Study workspace

Prepare for SC-200 with a reference that remembers your progress.

All nine learning paths now run in the new architecture. Select one to reveal its brief and modules.

09 / 09

Choose a learning path

0/404 units

01Microsoft Defender XDR6 modules · 53 units · Defender XDR, Defender for Office 365, Entra ID Protection, Defender for Identity, and Defender for Cloud Apps0/53 units complete+

02Microsoft Defender for Endpoint9 modules · 60 units · 5 hr 49 min · Deployment, attack surface reduction, investigations, response, automation, detections, and vulnerability management0/60 units complete+

03Microsoft Defender for Cloud6 modules · 48 units · 4 hr 17 min · Cloud security posture, multicloud onboarding, workload protection, alerts, and response0/48 units complete+

04Create queries for Microsoft Sentinel using KQL4 modules · 29 units · Query construction, aggregation, visualization, multi-table analysis, parsing, and reusable functions0/29 units complete+

05Configure your Microsoft Sentinel environment6 modules · 42 units · SIEM architecture, workspaces, logs, watchlists, threat intelligence, and unified SIEM/XDR0/42 units complete+

06Connect logs to Microsoft Sentinel7 modules · 49 units · Content Hub, Microsoft services, Defender, Windows, CEF, Syslog, and threat intelligence0/49 units complete+

07Create detections and perform investigations using Microsoft Sentinel8 modules · 56 units · Analytics, automation, playbooks, incidents, UEBA, ASIM, workbooks, and content management0/56 units complete−

Learning path 07 · Create detections and perform investigations using Microsoft Sentinel ↗

8 modules · 56 units · Analytics, automation, playbooks, incidents, UEBA, ASIM, workbooks, and content management

Study focus

Detection and response

Build analytics rules, automate triage, run playbooks, and manage security incidents.

Analytics and content

Apply UEBA, ASIM, KQL, workbooks, Content Hub solutions, and repository-based deployment.

8 modules · 56 units

Select one or more modules

Each click adds or removes a module from your workspace. Units remain closed until you open them.

01Threat detection with Microsoft Sentinel analytics0/9 units−02Automation in Microsoft Sentinel0/5 units+03Threat response with Microsoft Sentinel playbooks0/7 units+04Security incident management in Microsoft Sentinel0/7 units+05Identify threats with Behavioral Analytics0/7 units+06Data normalization in Microsoft Sentinel0/8 units+07Query, visualize, and monitor data in Microsoft Sentinel0/8 units+08Manage content in Microsoft Sentinel0/5 units+

Module 1

Threat detection with Microsoft Sentinel analytics

Focus: rule types, templates, custom logic, incident creation, entities, and lifecycle management.

0/9

01 / 09Introduction

Sentinel analytics turns ingested telemetry into alerts and incidents. Choose a detection method, define actionable logic, map entities, tune noise, and maintain the rule as threats and sources evolve.

Official moduleObjectives and prerequisites

02 / 09Exercise - Detect threats with Microsoft Sentinel analytics

Deploy a Sentinel workspace and test VM, install the Azure Activity solution, and connect subscription activity through Azure Policy. Retain the resources for the later detection exercise and monitor Azure cost.

Official exercisePrepare the lab

03 / 09What is Microsoft Sentinel Analytics?

Analytics correlates signals from endpoints, identities, networks, cloud services, and threat intelligence. Use cases include compromised accounts, suspicious behavior, exfiltration, insider threats, incident investigation, and hunting. Filter templates by severity, type, ATT&CK tactics, and source.

Official lessonAnalytics purpose and page

04 / 09Types of analytics rules

Type	Use
Scheduled / NRT	Custom KQL on a schedule or near real time.
Fusion	ML correlation of low-fidelity signals into multistage incidents.
Microsoft security	Incidents from connected Microsoft security alerts.
ML / anomaly	Microsoft-managed behavioral detections.
Threat intelligence	Observable matches against organizational events.

Exam takeaway: scheduled rules are customizable; managed Fusion and ML logic is not.

Official lessonAnalytics rule families

05 / 09Create an analytics rule from templates

Templates expose severity, required sources, ATT&CK mapping, and rule type. Scheduled and Microsoft security templates allow query or alert-filter tuning; Fusion and ML templates are generally enabled or disabled. A disabled Create rule action often indicates a missing connector.

Official lessonTemplate workflow

06 / 09Create an analytics rule from wizard

Define metadata, severity, and ATT&CK mapping.
Enter KQL and set frequency, lookback, threshold, and grouping.
Map query columns to entities and custom details.
Configure incidents and automated response.
Validate and monitor the rule.

Entity mapping powers correlation, graphs, timelines, and investigation pivots.

Official lessonCustom rule wizard

07 / 09Manage analytics rules

Enable, disable, edit, duplicate, export, delete, and monitor rules. Tune KQL, thresholds, grouping, suppression, and exclusions using false-positive and missed-detection evidence. Document ownership, data dependencies, expected volume, and change history.

Official lessonRule lifecycle and tuning

08 / 09Exercise - Detect threats with Microsoft Sentinel analytics

Create a detection for successful Azure VM deletion, map caller and IP entities, generate test activity, and verify the alert and incident.

Official exerciseBuild and validate a detection

09 / 09Summary

Effective analytics begins with the right data, uses the appropriate rule type, maps entities, creates actionable incidents, and is continuously measured and tuned.

Official moduleSummary and assessment

08Perform threat hunting in Microsoft Sentinel4 modules · 25 units · Hunting hypotheses, queries, bookmarks, livestream, search jobs, restored logs, and notebooks0/25 units complete+

09Mitigate threats using Microsoft Purview4 modules · 42 units · DLP alerts, insider risk, Audit, eDiscovery, Defender XDR, and investigation workflows0/42 units complete+