Configure SIEM Security Operations Using Microsoft Sentinel SC5001 Course in Fairfax

Configure SIEM Security Operations using Microsoft Sentinel (SC-5001) Course Outline

Module 1: Create and Manage Microsoft Sentinel Workspaces

• Plan for the Microsoft Sentinel workspace
• Create a Microsoft Sentinel workspace
• Manage Workspaces Across Tenants using Azure Lighthouse
• Understand Microsoft Sentinel Permissions and Roles
• Manage Microsoft Sentinel Settings
• Configure Logs

Module 2: Connect Microsoft services to Microsoft Sentinel

• Plan for Microsoft Services Connectors
• Connect the Microsoft Office 365 Connector
• Connect the Microsoft Entra Connector
• Connect the Microsoft Entra ID Protection Connector
• Connect the Azure Activity Connector

Module 3: Connect Windows Hosts to Microsoft Sentinel

• Plan for Windows Hosts Security Events Connector
• Connect Using the Windows Security Events Via AMA Connector
• Connect Using the Security Events Via Legacy Agent Connector
• Collect Sysmon Event Logs

Module 4: Threat Detection with Microsoft Sentinel Analytics

• Exercise - Detect Threats with Microsoft Sentinel Analytics
• What is Microsoft Sentinel Analytics?
• Types of Analytics Rules
• Create an Analytics Rule from Templates
• Create an Analytics Rule from Wizard
• Manage Analytics Rules
• Exercise - Detect Threats with Microsoft Sentinel Analytics

Module 5: Automation in Microsoft Sentinel

• Understand Automation Options
• Create Automation Rules

Module 6: Configure SIEM Security Operations using Microsoft Sentinel

• Exercise - Configure SIEM Operations using Microsoft Sentinel
• Exercise - Install Microsoft Sentinel Content Hub Solutions and Data Connectors
• Exercise - Configure a Data Connector Data Collection Rule
• Exercise - Perform a Simulated Attack to Validate the Analytic and Automation Rules

Who Should Attend this Configure SIEM Security Operations using Microsoft Sentinel (SC-5001)?

This Configure SIEM Security Operations using Microsoft Sentinel (SC-5001) Course is designed for anyone who wants to effectively set up and utilise Microsoft Sentinel for Security Information and Event Management (SIEM). However, this training will be beneficial for:

• Cybersecurity Analysts
• Security Operations Centre (SOC) Analysts
• IT Security Engineers
• SIEM Administrators
• Threat Intelligence Analysts
• Network Security Managers
• Compliance and Audit Officers

Prerequisites of the Configure SIEM Security Operations using Microsoft Sentinel (SC-5001) Course

There are no formal prerequisites for attending this Configure SIEM Security Operations using Microsoft Sentinel (SC-5001) Course.

Configure SIEM Security Operations using Microsoft Sentinel (SC-5001) Course Overview

Configure SIEM Security Operations using Microsoft Sentinel (SC-5001) is a focused training course that teaches how to set up and manage Security Information and Event Management (SIEM) operations using Microsoft Sentinel. The importance of this course stems from the growing need to safeguard digital infrastructures and data effectively against increasing cybersecurity threats. For organisations, the training enables the setup of a robust SIEM system that enhances threat detection and response capabilities, crucial for maintaining security and compliance. For individuals, it provides deep insights into cloud-based security operations, enhancing skill sets in a critical area of IT security. Career-wise, the course prepares participants for advanced roles in cybersecurity, such as SIEM administrators, security analysts, or security consultants, where expertise in cutting-edge security technologies is highly valued.

In this course, delegates will learn how to effectively configure and manage Microsoft Sentinel as a SIEM system. They will start by setting up Sentinel workspaces, understanding and managing permissions, and configuring data collection across multiple platforms and services. Delegates will also learn to connect and monitor various data sources, including Microsoft services and third-party applications. This training will be conducted by our highly professional and skilled trainer, who has years of experience in teaching.

Course Objectives

• To deploy Microsoft Sentinel workspaces optimised for organisational needs
• To integrate and manage data connectors from Microsoft services and third parties
• To create advanced analytics rules to detect security threats effectively
• To implement automation for efficient security incident response
• To configure and manage permissions, roles, and settings within Microsoft Sentinel
• To practice and refine security configurations with real-world simulations

After attending this training course, delegates will be able to effectively configure and utilise Microsoft Sentinel as a powerful SIEM tool within their organisations. They will be capable of integrating a variety of data sources, designing sophisticated analytics to monitor security threats, and implementing automated workflows to respond to incidents rapidly.

What’s included in this Configure SIEM Security Operations using Microsoft Sentinel SC5001 Course?

• World-Class Training Sessions from Experienced Instructors
• Configure SIEM Security Operations using Microsoft Sentinel SC5001 Course Certificate
• Digital Delegate Pack