Build a strong foundation in Microsoft Sentinel and understand how modern Security Operations Centers use SIEM technology to collect, analyze, detect, investigate, and respond to security threats. This beginner-focused course explains SIEM fundamentals before introducing Microsoft Sentinel as a cloud-native security operations platform. Learners explore how Sentinel ingests security data through data connectors, stores and queries logs using Log Analytics and KQL, visualizes information through workbooks, detects suspicious activity using analytics rules, supports threat hunting and incident investigation, and automates responses using playbooks. The course also explains when Microsoft Sentinel is appropriate for cloud, multi-cloud, hybrid, and on-premises environments, as well as how it works alongside Azure Monitor, Log Analytics, and Microsoft Defender for Cloud.
Course overview
What will learners be able to do?
By the end of this course, learners will be able to:
- Explain what a SIEM is and how it supports Security Operations Center (SOC) activities.
- Describe the role and core capabilities of Microsoft Sentinel.
- Connect and ingest security data from sources such as Azure, Microsoft Defender, AWS, GCP, Syslog, CEF, and threat intelligence feeds.
- Understand how Sentinel stores data in Log Analytics workspaces.
- Use Kusto Query Language (KQL) to query and investigate security data.
- Use Workbooks to visualize logs, incidents, and security trends.
- Understand how analytics rules and alerts help detect suspicious activity.
- Manage and investigate security incidents in Microsoft Sentinel.
- Understand how Sentinel maps entities and supports incident investigation.
- Use automation rules and playbooks to automate security responses.
- Explain how Azure Logic Apps supports Sentinel automation.
- Understand how Microsoft Sentinel supports cloud, multi-cloud, hybrid, and on-premises environments.
- Identify when Microsoft Sentinel is appropriate for an organization’s security operations.
- Understand how Sentinel works alongside Azure Monitor, Log Analytics, and Microsoft Defender for Cloud.
- Describe the complete security operations lifecycle: collect, detect, investigate, and respond.
Step-by-step learning
Enrol to open every lesson and section quiz.
Your instructor
Course instructor
Learner feedback
No reviews yet. Enrolled learners can be the first to share their experience.
Learn together
Ask a question or share something you learned.
