Study workspace

Prepare for SC-200 with a reference that remembers your progress.

All nine learning paths now run in the new architecture. Select one to reveal its brief and modules.

09 / 09

Choose a learning path

0/404 units

01Microsoft Defender XDR6 modules · 53 units · Defender XDR, Defender for Office 365, Entra ID Protection, Defender for Identity, and Defender for Cloud Apps0/53 units complete+

02Microsoft Defender for Endpoint9 modules · 60 units · 5 hr 49 min · Deployment, attack surface reduction, investigations, response, automation, detections, and vulnerability management0/60 units complete+

03Microsoft Defender for Cloud6 modules · 48 units · 4 hr 17 min · Cloud security posture, multicloud onboarding, workload protection, alerts, and response0/48 units complete+

04Create queries for Microsoft Sentinel using KQL4 modules · 29 units · Query construction, aggregation, visualization, multi-table analysis, parsing, and reusable functions0/29 units complete+

05Configure your Microsoft Sentinel environment6 modules · 42 units · SIEM architecture, workspaces, logs, watchlists, threat intelligence, and unified SIEM/XDR0/42 units complete+

06Connect logs to Microsoft Sentinel7 modules · 49 units · Content Hub, Microsoft services, Defender, Windows, CEF, Syslog, and threat intelligence0/49 units complete+

07Create detections and perform investigations using Microsoft Sentinel8 modules · 56 units · Analytics, automation, playbooks, incidents, UEBA, ASIM, workbooks, and content management0/56 units complete−

Learning path 07 · Create detections and perform investigations using Microsoft Sentinel ↗

8 modules · 56 units · Analytics, automation, playbooks, incidents, UEBA, ASIM, workbooks, and content management

Study focus

Detection and response

Build analytics rules, automate triage, run playbooks, and manage security incidents.

Analytics and content

Apply UEBA, ASIM, KQL, workbooks, Content Hub solutions, and repository-based deployment.

8 modules · 56 units

Select one or more modules

Each click adds or removes a module from your workspace. Units remain closed until you open them.

01Threat detection with Microsoft Sentinel analytics0/9 units+02Automation in Microsoft Sentinel0/5 units−03Threat response with Microsoft Sentinel playbooks0/7 units+04Security incident management in Microsoft Sentinel0/7 units+05Identify threats with Behavioral Analytics0/7 units+06Data normalization in Microsoft Sentinel0/8 units+07Query, visualize, and monitor data in Microsoft Sentinel0/8 units+08Manage content in Microsoft Sentinel0/5 units+

Module 2

Automation in Microsoft Sentinel

Focus: automation triggers, conditions, ordered actions, expiration, and incident orchestration.

0/5

01 / 05Introduction

Automation reduces repetitive triage and coordinates consistent incident handling. Automation rules manage incident properties and invoke playbooks for broader response.

Official moduleAutomation objectives

02 / 05Understand automation options

Rules trigger on incident creation or update, or alert creation. Conditions can inspect provider, rule, severity, status, tags, and owner. Native actions assign owners, change status or severity, add tags, and run playbooks. Use playbooks for APIs, enrichment, notification, ticketing, or containment.

Official lessonRules versus playbooks

03 / 05Create automation rules

Select a trigger and scoped conditions.
Add actions in the intended order.
Set order relative to other rules.
Optionally define expiration.
Enable, test, and monitor.

Order matters because an earlier rule can change properties evaluated by a later rule.

Official lessonCreate and prioritize rules

04 / 05Module assessment

Review triggers, conditions, native actions, playbook execution, ordering, expiration, and the boundary between Sentinel automation and Logic Apps.

Official assessmentAutomation knowledge check

05 / 05Summary and resources

Use explicit automation rules for deterministic changes and governed playbooks when a workflow crosses services or requires complex logic.

Official moduleSummary and resources

08Perform threat hunting in Microsoft Sentinel4 modules · 25 units · Hunting hypotheses, queries, bookmarks, livestream, search jobs, restored logs, and notebooks0/25 units complete+

09Mitigate threats using Microsoft Purview4 modules · 42 units · DLP alerts, insider risk, Audit, eDiscovery, Defender XDR, and investigation workflows0/42 units complete+