLs, and hashes.
`Watchlist`	Imported watchlist records used for enrichment and correlation.

Analytics rules query workspace tables to create alerts; configured grouping and correlation then create incidents.

Official lessonSentinel feature tables

04 / 07Understand common tables

Source	Common table
Azure control plane	`AzureActivity`
Azure resource logs	`AzureDiagnostics`
Microsoft Entra audit / sign-ins	`AuditLogs`, `SigninLogs`
Windows security / Sysmon	`SecurityEvent`, `Event`
Linux / network appliances	`Syslog`, `CommonSecurityLog`
Microsoft 365 audit	`OfficeActivity`
Windows Firewall	`WindowsFirewall`

Exam takeaway: choose the table from the data source and connector, not merely from the entity you are investigating.

Official lessonFrequently queried connector tables

05 / 07Understand Microsoft Defender XDR tables

Defender XDR advanced hunting tables are grouped by security domain. Endpoint examples include DeviceProcessEvents, DeviceNetworkEvents, DeviceFileEvents, DeviceLogonEvents, and DeviceRegistryEvents. Email examples include EmailEvents, EmailAttachmentInfo, EmailUrlInfo, and UrlClickEvents.

CloudAppEvents covers cloud application activity; identity tables cover sign-ins and directory behavior; AlertInfo and AlertEvidence connect detections to evidence. In the unified portal, these can be correlated with Sentinel workspace tables through advanced hunting according to onboarding and retention.

Official lessonDefender XDR advanced hunting schemas

06 / 07Module assessment

Match portal query surfaces and common tables to Sentinel alerts, incidents, Entra activity, Azure resources, Windows events, network devices, endpoints, identities, cloud apps, and email evidence.

Official assessmentTables and querying knowledge check

07 / 07Summary and resources

Start every investigation by confirming workspace, tier, time range, connector, and schema. Query the narrowest relevant table, then correlate across domains when the evidence requires it.

Official moduleSummary and resources

06Connect logs to Microsoft Sentinel7 modules · 49 units · Content Hub, Microsoft services, Defender, Windows, CEF, Syslog, and threat intelligence0/49 units complete+

07Create detections and perform investigations using Microsoft Sentinel8 modules · 56 units · Analytics, automation, playbooks, incidents, UEBA, ASIM, workbooks, and content management0/56 units complete+

08Perform threat hunting in Microsoft Sentinel4 modules · 25 units · Hunting hypotheses, queries, bookmarks, livestream, search jobs, restored logs, and notebooks0/25 units complete+

09Mitigate threats using Microsoft Purview4 modules · 42 units · DLP alerts, insider risk, Audit, eDiscovery, Defender XDR, and investigation workflows0/42 units complete+