Study workspace

Prepare for SC-200 with a reference that remembers your progress.

All nine learning paths now run in the new architecture. Select one to reveal its brief and modules.

09 / 09

Choose a learning path

0/404 units
05Configure your Microsoft Sentinel environment6 modules · 42 units · SIEM architecture, workspaces, logs, watchlists, threat intelligence, and unified SIEM/XDR0/42 units complete−
Learning path 05 · Configure your Microsoft Sentinel environment ↗

6 modules · 42 units · SIEM architecture, workspaces, logs, watchlists, threat intelligence, and unified SIEM/XDR

0%

Study focus

Sentinel foundation

Understand the SIEM workflow and design workspaces, permissions, retention, and data tiers.

Security context

Use logs, watchlists, threat intelligence, and Defender XDR integration to support operations.

6 modules · 42 units

Select one or more modules

Each click adds or removes a module from your workspace. Units remain closed until you open them.

05Utilize threat intelligence in Microsoft Sentinel0/6 units−
05

Module 5

Utilize threat intelligence in Microsoft Sentinel

Focus: cyber threat intelligence sources, indicator lifecycle, tagging, KQL, analytics, and hunting.
0/6
01 / 06Introduction

Sentinel can ingest, create, manage, query, and operationalize threat indicators so analysts can correlate organizational telemetry with known malicious infrastructure and artifacts.

Official moduleThreat intelligence objectives
02 / 06Define threat intelligence

Cyber threat intelligence may come from open-source feeds, sharing communities, commercial providers, or internal investigations. Strategic and operational reports describe actors, motives, campaigns, and techniques; tactical indicators describe observable IPs, domains, URLs, hashes, and similar IoCs.

Sentinel imports indicators through connectors, manages them in Threat Intelligence, correlates them with analytics rules, visualizes them in workbooks, and uses them in hunting.

Official lessonCTI sources and operational uses
03 / 06Manage your threat indicators

The Threat Intelligence area supports viewing, filtering, searching, creating, editing, and tagging indicators without writing KQL. Required properties depend on indicator type and commonly include the observable, confidence, description, source, validity period, threat type, and tags.

Use consistent tag conventions for actor, campaign, incident, source, or handling classification. Multiple indicators can be tagged in bulk, and each indicator can have several tags.

Official lessonIndicator creation, filtering, and tagging
04 / 06View your threat indicators with KQL

Query the threat-intelligence table to validate ingestion, find active indicators, group by source or threat type, and correlate observables with event tables. Filter expired or revoked records before detection use.

ThreatIntelligenceIndicator
| where Active == true
| where ExpirationDateTime > now()
| summarize Indicators = count()
    by ThreatType, SourceSystem

For production correlation, normalize observable values and types, constrain both indicator and event time ranges, and use the current schema exposed by your workspace and connector.

Official lessonQuery and correlate indicators
05 / 06Module assessment

Review CTI source types, reports versus tactical IoCs, connector ingestion, indicator properties and tags, active and expiration filters, and how analytics, hunting, and workbooks operationalize threat intelligence.

Official assessmentThreat intelligence knowledge check
06 / 06Summary and resources

Threat intelligence creates value only when indicators are sourced, normalized, time-bounded, tagged, monitored for quality, and correlated with relevant organizational telemetry.

Official moduleSummary and resources
End of learning pathConfigure your Microsoft Sentinel environment
↑