Microsoft Security Operations Analyst

A SOC that triages everything by hand falls behind. You set automated investigation and response levels, organize device groups, and tune alerts so analysts spend their time on the incidents that need a person.

• Automated investigation and remediation levels
• Device groups and role-based access
• Alert tuning and suppression rules
• Custom detection rules in Defender XDR
• Attack disruption and what it can do on its own

You build A tuning plan for Defender XDR that lowers alert noise without hiding real threats.

How you set up Sentinel decides what it costs and what you can find later. You design workspaces and access, choose table tiers and retention, and install solutions from the content hub.

• Workspace design and Azure RBAC for Sentinel
• Table tiers, retention and the data lake
• Estimating and controlling ingestion cost
• Content hub solutions and templates
• Onboarding Sentinel to the Defender portal

You build A Sentinel deployment plan with workspace layout, roles, retention and a cost estimate.

Detection is only as good as the data behind it. You connect Windows, Linux, Azure and Microsoft 365 sources, route logs through data collection rules, and normalize them so one query works across sources.

• Data connectors for Azure and Microsoft 365
• Windows security events through the Azure Monitor Agent
• Syslog and CEF from Linux and network devices
• Data collection rules and transformations
• Normalization with ASIM parsers
• Checking that data is arriving and complete

You build A set of connected sources with a health query that proves each one is sending data.

Rules turn raw logs into signal. You write scheduled and near-real-time analytics rules, map entities, enrich with watchlists and threat intelligence, and link each rule to the ATT&CK technique it covers.

• Scheduled and near-real-time analytics rules
• Entity mapping and alert grouping
• Watchlists and threat intelligence indicators
• Mapping detections to MITRE ATT&CK
• Testing and tuning a rule against false positives

You build Three custom analytics rules, each mapped to an ATT&CK technique and tested against sample data.

Repeated tasks belong to machines. You build automation rules that route and enrich incidents, write playbooks that block, notify or ticket, and give them only the permissions they need.

• Automation rules: triggers, conditions and actions
• Playbooks built on Logic Apps
• Managed identities and playbook permissions
• Incident tasks and assignment
• Safe automation: approvals before disruptive actions

You build A playbook that enriches an incident, notifies the owner and asks for approval before isolating a device.

Endpoints are where most attacks leave their clearest trail. You read device timelines, use live response to collect evidence, isolate machines, and judge when automated remediation is enough.

• Reading a Defender for Endpoint alert and device timeline
• Live response: commands and file collection
• Isolating a device and restricting apps
• Investigation packages and evidence
• Reviewing automated investigation results

You build An investigation report on a simulated malware incident, with timeline, evidence and containment steps.

Attackers move between mailboxes, accounts and apps, and so must you. You follow a phishing mail to the account it compromised, read risky sign-ins, review cloud app activity, and use Purview Audit to see what a user did.

• Phishing investigation with Defender for Office 365
• Compromised accounts and risky sign-ins
• Defender for Identity signals and lateral movement
• Cloud app activity and OAuth app risks
• Purview Audit for Microsoft 365 activity
• Containing a compromised account

You build A case file that follows one phishing email to a compromised account and the actions taken on it.

Real attacks cross several products at once. You read the incident graph, group related alerts, trace the kill chain from entry to impact, classify the incident and write the review that improves the next response.

• Reading an incident graph and its correlated alerts
• Tracing the attack path across devices, identities and cloud
• Cloud workload alerts from Defender for Cloud
• Classifying, closing and documenting an incident
• Post-incident review and detection gaps

You build A written incident review for a multi-stage attack, with the new detections it calls for.

AI can summarize an incident in seconds, and it can also be wrong. You learn to prompt Security Copilot, use its embedded experiences and agents inside triage, and verify every conclusion against the underlying evidence.

• What Security Copilot does well and where it fails
• Writing prompts for an investigation
• Embedded Copilot in the Defender portal
• Agents that triage and summarize
• Verifying output against raw evidence
• Data access and permission boundaries

You build A short guide for analysts on using Security Copilot in triage, with checks for every AI-written finding.

Hunting starts with a question and ends with a query. You learn Kusto Query Language from filters to joins, then use the advanced hunting tables to test hypotheses and turn good hunts into detections.

• KQL operators: where, summarize, project and extend
• Joins, unions and parsing semi-structured data
• The advanced hunting schema in Defender XDR
• Forming a hunting hypothesis
• Bookmarks, livestream and hunting graphs
• Turning a hunt into a custom detection

You build A hunting query pack for three hypotheses, one of which becomes a detection rule.

Some threats show up only over months of data. You use the data lake for cheap long-term storage, run jobs and summary rules to condense it, and use notebooks to analyze what plain queries cannot.

• What belongs in the data lake and what does not
• KQL jobs over long retention
• Summary rules for cheaper, faster queries
• Notebooks for Python analysis of security data
• Hunting over long periods

You build A summary rule and a notebook that surface a slow, low-volume pattern across months of logs.

One scenario ties the course together. You ingest the data, write the detection, work the incident it raises, hunt for what it missed and automate the repeatable parts, then present what you found and changed.

• Reading the scenario and choosing data sources
• Writing and testing the detection
• Investigating and containing the incident
• Hunting for related activity
• Automating the response and reporting it

You build A full SOC exercise from first alert to closed incident, with detections, hunts and automation documented.