Study workspace

Prepare for SC-200 with a reference that remembers your progress.

All nine learning paths now run in the new architecture. Select one to reveal its brief and modules.

09 / 09

Choose a learning path

0/404 units

01Microsoft Defender XDR6 modules · 53 units · Defender XDR, Defender for Office 365, Entra ID Protection, Defender for Identity, and Defender for Cloud Apps0/53 units complete+

02Microsoft Defender for Endpoint9 modules · 60 units · 5 hr 49 min · Deployment, attack surface reduction, investigations, response, automation, detections, and vulnerability management0/60 units complete+

03Microsoft Defender for Cloud6 modules · 48 units · 4 hr 17 min · Cloud security posture, multicloud onboarding, workload protection, alerts, and response0/48 units complete+

04Create queries for Microsoft Sentinel using KQL4 modules · 29 units · Query construction, aggregation, visualization, multi-table analysis, parsing, and reusable functions0/29 units complete+

05Configure your Microsoft Sentinel environment6 modules · 42 units · SIEM architecture, workspaces, logs, watchlists, threat intelligence, and unified SIEM/XDR0/42 units complete+

06Connect logs to Microsoft Sentinel7 modules · 49 units · Content Hub, Microsoft services, Defender, Windows, CEF, Syslog, and threat intelligence0/49 units complete−

Learning path 06 · Connect logs to Microsoft Sentinel ↗

7 modules · 49 units · Content Hub, Microsoft services, Defender, Windows, CEF, Syslog, and threat intelligence

Study focus

Data onboarding

Select and configure connectors for Microsoft services, Defender, Windows, CEF, and Syslog sources.

Collection reliability

Plan agents, data collection rules, forwarding, destination tables, threat indicators, and ingestion validation.

7 modules · 49 units

Select one or more modules

Each click adds or removes a module from your workspace. Units remain closed until you open them.

01Connect data to Microsoft Sentinel using data connectors0/6 units+02Connect Microsoft services to Microsoft Sentinel0/8 units+03Connect Microsoft Defender XDR to Microsoft Sentinel0/8 units+04Connect Windows hosts to Microsoft Sentinel0/7 units−05Connect Common Event Format logs to Microsoft Sentinel0/5 units+06Connect Syslog data sources to Microsoft Sentinel0/7 units+07Connect threat indicators to Microsoft Sentinel0/8 units+

Module 4

Connect Windows hosts to Microsoft Sentinel

Focus: AMA, Data Collection Rules, Azure Arc, event filtering, legacy collection, Windows Event Forwarding, and Sysmon.

0/7

01 / 07Introduction

Windows security events and Sysmon provide authentication, privilege, process, network, registry, file, and system activity needed for host-based detections and investigations.

Official moduleWindows collection objectives

02 / 07Plan for Windows hosts security events connector

Preferred: Windows Security Events via AMA. It uses reusable, scoped DCRs, improves performance and security, and supports source filtering. Non-Azure machines require Azure Arc. The legacy Log Analytics agent was deprecated on August 31, 2024 and should be used only where AMA is unsupported.

For centralized Windows Event Forwarding, deploy the Windows Forwarded Events solution and collect from a Windows Event Collector.

Official lessonAMA, legacy agent, and WEF options

03 / 07Connect using Windows Security Events via AMA

Create a DCR, select Azure VMs or Arc-enabled servers, and choose All, Common, Minimal, or Custom collection. Custom mode accepts XPath 1.0 expressions; the lesson allows up to 20 expressions per box and 100 boxes per rule.

$XPath = '*[System[EventID=1035]]'
Get-WinEvent -LogName 'Application' -FilterXPath $XPath

Test XPath locally before deployment. Filter at source to reduce unnecessary ingestion while preserving required audit and detection events.

Official lessonDCR scope and XPath filtering

04 / 07Connect using the Security Events via Legacy Agent Connector

Set	Coverage
All	All Windows Security and AppLocker events.
Common	Manageable volume with a full user audit trail.
Minimal	Low-volume events most relevant to successful compromise; not a full audit trail.
Custom	Explicit logs and XPath filters.

Events are queried from SecurityEvent. Treat legacy deployment as an exception and plan migration to AMA.

Official lessonLegacy collection sets

05 / 07Collect Sysmon event logs

Sysmon records detailed process creation, network connections, file-time changes, and other system activity. Install and configure Sysmon separately, then use Windows Event Forwarding and an AMA DCR with a custom XPath path:

Microsoft-Windows-Sysmon/Operational!*

The Windows Forwarded Events connector installs AMA where required. Microsoft recommends ASIM normalization for downstream portable analytics.

Official lessonSysmon through WEF and AMA

06 / 07Module assessment

Review AMA versus legacy, Arc requirements, DCR scope, event sets, XPath validation, Windows Event Collector architecture, Sysmon channel collection, and ASIM.

Official assessmentWindows connector knowledge check

07 / 07Summary and resources

Standardize on AMA and DCRs, onboard non-Azure systems with Arc, filter deliberately, and validate that the events needed by analytics and investigations reach the expected table.

Official moduleSummary and resources

07Create detections and perform investigations using Microsoft Sentinel8 modules · 56 units · Analytics, automation, playbooks, incidents, UEBA, ASIM, workbooks, and content management0/56 units complete+

08Perform threat hunting in Microsoft Sentinel4 modules · 25 units · Hunting hypotheses, queries, bookmarks, livestream, search jobs, restored logs, and notebooks0/25 units complete+

09Mitigate threats using Microsoft Purview4 modules · 42 units · DLP alerts, insider risk, Audit, eDiscovery, Defender XDR, and investigation workflows0/42 units complete+