Study workspace

Prepare for SC-200 with a reference that remembers your progress.

All nine learning paths now run in the new architecture. Select one to reveal its brief and modules.

09 / 09

Choose a learning path

0/404 units

01Microsoft Defender XDR6 modules · 53 units · Defender XDR, Defender for Office 365, Entra ID Protection, Defender for Identity, and Defender for Cloud Apps0/53 units complete+

02Microsoft Defender for Endpoint9 modules · 60 units · 5 hr 49 min · Deployment, attack surface reduction, investigations, response, automation, detections, and vulnerability management0/60 units complete+

03Microsoft Defender for Cloud6 modules · 48 units · 4 hr 17 min · Cloud security posture, multicloud onboarding, workload protection, alerts, and response0/48 units complete+

04Create queries for Microsoft Sentinel using KQL4 modules · 29 units · Query construction, aggregation, visualization, multi-table analysis, parsing, and reusable functions0/29 units complete+

05Configure your Microsoft Sentinel environment6 modules · 42 units · SIEM architecture, workspaces, logs, watchlists, threat intelligence, and unified SIEM/XDR0/42 units complete+

06Connect logs to Microsoft Sentinel7 modules · 49 units · Content Hub, Microsoft services, Defender, Windows, CEF, Syslog, and threat intelligence0/49 units complete−

Learning path 06 · Connect logs to Microsoft Sentinel ↗

7 modules · 49 units · Content Hub, Microsoft services, Defender, Windows, CEF, Syslog, and threat intelligence

Study focus

Data onboarding

Select and configure connectors for Microsoft services, Defender, Windows, CEF, and Syslog sources.

Collection reliability

Plan agents, data collection rules, forwarding, destination tables, threat indicators, and ingestion validation.

7 modules · 49 units

Select one or more modules

Each click adds or removes a module from your workspace. Units remain closed until you open them.

01Connect data to Microsoft Sentinel using data connectors0/6 units+02Connect Microsoft services to Microsoft Sentinel0/8 units+03Connect Microsoft Defender XDR to Microsoft Sentinel0/8 units+04Connect Windows hosts to Microsoft Sentinel0/7 units+05Connect Common Event Format logs to Microsoft Sentinel0/5 units−06Connect Syslog data sources to Microsoft Sentinel0/7 units+07Connect threat indicators to Microsoft Sentinel0/8 units+

Module 5

Connect Common Event Format logs to Microsoft Sentinel

Focus: CEF via AMA, Linux forwarder design, DCR creation, secure transport, and duplicate prevention.

0/5

01 / 05Introduction

CEF provides a vendor-neutral structured event format over Syslog. Sentinel parses CEF events into CommonSecurityLog, enabling consistent fields across supported security appliances.

Official moduleCEF objectives

02 / 05Plan for Common Event Format connector

CEF via AMA uses a dedicated 64-bit Linux forwarder in Azure, another cloud, or on-premises. Network appliances send CEF/Syslog to rsyslog or syslog-ng; AMA sends the parsed events securely to the Sentinel workspace.

Harden the forwarder, restrict network paths, and configure TLS between sources and forwarder where required. Supported distributions, daemon versions, RFC 3164/5424, sudo permissions, connectivity, and capacity must be validated against current documentation.

Official lessonForwarder architecture and prerequisites

03 / 05Connect your external solution using the CEF connector

Open CEF via AMA and create a DCR.
Select the Linux forwarder resource; AMA installs automatically if absent.
Configure facilities and minimum severities.
Point appliances to the forwarder's TCP or UDP 514 listener.
Validate CommonSecurityLog records and connector health.

If one forwarder handles both CEF and plain Syslog, exclude CEF facilities from the Syslog configuration to prevent duplicate rows in Syslog and CommonSecurityLog.

Official lessonCEF DCR and appliance forwarding

04 / 05Module assessment

Review forwarder placement, AMA and DCR responsibilities, Linux and daemon prerequisites, TLS, port 514, facilities and severities, destination table, and duplicate prevention.

Official assessmentCEF knowledge check

05 / 05Summary and resources

CEF is preferable when the vendor supports it because fields arrive normalized. Secure and monitor the forwarder as critical collection infrastructure.

Official moduleSummary and resources

07Create detections and perform investigations using Microsoft Sentinel8 modules · 56 units · Analytics, automation, playbooks, incidents, UEBA, ASIM, workbooks, and content management0/56 units complete+

08Perform threat hunting in Microsoft Sentinel4 modules · 25 units · Hunting hypotheses, queries, bookmarks, livestream, search jobs, restored logs, and notebooks0/25 units complete+

09Mitigate threats using Microsoft Purview4 modules · 42 units · DLP alerts, insider risk, Audit, eDiscovery, Defender XDR, and investigation workflows0/42 units complete+