SC-200T00: Microsoft Security Operations Analyst

Module 1: Mitigate Threats Using Microsoft Defender XDR

• Microsoft Defender XDR overview
• Microsoft Defender portal
• Security incidents and alerts
• Incident investigation
• Threat analytics
• Advanced hunting
• Automated investigation and response
• Microsoft Defender XDR incident management
• Cross-domain threat investigation

Module 2: Mitigate Threats Using Microsoft Defender for Endpoint

• Microsoft Defender for Endpoint
• Endpoint security monitoring
• Device inventory and management
• Endpoint alerts and incidents
• Advanced hunting
• Threat and vulnerability management
• Automated investigation and response
• Endpoint attack surface reduction
• Device isolation and remediation

Module 3: Mitigate Threats Using Microsoft Defender for Cloud

• Microsoft Defender for Cloud
• Cloud security posture management
• Secure Score
• Security recommendations
• Workload protection
• Security alerts
• Threat detection
• Cloud workload investigation
• Regulatory compliance
• Defender for Cloud integrations

Module 4: Mitigate Threats Using Microsoft Purview

• Microsoft Purview security and compliance capabilities
• Data Loss Prevention (DLP)
• DLP alerts and investigations
• Insider risk concepts
• Sensitive information protection
• Data security monitoring
• Investigating Purview alerts
• Security and compliance collaboration

Module 5: Mitigate Threats Using Microsoft Security Copilot

• Microsoft Security Copilot fundamentals
• Security Copilot capabilities
• Prompting for security investigations
• Incident investigation assistance
• Threat intelligence analysis
• Security response support
• Copilot integration with Microsoft security products

Module 6: Configure and Manage Microsoft Sentinel

• Microsoft Sentinel architecture
• Sentinel workspaces
• Data connectors
• Log collection
• Analytics and security data
• Content hub
• Workbooks
• Automation rules
• Playbooks
• Incident management
• Microsoft Sentinel integrations

Module 7: Use Kusto Query Language for Security Analysis

• KQL fundamentals
• Searching and filtering security data
• Tables and schemas
• Operators and expressions
• Querying logs
• Joining and summarizing data
• Time-based analysis
• Security investigation queries
• KQL for threat hunting
• KQL jobs and data analysis

Module 8: Detect and Investigate Threats in Microsoft Sentinel

• Analytics rules
• Scheduled detection rules
• Detection engineering
• Incidents and alerts
• Entity investigation
• Investigation graphs
• Threat intelligence
• Hunting queries
• Bookmarks
• Investigation and response workflows

Module 9: Perform Threat Hunting

• Threat hunting methodologies
• Hunting queries
• Proactive threat detection
• KQL-based hunting
• Hunting across Microsoft Sentinel and Defender
• Notebooks
• Threat indicators
• Advanced investigation techniques
• Threat hunting automation

Module 10: Respond to Security Incidents

• Security incident triage
• Incident prioritization
• Alert investigation
• Root-cause analysis
• Incident containment
• Threat remediation
• Automated response
• Playbooks and workflows
• Post-incident activities
• Security reporting

• Security Operations Analysts
• SOC Analysts
• Cybersecurity Analysts
• Incident Response Professionals
• Threat Intelligence Analysts
• Threat Hunters
• Security Engineers
• Cloud Security Professionals
• Azure Security Professionals
• Microsoft 365 Security Professionals
• Security Administrators
• Cybersecurity Consultants
• Professionals responsible for security monitoring, detection, investigation, and incident response
• IT security professionals preparing for the SC-200 examination

• Monitor and investigate threats across cloud, Microsoft 365, endpoints, and on-premises environments.
• Use Microsoft Sentinel for security monitoring, analytics, investigation, and threat hunting.
• Investigate alerts and incidents using Microsoft Defender XDR.
• Detect and respond to endpoint threats using Microsoft Defender for Endpoint.
• Assess and mitigate cloud workload threats using Microsoft Defender for Cloud.
• Use Kusto Query Language (KQL) to analyze security data and develop hunting queries.
• Create and manage detection and analytics rules.
• Perform proactive threat hunting across security environments.
• Investigate and respond to security incidents and alerts.
• Automate security responses using automation rules and playbooks.
• Use Microsoft Purview capabilities to investigate data security and DLP-related threats.
• Apply Microsoft Security Copilot to support security investigations and threat mitigation.
• Develop practical skills for incident triage, investigation, detection engineering, and threat response.
• Build capabilities aligned with the Microsoft Security Operations Analyst role.

• Fundamental understanding of Microsoft security, compliance, and identity solutions.
• Basic knowledge of Microsoft Defender XDR.
• Working knowledge of security operations and incident response.
• Familiarity with Microsoft Azure and Microsoft 365 environments.
• Basic understanding of network security and endpoint security.
• Familiarity with security alerts, incidents, and investigation workflows.
• Basic knowledge of KQL is beneficial but can be developed during the course.
• Understanding of common cybersecurity threats and attack techniques is recommended.
• Familiarity with Microsoft Sentinel and Defender security products is advantageous.

Certification: Microsoft Certified: Security Operations Analyst Associate
Exam: SC-200: Microsoft Security Operations Analyst
Course Duration: 4 Days
Passing Score: 700 or greater