Intermediate Level

Microsoft Certified Security Operations Analyst Associate (SC-200)

★ 4.8 (300 learners) 60 hrs total 19 modules

Microsoft Azure Entra ID AKS ChatGPT

Only 7 seats left · Next batch starts 5 Sept 2026

Download Curriculum

60 hrs: of content
19 modules: in curriculum
16 projects: hands-on builds
Intermediate: difficulty

Curriculum covers

Frameworks you'll master

4 tools & frameworks

Microsoft Azure Entra ID AKS ChatGPT

Course Curriculum

19 modules · 60 hours · 24 live sessions

Basics – Security Operations Center (SOC) 1 sessions

Complexity and Cyber Security Challenges
What is a SOC?
SOC Tier Model
Cyber Security Incident Response Process
EDR, XDR, SIEM & SOAR
Blue, Red & Purple Teaming

Basics – Cyber Threat Intelligence (CTI) 1 sessions

What is a Threat?
Intelligence, Threat Intelligence & Cyber Threat Intelligence (CTI)
What is CTI?
Threat, Vulnerability & Risk
ThreatInformed Defense
Tactics, Techniques & Procedures (TTPs)
IOCs & IOAs
Pyramid of Pain
CTI Sources

Basics Vulnerabilities 1 sessions

What is a Vulnerability?
0Common Vulnerabilities and Exposures (CVE)
Common Vulnerability Scoring System (CVSS)

Basics Azure 2 sessions

Cloud Computing Properties
Cloud Computing Types
Azure Global Backbone
Shared Responsibility Model
Azure Resource Hierarchy
Azure Subscription Types
Entra ID Tenants and Azure Subscriptions
Basics – Microsoft Security and Zero Trust
Zero Trust
The Microsoft Security Cosmos
Defending Across Attack Chains
Basics – MITRE ATT&CK
MITRE ATT&CK in the SC200
What is ATT&CK?
Mapping ATT&CK to the Pyramid of Pain
Matrices
Tactics
Techniques
Subtechniques
Tactics, Techniques & Subtechniques
Data Sources
Detections
Mitigations
Groups
Software
Campaigns
Relations
Demo: ATT&CK Enterprise Matrix

SetUp Microsoft Defender for Cloud (MDC) 1 sessions

Demo: Create Resource Group
Demo: Enable All Plans in Defender for Cloud
Demo: Create Sample Alerts

Configure settings in Microsoft Defender XDR 1 sessions

What is Defender XDR?
Demo: Configure Unified RBAC
Demo: Manage Incidents and Alerts
Demo: Configure Microsoft Defender for Endpoint advanced features

Manage assests and environments 2 sessions

Mitigate risk by using Exposure Management (XSPM) in Microsoft Defender XDR
Demo: XSPM Attack Surface
Demo: XSPM Exposure Insights
Demo: XSPM Secure Score
Discover unprotected resources by using Defender for Cloud
Defender for Cloud: CSPM & CWP
Defender for Cloud: What is CSPM?
Defender for Cloud: CSPM Plans
Defender for Cloud: RBAC
Defender for Cloud: Asset Inventory
Demo: Asset Inventory
Defender for Cloud: Security Recommendations
Demo: Security Recommendations
Defender for Cloud: Secure Score
Demo: Secure Score
Defender for Cloud: Remediation
Defender for Cloud: DevOps Security
Azure Arc

Design and configure a Microsoft Sentinel workspace 1 sessions

Plan a Microsoft Sentinel workspace
Demo: Create an Azure Resource Group for Sentinel
Log Analytics
Log Analytics Dedicated Cluster
Demo: Create a Log Analytics Workspace
Demo: Create a Sentinel Workspace
Sentinel RBAC
Demo: Configure Microsoft Sentinel roles
Demo: Connect Sentinel with Defender XDR
Pricing Models
Commitment Tiers
Log Types
Archive and Restore Logs
Demo: Cost Optimization Workbook
LongTerm Retention with Azure Data Explorer
LongTerm Retention with Azure Blob Storage

Ingest Data Sources in Microsoft Sentinel 2 sessions

Overview
Identify data sources to be ingested for Microsoft Sentinel
Demo: Implement and use Content hub solutions
Demo: Ingest CTI into Sentinel
Demo: Verify CTI Ingestion
Demo: Ingesting Entra ID into Sentinel
AMA and DCR
Demo: Ingesting Windows Security Event Logs with AMA and DCR
Monitor and optimize data ingestion
Demo: Monitor and optimize data ingestion
Configure protections in Microsoft Defender Security Technologies
What is Microsoft Defender for Office 365 (MDO)?
MDO: Edge Protection
MDO: Sender Intelligence
MDO: Content Filtering
MDO: Post Delivery Protection
MDO: Preset Security Policies
MDO: AntiPhishing Policy
MDO: AntiSpam Policy
MDO: AntiMalware Policy
MDO: Safe Attachments
MDO: Safe Links
Demo: Tenant Allow/Block Lists
What is Microsoft Defender for Cloud Apps (MDCA)?
MDCA: Cloud App Catalog
MDCA: Cloud App Policies

Configure detections in Microsoft Sentinel 1 sessions

Sentinel Workflow
Configure and manage analytics rules
Demo: Analytic Rules
Scheduled Analytic Rules
Demo: Scheduled Analytic Rules Entra ID
Demo: Scheduled Analytic Rules Windows Security Events
NearRealTimeRules (NRT)
Fusion
ML Behavior Analytics
Threat Intelligence Rules
Microsoft Security Rules
Implement behavioral analytics (UEBA)
Demo: UEBA

Mitigate Threats using Microsoft 365 Defender 4 sessions

Introduction to Threat Protection
Microsoft 365 Defender Suite
Typical Timeline of An Attack
Microsoft 365 Defender Interactive Demonstration
Mitigate incidents using Microsoft 365 Defender Chapter Introduction
How to Create your Playground Lab Environment
Microsoft 365 Defender portal Introduction
Managing Incidents
More about incidents
Simulate Incidents Tor Browser
Managing Incidents
Managing Alerts
Investigating Incidents MITRE ATTACK
Advance Hunting
Advance Hunting Schema
Exploring the Kusto Queries
Microsoft Threat Experts
Microsoft Defender for Office 365 Chapter Introduction
Microsoft Defender for Office 365 Key Capabilities
Microsoft Defender for Office 365 Key Capabilities II
Safeguard Your Organization M365 Defender for O365 Lab I
Investigating a Potential Breach Using Microsoft 365 Defender
Safeguard Your Organization M365 Defender for O365 Lab II
Attack Simulation Lab Activity
Microsoft Defender for Identity Introduction
What is Microsoft Defender for Identity
Microsoft Defender for Identity Key Capabilities
Installing Sensors on Domain Controller 1
Installing Sensors on Domain Controller 2
Capturing Lateral Movements
Threat Hunting Lab
Microsoft Defender for Identity Sensors Architecture
Protect Your Identities with Azure AD Identity Protection Introduction
User Risks & SignIn Risks
User risk policy & Sign in risk policy Lab Activity
Cloud App Security Introduction
The Cloud App Security Framework
Conditional Access App Controls
What is Information Protection?
Insider Risk Management Enable Auditing
Phases of Cloud App security
Cloud App security Phases Lab Activity
Data Loss Prevention Chapter Intro
DLP Alerts
Create Policies for DLP in Compliance Portal
Insider Risk Management
What is Insider Risk
Pain points of a Modern Workplace
Insider Risk management with M365 Defender
Insider Risk Management Permissions
Investigating Suspicious Cloud App Activity & Preventing Data Loss

Create Queries for Microsoft Sentinel using Kusto Query Language 1 sessions

The Construct of KQL Language
Declaring Variables with Let
Search and Where Operator
Extend Operator
Order By Usage
Project Operator
Summarize, Count and DCount Functions
Arg_Max and Arg_Min Functions
Make_List and Make_Set Functions
Render Operator
Bin Function
Union Operator

Respond to alerts and incidents in Microsoft Defender XDR 2 sessions

What is CWP?
Defender for Databases
Defender for Storage
Demo: Create a Storage Account
Demo: Malware Scanning Response with Workflow Automation & Azure Logic Apps
Defender for Containers
Demo: Create an AKS Cluster
Demo: Defender for Containers
Defender for Key Vault
Demo: Defender for Key Vault
Defender for Resource Manager
Email Notifications
Demo: Create Suppression Rules
Workflow Automation
What is Defender for Identity?
Identities are the new security perimeter!
NTLM
PasstheHash Attacks
Kerberos
PassTheTicket Attacks
Brute Force Attacks
Remote Code Execution Attacks

Respond to alerts and incidents in Microsoft Defender for Endpoint 1 sessions

What is Defender for Servers?
Agents
Threat Detection for OS Level
Alerts for Windows Machines
Alerts for Linux Machines
Demo: Create Virtual Machines
Demo: Brute Force SSH
Demo: Perform actions on the device, including live response and isolation

Investigate Microsoft 365 Activities 1 sessions

What is Microsoft Purview?
The New Purview Portal
Demo: Access the Purview Portal
Data Security
Data Security Threats
Purview Sensitive Information Types
Demo: Purview Sensitive Information Types
Purview Sensitivity Labels
Purview Data Loss Prevention (DLP)
Demo: Purview DLP Policies
Purview Audit
Insider Risk Management
Demo: Purview & Defender XDR

Respond to incidents in Microsoft Sentinel 1 sessions

Incident Dashboard
Automation Capabilities in Sentinel
Automation rules
Playbooks
Automation rules vs. Playbooks
Azure Logic Apps
Demo: Playbook with MITRE ATT&CK & ChatGPT
Sentinel REST API

Implement and use Microsoft Copilot for Security 2 sessions

What is GenAI?
What is a Large Language Model (LLM)?
What is a Prompt?
AI Models
LLM Architecture
The Importance of Security in GenAI
Threat Vectors for a GenAI Application
How Adversaries Leverage AI
Shared Responsibility in AI
Microsoft Responsible AI
What is Microsoft Copilot for Security?
From Prompt to Reponse
Architecture
Extending Copilot with Plugins & more
Privacy Implications
Manage permissions and roles in Copilot for Security: Authentication & RBAC
Standalone vs. Embedded Experience
Onboarding Requirements
Demo: Create Compute Capacities
Demo: Setup Copilot for Security
Creating Effective Prompts
Demo: Monitor Copilot for Security capacity and cost
Demo: Create and use promptbooks
Demo: Suspicious Script Analysis Promptbook
Demo: Threat Actor Profile Promptbook
Demo: Vulnerability Impact Assessment Promptbook
Demo: CTI Prompts
Demo: Vulnerability Assessment Prompts
Demo: Purview

Hunts for threats by using KQL 1 sessions

What is Threat Hunting?
Identify threats by using Kusto Query Language (KQL)
Demo: Create custom hunting queries by using KQL
Demo: Interpret threat analytics in the Microsoft Defender portal
Demo: Intel Profiles
Demo: Intel Explorer

Hunts for threats by using Microsoft Sentinel 1 sessions

Demo: Create and manage hunts
Demo: Create and monitor hunting queries
Notebooks
Demo: Notebooks with MSTICPy
CTI in Sentinel
STIX & TAXII
Demo: CTI in Sentinel

Download Full Curriculum

Batch Schedule

⚡ Seats filling fast — only 7 remaining across all batches

Available Batches
Batch Type	Schedule	Duration	Next Start Date	Availability
Weekend	Sat & Sun, 10am–1pm	10 weeks	5 Sept 2026	Available
Weekday	Mon–Fri, 7–9pm	8 weeks	7 Sept 2026	Available
Fast-track	Mon–Sun, 6 hours/day	2 weeks	14 Sept 2026	Available

Ready to Get Started?

Download the curriculum to see every module, batch dates and fees. Book a free 30-minute session with our advisors to get your questions answered.

Book Free Demo

Download the Full Curriculum

See every module, capstone project, and tool covered — free, instant access.

Similar Courses You Might Like

View Course →

Microsoft Azure

microsoft azure

Azure Kubernetes Service with Azure DevOps and Terraform

★ 4.8 · 300 learners · Intermediate

Starts 8 Aug 2026 · ~1–2 months

View Course →

Microsoft Azure

microsoft azure

Microsoft Certified - Security, Compliance & Identity Fundamentals - SC-900

★ 4.8 · 300 learners · Beginner

Starts 15 Aug 2026 · ~1–2 months

View Course →

Microsoft Azure

microsoft azure

Microsoft Certified Azure Administrator Associate (AZ-104)

★ 4.8 · 300 learners · Intermediate

Starts 22 Aug 2026 · ~1–2 months

View Course →

Microsoft Azure

microsoft azure

Microsoft Certified Azure AI Engineer Associate (AI-102)

★ 4.8 · 300 learners · Intermediate

Starts 29 Aug 2026 · ~1–2 months

Book Free Demo