Course Outline
Module 1: Mitigate Threats Using Microsoft Defender
Analyze threat data across domains and rapidly remediate threats using built-in orchestration and automation features in Microsoft 365 Defender. This module covers cybersecurity threats and how the latest threat protection tools from Microsoft can safeguard your organization’s users, devices, and data. You will also learn to use advanced detection and remediation techniques to protect Azure Active Directory identities and applications from compromise.
Lessons
- Introduction to Threat Protection with Microsoft 365
- Mitigate Incidents Using Microsoft 365 Defender
- Remediate Risks with Microsoft Defender for Office 365
- Microsoft Defender for Identity
- Azure AD Identity Protection
- Microsoft Cloud App Security
- Respond to Data Loss Prevention Alerts
- Manage Insider Risk in Microsoft 365
Lab : Mitigate Threats Using Microsoft Defender
- Explore Microsoft 365 Defender
After completing this module, students will be able to:
- Explain how the threat landscape is evolving for government
- Manage incidents in Microsoft 365 Defender for government
- Conduct advanced hunting in Microsoft 365 Defender for government
- Investigate alerts in Microsoft Defender for government
- Describe the investigation and remediation features of Azure Active Directory Identity Protection for government
- Define the Cloud App Security framework for government
- Explain how Cloud Discovery helps you monitor activities within your organization for government
Module 2: Mitigate Threats Using Microsoft 365 Defender for Endpoint
Implement the Microsoft Defender for Endpoint platform to detect, investigate, and respond to advanced threats. This module will help your organization stay secure by teaching you how to deploy the Microsoft Defender for Endpoint environment, including onboarding devices and configuring security settings. You will also learn how to investigate incidents and alerts using Microsoft Defender for Endpoints, perform advanced hunting, consult with threat experts, configure automation in Microsoft Defender for Endpoint, and use Threat and Vulnerability Management to identify environmental weaknesses.
Lessons
- Protect Against Threats with Microsoft Defender for Endpoint
- Deploy the Microsoft Defender for Endpoint Environment
- Implement Windows 10 Security Enhancements
- Perform Device Investigations
- Perform Actions on a Device
- Perform Evidence and Entities Investigations
- Configure for Alerts and Detections
- Manage Insider Risk in Microsoft 365
- Utilize Threat and Vulnerability Management
Lab : Mitigate Threats Using Microsoft 365 Defender for Endpoint
- Deploy Microsoft Defender for Endpoint
- Mitigate Attacks Using Defender for Endpoint
After completing this module, students will be able to:
- Define the capabilities of Microsoft Defender for Endpoint for government
- Configure Microsoft Defender for Endpoint environment settings for government
- Configure Attack Surface Reduction rules on Windows 10 devices for government
- Describe device forensics information collected by Microsoft Defender for Endpoint for government
- Conduct forensics data collection using Microsoft Defender for Endpoint for government
- Investigate user accounts in Microsoft Defender for Endpoint for government
- Manage automation settings in Microsoft Defender for Endpoint for government
- Manage indicators in Microsoft Defender for Endpoint for government
- Describe Threat and Vulnerability Management in Microsoft Defender for Endpoint for government
Module 3: Mitigate Threats Using Azure Defender
Use Azure Defender integrated with Azure Security Center to protect Azure, hybrid cloud, and on-premises workloads. This module covers the purpose of Azure Defender, its relationship to Azure Security Center, and how to enable Azure Defender. You will also learn about the protections and detections provided by Azure Defender for each cloud workload and how to add Azure Defender capabilities to your hybrid environment.
Lessons
- Plan for Cloud Workload Protections Using Azure Defender
- Explain Cloud Workload Protections in Azure Defender
- Connect Azure Assets to Azure Defender
- Connect Non-Azure Resources to Azure Defender
- Remediate Security Alerts Using Azure Defender
Lab : Mitigate Threats Using Azure Defender
- Deploy Azure Defender
- Mitigate Attacks with Azure Defender
After completing this module, students will be able to:
- Describe Azure Defender features for government
- Explain Azure Security Center features for government
- Explain which workloads are protected by Azure Defender for government
- Explain how Azure Defender protections function for government
- Configure auto-provisioning in Azure Defender for government
- Describe manual provisioning in Azure Defender for government
- Connect non-Azure machines to Azure Defender for government
- Describe alerts in Azure Defender for government
- Remediate alerts in Azure Defender for government
- Automate responses in Azure Defender for government
Module 4: Create Queries for Azure Sentinel Using Kusto Query Language (KQL)
Write Kusto Query Language (KQL) statements to query log data and perform detections, analysis, and reporting in Azure Sentinel. This module focuses on the most commonly used operators and provides example KQL statements for security-related table queries. You will learn how basic KQL statement structure forms the foundation for more complex statements, how to summarize and visualize data using KQL, and how to manipulate string data ingested from log sources.
Lessons
- Construct KQL Statements for Azure Sentinel
- Analyze Query Results Using KQL
- Build Multi-Table Statements Using KQL
- Work with Data in Azure Sentinel Using Kusto Query Language
Lab : Create Queries for Azure Sentinel Using Kusto Query Language (KQL)
- Construct Basic KQL Statements
- Analyze Query Results Using KQL
- Build Multi-Table Statements in KQL
- Work with String Data in KQL
After completing this module, students will be able to:
- Construct KQL statements for government
- Search log files for security events using KQL for government
- Filter searches based on event time, severity, domain, and other relevant data using KQL for government
- Summarize data using KQL statements for government
- Render visualizations using KQL statements for government
- Extract data from unstructured string fields using KQL for government
- Extract data from structured string data using KQL for government
- Create Functions using KQL for government
Module 5: Configure Your Azure Sentinel Environment
Get started with Azure Sentinel by properly configuring the Azure Sentinel workspace. Traditional security information and event management (SIEM) systems often require extensive setup and may not be optimized for cloud workloads. Azure Sentinel enables you to quickly gain valuable security insights from your cloud and on-premises data. This module helps you understand the architecture of Azure Sentinel workspaces to ensure they meet your organization’s security operations requirements. You will learn about the tables, fields, and data ingested in your workspace and how to query the most used data tables in Azure Sentinel.
Lessons
- Introduction to Azure Sentinel for government
- Create and Manage Azure Sentinel Workspaces for government
- Query Logs in Azure Sentinel for government
- Use Watchlists in Azure Sentinel for government
- Utilize Threat Intelligence in Azure Sentinel for government
Lab : Configure Your Azure Sentinel Environment
- Create an Azure Sentinel Workspace for government
- Create a Watchlist for government
- Create a Threat Indicator for government
After completing this module, students will be able to:
- Identify the various components and functionality of Azure Sentinel for government
- Identify use cases where Azure Sentinel would be a good solution for government
- Describe Azure Sentinel workspace architecture for government
- Install Azure Sentinel workspace for government
- Manage an Azure Sentinel workspace for government
- Create a watchlist in Azure Sentinel for government
- Use KQL to access the watchlist in Azure Sentinel for government
- Manage threat indicators in Azure Sentinel for government
- Use KQL to access threat indicators in Azure Sentinel for government
Module 6: Connect Logs to Azure Sentinel
Connect data at cloud scale across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds, to Azure Sentinel. The primary approach to connect log data is using the Azure Sentinel provided data connectors. This module provides an overview of available data connectors and covers configuration options and data provided by Azure Sentinel connectors for Microsoft 365 Defender.
Lessons
- Connect Data to Azure Sentinel Using Data Connectors for government
- Connect Microsoft Services to Azure Sentinel for government
- Connect Microsoft 365 Defender to Azure Sentinel for government
- Connect Windows Hosts to Azure Sentinel for government
- Connect Common Event Format Logs to Azure Sentinel for government
- Connect Syslog Data Sources to Azure Sentinel for government
- Connect Threat Indicators to Azure Sentinel for government
Lab : Connect Logs to Azure Sentinel
- Connect Data to Azure Sentinel Using Data Connectors for government
- Connect Windows Devices to Azure Sentinel Using Data Connectors for government
- Connect Linux Hosts to Azure Sentinel Using Data Connectors for government
- Connect Threat Intelligence to Azure Sentinel Using Data Connectors for government
After completing this module, students will be able to:
- Explain the use of data connectors in Azure Sentinel for government
- Explain the differences between Common Event Format and Syslog connector options in Azure Sentinel for government
- Connect Microsoft service connectors for government
- Explain how connectors auto-create incidents in Azure Sentinel for government
- Activate the Microsoft 365 Defender connector in Azure Sentinel for government
- Connect Azure Windows Virtual Machines to Azure Sentinel for government
- Connect non-Azure Windows hosts to Azure Sentinel for government
- Configure Log Analytics agent to collect Sysmon events for government
- Explain the Common Event Format connector deployment options in Azure Sentinel for government
- Configure the TAXII connector in Azure Sentinel for government
- View threat indicators in Azure Sentinel for government
Module 7: Create Detections and Perform Investigations Using Azure Sentinel
Detect previously uncovered threats and rapidly remediate them with built-in orchestration and automation in Azure Sentinel. You will learn how to create Azure Sentinel playbooks to respond to security threats, investigate Azure Sentinel incident management, understand Azure Sentinel events and entities, and discover methods for resolving incidents. Additionally, you will learn how to query, visualize, and monitor data in Azure Sentinel.
Lessons
- Threat Detection with Azure Sentinel Analytics for government
- Threat Response with Azure Sentinel Playbooks for government
- Security Incident Management in Azure Sentinel for government
- Use Entity Behavior Analytics in Azure Sentinel for government
- Query, Visualize, and Monitor Data in Azure Sentinel for government
Lab : Create Detections and Perform Investigations Using Azure Sentinel
- Activate a Microsoft Security Rule for government
- Create a Playbook for government
- Create a Scheduled Query for government
- Understand Detection Modeling for government
- Conduct Attacks for government
- Create Detections for government
- Investigate Incidents for government
- Create Workbooks for government
After completing this module, students will be able to:
- Explain the importance of Azure Sentinel Analytics for government
- Create rules from templates for government
- Manage rules with modifications for government
- Explain Azure Sentinel SOAR capabilities for government
- Create a playbook to automate an incident response for government
- Investigate and manage incident resolution for government
- Explain User and Entity Behavior Analytics in Azure Sentinel for government
- Explore entities in Azure Sentinel for government
- Visualize security data using Azure Sentinel Workbooks for government
Module 8: Perform Threat Hunting in Azure Sentinel
In this module, you will learn to proactively identify threat behaviors by using Azure Sentinel queries. You will also learn how to use bookmarks and livestream to hunt threats and explore notebooks in Azure Sentinel for advanced hunting.
Lessons
- Threat Hunting with Azure Sentinel for government
- Hunt for Threats Using Notebooks in Azure Sentinel for government
Lab : Threat Hunting in Azure Sentinel
- Perform Threat Hunting in Azure Sentinel for government
- Threat Hunting Using Notebooks with Azure Sentinel for government
After completing this module, students will be able to:
- Describe threat hunting concepts for use with Azure Sentinel for government
- Define a threat hunting hypothesis for use in Azure Sentinel for government
- Use queries to hunt for threats for government
- Observe threats over time with livestream for government
- Explore API libraries for advanced threat hunting in Azure Sentinel for government
- Create and use notebooks in Azure Sentinel for government
Requirements
Basic knowledge of Microsoft 365 for government
Fundamental understanding of Microsoft security, compliance, and identity products for government use
Intermediate knowledge of Windows 10 for government operations
Familiarity with Azure services, particularly Azure SQL Database and Azure Storage for government applications
Familiarity with Azure virtual machines and virtual networking for government systems
Basic understanding of scripting concepts for government IT processes
Testimonials (3)
The trainer was very knowledgable and took time to give a very good insight into cyber security issues. A lot of these examples could be used or modified for our learners and create some very engaging lesson activities.
Jenna - Merthyr College
Course - Fundamentals of Corporate Cyber Warfare
Pentester skills what demonstrate teacher
Oleksii Adamovych - EY GLOBAL SERVICES (POLAND) SP Z O O
Course - Ethical Hacker
The instructor has a very wide range of knowledge and is committed to what he does. He is able to interest the listener with his course. The scope of the training fully met my expectations.
