- Explain threat hunting concepts in Microsoft Sentinel
Upon completion of this module, the learner is able to:
- Describe threat hunting concepts for use with Microsoft Sentinel
- Define a threat hunting hypothesis for use in Microsoft Sentinel
- Learn how to proactively identify threat behaviors by using Microsoft Sentinel queries.
In this module, you will:
- Use queries to hunt for threats.
- Save key findings with bookmarks.
- Observe threats over time with livestream.
- Use Search jobs in Microsoft Sentinel
After completing this module, you'll be able to:
- Use Search Jobs in Microsoft Sentinel
- Restore archive logs in Microsoft Sentinel
- Hunt for threats using notebooks in Microsoft Sentinel
Upon completion of this module, the learner is able to:
- Explore API libraries for advanced threat hunting in Microsoft Sentinel
- Describe notebooks in Microsoft Sentinel
- Create and use notebooks in Microsoft Sentinel
Overview
Coursera Flash Sale
40% Off Coursera Plus for 3 Months!
Grab it
Syllabus
- Explain threat hunting concepts in Microsoft Sentinel
- Introduction
- Understand cybersecurity threat hunts
- Develop a hypothesis
- Explore MITRE ATT&CK
- Module assessment
- Summary and resources
- Threat hunting with Microsoft Sentinel
- Introduction
- Exercise setup
- Explore creation and management of threat-hunting queries
- Save key findings with bookmarks
- Observe threats over time with livestream
- Exercise - Hunt for threats by using Microsoft Sentinel
- Summary
- Use Search jobs in Microsoft Sentinel
- Introduction
- Hunt with a Search Job
- Restore historical data
- Module assessment
- Summary and resources
- Hunt for threats using notebooks in Microsoft Sentinel
- Introduction
- Access Azure Sentinel data with external tools
- Hunt with notebooks
- Create a notebook
- Explore notebook code
- Module assessment
- Summary and resources