Study workspace

Prepare for SC-200 with a reference that remembers your progress.

All nine learning paths now run in the new architecture. Select one to reveal its brief and modules.

09 / 09

Choose a learning path

0/404 units
08Perform threat hunting in Microsoft Sentinel4 modules · 25 units · Hunting hypotheses, queries, bookmarks, livestream, search jobs, restored logs, and notebooks0/25 units complete−
Learning path 08 · Perform threat hunting in Microsoft Sentinel ↗

4 modules · 25 units · Hunting hypotheses, queries, bookmarks, livestream, search jobs, restored logs, and notebooks

0%

Study focus

Hunting workflow

Develop hypotheses, manage hunting queries, preserve evidence with bookmarks, and monitor activity with livestream.

Deep investigation

Use search and restore jobs, notebooks, MSTICPy, APIs, and machine learning for advanced hunts.

4 modules · 25 units

Select one or more modules

Each click adds or removes a module from your workspace. Units remain closed until you open them.

04Hunt for threats using notebooks in Microsoft Sentinel0/7 units−
04

Module 4

Hunt for threats using notebooks in Microsoft Sentinel

Focus: Log Analytics APIs, Kqlmagic, MSTICPy, Azure Machine Learning, notebook creation, and reusable investigation code.
0/7
01 / 07Introduction

Notebooks combine executable Python, KQL, visualizations, and narrative in a reproducible investigation. They suit enrichment, data fusion, statistics, graph analysis, machine learning, and workflows that exceed portal-query capabilities.

Official lessonAdvanced hunting objectives
02 / 07Access Azure Sentinel data with external tools

Sentinel data resides in Log Analytics and is accessible through standard APIs. Kqlmagic runs KQL from notebook cells. MSTICPy provides data acquisition, predefined security queries, enrichment, analysis, and visualization for Sentinel, Defender, and other sources.

Official lessonKqlmagic and MSTICPy
03 / 07Hunt with notebooks

Jupyter separates the browser interface from the execution kernel. Sentinel notebook templates run through Azure Machine Learning compute and can use pandas, matplotlib, Bokeh, scikit-learn, MSTICPy, and other Python libraries.

Use Microsoft templates as working examples, adapt them to local schemas, and treat imported community notebooks as code that must be reviewed before execution.

Official lessonNotebook components and uses
04 / 07Create a notebook
  1. Configure an Azure Machine Learning workspace from Sentinel.
  2. Create a notebook from the Getting Started template.
  3. Launch it in Azure ML Studio and provision compute.
  4. Select the supported Python kernel and authenticate.
  5. Initialize MSTICPy and review msticpyconfig.yaml.
  6. Query the Sentinel workspace and stop compute after use.

Compute instances incur cost while running; use least privilege and protect secrets in configuration.

Official lessonAzure ML notebook setup
05 / 07Explore notebook code

Typical code initializes authentication and providers, executes KQL, converts results to pandas data frames, enriches entities with threat intelligence or GeoIP, visualizes timelines or relationships, and records conclusions.

Run cells in order, inspect variables and outputs, pin or document package versions, remove secrets, clear sensitive outputs, and preserve enough narrative for another analyst to reproduce the hunt.

Official lessonInvestigation notebook workflow
06 / 07Module assessment

Review Log Analytics API access, Kqlmagic, MSTICPy capabilities, notebook interface and kernel, Azure ML workspace and compute, authentication, templates, code execution, cost, and reproducibility.

Official assessmentNotebook hunting knowledge check
07 / 07Summary and resources

Notebooks extend Sentinel with programmable acquisition, enrichment, analysis, and visualization. Govern them as investigation code: reviewed, reproducible, least-privileged, cost-aware, and safe for sensitive evidence.

Official lessonSummary and resources
End of learning pathPerform threat hunting in Microsoft Sentinel
↑