Course curriculum

Microsoft SC-200 Security Operations Analyst

Study guides for the Microsoft SC-200 Security Operations Analyst certification.

8 modules62 lessons

Curriculum

Modules and lessons

← Course library

Module 01

Microsoft Sentinel

20 lessons

01Create and Manage Microsoft Sentinel Hunts – SC-200 Study GuideLearn how to create and manage Microsoft Sentinel hunts, use live streams and bookmarks, track hunt status, evaluate hypotheses, and prepare for SC-200 scenarios.Open lesson →
02Manage and Use Microsoft Sentinel Threat Indicators – SC-200 Study GuideLearn how to manage Microsoft Sentinel threat indicators, CTI objects, relationships, Content Hub solutions, IOC metadata, and SOC investigation decisions for the SC-200 exam.Open lesson →
03Microsoft Sentinel SIEM and SOAR Fundamentals – SC-200 Study GuidePurpose of This Lesson This lesson introduces Microsoft Sentinel as Microsoft’s cloud-native security information and event management and security orchestration, automation, and response platform. For the SC-200 Microsoft Security Operations Analyst exam, Sentinel is one of the most important products to understand because it sits at the center of many SOC workflows. A Microsoft Security […]Open lesson →
04Planning and Creating a Microsoft Sentinel Workspace – SC-200 Study GuidePurpose of This Lesson This lesson explains the foundational setup required before Microsoft Sentinel can be used as a cloud-native SIEM and SOAR platform. The main focus is planning and creating the Log Analytics workspace that Microsoft Sentinel depends on. For the SC-200 exam, this is important because Microsoft Sentinel does not operate in isolation. […]Open lesson →
05Microsoft Sentinel Roles, Permissions, Log Storage, and Retention – SC-200 Study GuidePurpose of This Lesson This lesson focuses on two foundational Microsoft Sentinel administration topics: role-based access control and log storage/retention. For the SC-200 exam, you need to understand more than how to investigate alerts. You also need to know how Microsoft Sentinel is secured, who can perform specific SOC actions, where Sentinel data is stored, […]Open lesson →
06Microsoft Sentinel Workbooks and Custom Dashboards – SC-200 Study GuidePurpose of This Lesson This lesson explains how Microsoft Sentinel workbooks are used to visualize security data, review trends, and build interactive dashboards for SOC monitoring. For the SC-200 exam, you need to understand that workbooks are not detection rules, incidents, or automated response tools. They are primarily used for visual analysis, reporting, dashboarding, and […]Open lesson →
07Microsoft Sentinel Data Connectors and Content Hub – SC-200 Study GuidePurpose of This Lesson This lesson explains how Microsoft Sentinel receives security data from Microsoft services, cloud platforms, on-premises systems, third-party products, and custom applications. For the SC-200 exam, this topic matters because Microsoft Sentinel is only useful when it has the right data sources connected. A Security Operations Analyst must understand how data connectors […]Open lesson →
08Microsoft Sentinel Data Connectors, Azure Monitor Agent, Syslog, and CEF – SC-200 Study GuidePurpose of This Lesson This lesson explains how Microsoft Sentinel collects data from Microsoft services, Azure resources, Windows and Linux systems, and third-party security appliances. For the SC-200 exam, this matters because Microsoft Sentinel is only useful when it has the right data sources connected. A Security Operations Analyst must understand how logs are ingested, […]Open lesson →
09Microsoft Sentinel Syslog, CEF, and Windows Event Collection – SC-200 Study GuidePurpose of This Lesson This lesson explains how Microsoft Sentinel ingests security event data from different operating systems, appliances, and log sources using common logging formats and data connectors. For the SC-200 exam, this topic matters because a Microsoft Security Operations Analyst must understand how data gets into Microsoft Sentinel before it can be used […]Open lesson →
10Microsoft Sentinel Entities and Entity Mapping – SC-200 Study GuidePurpose of This Lesson Microsoft Sentinel entities are one of the core concepts that help transform raw security logs into meaningful investigation context. In a SOC, it is not enough to know that an alert fired. An analyst needs to understand which user, device, IP address, URL, file, or cloud resource was involved. Entities allow […]Open lesson →
11Microsoft Sentinel Analytics Rules – SC-200 Study GuidePurpose of This Lesson Microsoft Sentinel analytics rules are used to detect suspicious activity, anomalies, known attack patterns, and indicators of compromise across connected data sources. For the SC-200 exam, this topic is important because analytics rules are one of the main ways Microsoft Sentinel turns raw security data into actionable alerts and incidents. A […]Open lesson →
12Microsoft Sentinel ASIM Normalization and Parsers – SC-200 Study GuidePurpose of This Lesson This lesson explains ASIM, the Advanced Security Information Model, in Microsoft Sentinel. ASIM matters because Microsoft Sentinel collects security data from many different sources: Microsoft products, on-premises servers, Linux systems, DNS platforms, firewalls, cloud services, endpoint tools, and custom applications. Each source may use different table names, field names, and event […]Open lesson →
13Microsoft Sentinel UEBA and Behavioral Analytics – SC-200 Study GuidePurpose of This Lesson This lesson explains how to implement User and Entity Behavior Analytics, commonly called UEBA, in Microsoft Sentinel. UEBA helps Microsoft Sentinel detect suspicious activity that may not match a simple rule-based detection. Instead of only looking for obvious indicators like repeated failed sign-ins, known malware, or specific attack signatures, UEBA builds […]Open lesson →
14Investigate and Remediate Microsoft Sentinel Incidents – SC-200 Study GuideLearn how to investigate, manage, classify, and remediate Microsoft Sentinel incidents in the Defender portal for the SC-200 exam.Open lesson →
15Microsoft Sentinel Automation Rules and Playbooks – SC-200 Study GuideLearn how Microsoft Sentinel automation rules and Logic Apps playbooks support incident triage, enrichment, integrations, remediation, and SC-200 scenario decisions.Open lesson →
16Create and Configure Microsoft Sentinel Automation Rules – SC-200 Study GuideLearn how to configure Microsoft Sentinel automation rules, including triggers, conditions, actions, execution order, expiration, and SC-200 exam scenarios.Open lesson →
17Create and Configure Microsoft Sentinel Playbooks – SC-200 Study GuideLearn how Microsoft Sentinel playbooks use Azure Logic Apps, managed identities, triggers, templates, connectors, and permissions for SC-200 incident response.Open lesson →
18Run Sentinel Playbooks on On-Premises Resources – SC-200 Study GuideLearn how Microsoft Sentinel playbooks use Azure Automation and Hybrid Runbook Workers to execute secure on-premises response actions for the SC-200 exam.Open lesson →
19Configure Anomaly Detection Analytics Rules – SC-200 Study GuideLearn how Microsoft Sentinel anomaly analytics, UEBA signals, NRT rules, KQL thresholds, and failed-logon detection support SC-200 exam decisions and SOC investigations.Open lesson →
20Customizing Microsoft Sentinel Hunting Queries with KQL – SC-200 Study GuideLearn how to use Microsoft Sentinel GitHub hunting queries in Defender Advanced Hunting, customize KQL time ranges, and avoid SC-200 investigation traps.Open lesson →

Module 02

Microsoft Defender XDR

7 lessons

Module 03

Microsoft Security Copilot

6 lessons

Module 04

Microsoft Defender for Endpoint

7 lessons

Module 05

Microsoft Defender for Office 365

3 lessons

Module 06

Microsoft Defender for Cloud Apps

2 lessons

Module 07

Microsoft Purview

9 lessons

Module 08

KQL and Threat Hunting

8 lessons