SC-200: Connect logs to Microsoft Sentinel

Overview

Module 1: Connect data to Microsoft Sentinel using data connectors

Upon completion of this module, the learner will be able to:

Explain the use of data connectors in Microsoft Sentinel
Describe the Microsoft Sentinel data connector providers
Explain the Common Event Format and Syslog connector differences in Microsoft Sentinel

Module 2: Connect Microsoft services to Microsoft Sentinel

Upon completion of this module, the learner will be able to:

Connect Microsoft service connectors
Explain how connectors auto-create incidents in Microsoft Sentinel

Module 3: Connect Microsoft 365 Defender to Microsoft Sentinel

Upon completion of this module, the learner will be able to:

Activate the Microsoft 365 Defender connector in Microsoft Sentinel
Activate the Microsoft Defender for Endpoint connector in Microsoft Sentinel
Activate the Microsoft Defender for Office 365 connector in Microsoft Sentinel

Module 4: Connect Windows hosts to Microsoft Sentinel

Upon completion of this module, the learner will be able to:

Connect Azure Windows Virtual Machines to Microsoft Sentinel
Connect non-Azure Windows hosts to Microsoft Sentinel
Configure Log Analytics agent to collect Sysmon events

Module 5: Connect Common Event Format logs to Microsoft Sentinel

Upon completion of this module, the learner will be able to:

Explain the Common Event Format connector deployment options in Microsoft Sentinel
Run the deployment script for the Common Event Format connector

Module 6: Connect syslog data sources to Microsoft Sentinel

Upon completion of this module, the learner will be able to:

Describe the Syslog connector deployment options in Microsoft Sentinel
Run the connector deployment script to send data to Microsoft Sentinel
Configure the Log Analytics agent integration for Microsoft Sentinel
Create a parse using KQL in Microsoft Sentinel

Module 7: Connect threat indicators to Microsoft Sentinel

Upon completion of this module, the learner will be able to:

Configure the TAXII connector in Microsoft Sentinel
Configure the Threat Intelligence Platform connector in Microsoft Sentinel
View threat indicators in Microsoft Sentinel