Microsoft Security Operations Analyst Training (SC-200)

Course 8591

  • Duration: 4 days
  • Exam Voucher: Yes
  • Language: English
  • Level: Intermediate

This hands-on, instructor-led course equips learners with the skills to detect, investigate, and respond to cybersecurity threats using Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Defender for Cloud. Participants will gain practical experience in configuring security tools, analyzing threat data using Kusto Query Language (KQL), and applying automation and AI-driven insights to enhance security operations.

Designed for professionals in security operations roles, this course emphasizes real-world scenarios such as incident response, threat hunting, and data loss prevention. Learners will also explore Microsoft Security Copilot and its integration across the Microsoft security ecosystem to streamline investigations and improve threat detection.

Security Operations Analyst Training Delivery Methods

  • In-Person

  • Online

Security Operations Analyst Training Information

By the end of this course, participants will be able to:

  • Configure and operationalize Microsoft Sentinel and Microsoft Defender XDR for threat detection and response.
  • Investigate and remediate security incidents using Microsoft Defender for Endpoint and Microsoft Defender for Cloud.
  • Apply Kusto Query Language (KQL) to analyze security data and build custom queries.
  • Utilize Microsoft Security Copilot to enhance threat analysis and automate security workflows.
  • Implement data connectors and manage cloud security posture across hybrid environments.
  • Conduct threat hunting and manage security incidents using Microsoft Sentinel analytics and playbooks.

Prerequisites

Before attempting SC-200, attendees should have a:

  • Familiarity with Microsoft 365 and Azure services.
  • Basic understanding of cybersecurity concepts and incident response.
  • Experience with IT administration or security operations is recommended.

Exam Information

This course can help you prepare for the following Microsoft role-based certification exam — Exam SC-200: Microsoft Security Operations Analyst

Security Operations Analyst Training Outline

Module 1: Microsoft Defender XDR Threat Protection

  • Use Microsoft Defender XDR to detect and respond to threats.
  • Mitigate incidents across Microsoft Defender products.
  • Remediate risks in Microsoft Defender for Office 365.
  • Manage identity protection with Microsoft Entra.
  • Safeguard cloud apps using Microsoft Defender for Cloud Apps.

Module 2: Microsoft Security Copilot and Generative AI

  • Understand the fundamentals of generative AI and large language models.
  • Describe how Microsoft Security Copilot processes prompts and supports investigations.
  • Explore embedded experiences of Security Copilot across Microsoft security products.
  • Use promptbooks, plugins, and workspaces to enhance threat response.

Module 3: Data Loss Prevention and Insider Risk Management

  • Investigate and respond to DLP alerts using Microsoft Purview and Defender XDR.
  • Analyze insider risk alerts and manage related cases.
  • Conduct audits and eDiscovery searches to support compliance and investigations.

Module 4: Microsoft Defender for Endpoint

  • Deploy and configure Microsoft Defender for Endpoint across devices.
  • Investigate devices, users, and evidence to assess threats.
  • Perform remote actions and automate remediation.
  • Manage alerts, indicators, and vulnerability data.

Module 5: Microsoft Defender for Cloud

  • Plan and enable cloud workload protections.
  • Connect Azure and non-Azure assets to Defender for Cloud.
  • Manage cloud security posture and regulatory compliance.
  • Remediate alerts and generate threat intelligence reports.

Module 6: Kusto Query Language (KQL) Fundamentals

  • Construct basic KQL statements for data analysis.
  • Summarize and visualize query results.
  • Build multi-table queries and extract structured/unstructured data.
  • Create parsers and integrate external data sources.

Module 7: Microsoft Sentinel Overview

  • Understand Microsoft Sentinel architecture and use cases.
  • Create and manage Sentinel workspaces and permissions.
  • Query logs and use watchlists for threat detection.
  • Integrate Microsoft Defender XDR with Sentinel.

Module 8: Data Connectors in Microsoft Sentinel

  • Connect Microsoft services and external data sources to Sentinel.
  • Configure connectors for Windows, Syslog, CEF, and threat intelligence.
  • Manage ingestion and normalization of log data.

Module 9: Threat Detection and Incident Response

  • Create and manage analytics rules in Microsoft Sentinel.
  • Automate incident response using playbooks.
  • Investigate incidents and manage evidence and entities.
  • Use behavioral analytics and anomaly detection.

Module 10: Threat Hunting in Microsoft Sentinel

  • Apply threat hunting concepts and develop hypotheses.
  • Use KQL queries, bookmarks, and livestream for hunting.
  • Conduct long-term searches and use notebooks for advanced analysis.

Need Help Finding The Right Training Solution?

Our training advisors are here for you.

Security Operations Analyst Training FAQs

Yes! This class prepares an attendee for the Microsoft Exam SC-200: Microsoft Security Operations Analyst.

This course is ideal for:

  • Security Operations Analysts seeking hands-on experience with Microsoft security tools.
  • Security Engineers responsible for configuring and managing threat detection systems.
  • IT Professionals transitioning into cybersecurity roles focused on cloud and endpoint protection.

Participants will gain practical skills to secure organizational environments and respond effectively to cyber threats.

Please reach out to info@learningtree.com after your course to obtain your exam voucher.
Chat With Us