Microsoft Sentinel End-to-End SOC Operations Training

Gain practical skills in Microsoft Sentinel to run complete SOC operations. Learn log onboarding, analytic rules, threat detection, and automation with playbooks. Apply hands-on techniques to monitor, investigate, and respond to security incidents effectively. This course provides a complete, hands-on journey into Microsoft Sentinel and end-to-end SOC operations. It begins with setting up lab infrastructure, creating resource groups, Log Analytics workspaces, and data collection endpoints, and enabling Microsoft Sentinel with proper RBAC and permissions. Learners gain practical experience preparing on-premises virtual machines, including Windows 10 and Ubuntu 22.04 LTS, to simulate real-world environments. Next, the course focuses on log onboarding and validation. Students install the Azure Monitor Agent (AMA), configure data collection rules for multiple VM types, and ensure accurate log ingestion. The course then covers advanced threat detection using analytic rules, including PowerShell auditing, SSH brute force detection, impossible login locations, and suspicious activity monitoring. Each module is reinforced with hands-on labs for practical understanding. Finally, learners explore automation and playbooks to streamline SOC operations. You will create, connect, trigger, and test playbooks, automating responses to alerts and threats. By the end, participants will have the knowledge and practical skills to monitor environments, detect threats, and respond using Microsoft Sentinel, making them confident in end-to-end SOC management and security operations. Ideal for SOC analysts, security engineers, IT administrators, and cloud security professionals. Basic knowledge of Azure, Windows/Linux administration, and cybersecurity fundamentals is recommended. The course uses a hands-on lab-based approach with step-by-step modules. Each section builds practical SOC skills in Sentinel from onboarding to automation. Learners reinforce concepts through real-world scenarios and exercises. This course is based on Microsoft Sentinel End-to-End SOC Operations Training, by Yasir Mehmood. This video is licensed and distributed by Packt. All rights reserved. Packt is one of the world's most prolific publishers of cutting-edge technical content. For over two decades we've made it our mission to curate and publish the knowledge of only the very best technical experts. We focus on real-world courses that help our customers get the job done, with coverage that extends across a wide range of established and cutting-edge technical topics. If you're an individual or an organisation that embraces learning by doing, Packt is the perfect fit for you.