← Back to courses
Cybersecurity
Microsoft Security Operations Analyst
Microsoft Sentinel, Defender XDR and KQL threat hunting (Exam SC-200)
A lab-based classroom course in working a security operations centre on Microsoft's tools. It follows the three skill areas of the SC-200 study guide (skills as of 21 October 2026): managing a security operations environment, responding to security incidents, and threat hunting.
10Modules
IntermediateLevel
3 monthsDuration
COURSE THUMBNAIL
What you will be able to do
Configure Microsoft Sentinel and Defender XDR for a security operations team
Connect data sources and write detection rules
Investigate and remediate alerts and incidents
Hunt for threats with KQL queries
Automate responses with rules and playbooks
Sit Exam SC-200 having covered every skill area Microsoft lists
Course outline
01
Configuring Microsoft Defender XDR and Defender for Endpoint
02
Setting up Microsoft Sentinel: roles, retention and workbooks
03
Ingesting data into Microsoft Sentinel
04
Detections: analytics rules and the MITRE ATT&CK matrix
05
Automation rules and playbooks
06
Responding to alerts and incidents in Defender XDR
07
Investigating devices with Defender for Endpoint
08
Investigating Microsoft 365 activity with Microsoft Purview
09
Threat hunting with Kusto Query Language (KQL)
10
Review labs and exam practice
Tools you will use
Microsoft SentinelMicrosoft Defender XDRMicrosoft Defender for EndpointMicrosoft PurviewKQLMicrosoft Entra ID
What you need
Security fundamentals (SC-900 or Security+ level)
Basic familiarity with Azure and Microsoft 365
