Configure Your Microsoft Sentinel Environment

This course introduces Microsoft Sentinel as a cloud and on-premises security information and event management solution, then demonstrates how to plan, create, configure, and manage Sentinel workspaces. It covers data connectors, log querying and retention, analytics, incidents, automation, threat hunting, permissions, and workspace settings.

Syllabus

- Introduction
- Learning objectives
- What is security information and event management?
- What is Microsoft Sentinel
- How Microsoft Sentinel works
- Data connectors
- Querying and log retention
- Analytics rules
- Incidents and investigations
- Automation rules and playbooks
- User entity behavior analytics
- Threat hunting and notebooks
- Threat intelligence and watchlists
- When to use Microsoft Sentinel
- Knowledge check
- Create and manage Microsoft Sentinel workspaces
- Learning objectives
- Plan for the Microsoft Sentinel workspace
- Single-tenant single workspace
- Multi=tenant workspace
- Understand Microsoft Sentinel permissions and roles
- Demo - Create a Microsoft Sentinel workspace
- Manage Microsoft Sentinel settings
- Configure logs
- Summary and conclusions