Overview

Skills at a glanceManage a security operations environment (20-25%)Configure protections and detections (15-20%)Manage incident response (25-30%)Manage security threats (15-20%)Manage a security operations environmentConfigure settings in Microsoft Defender XDRConfigure alert and vulnerability notification rulesConfigure Microsoft Defender for Endpoint advanced featuresConfigure endpoint rules settingsManage automated investigation and response capabilities in Microsoft Defender XDRConfigure automatic attack disruption in Microsoft Defender XDRManage assets and environmentsConfigure and manage device groups, permissions, and automation levels in Microsoft Defender for EndpointIdentify unmanaged devices in Microsoft Defender for EndpointDiscover unprotected resources by using Defender for CloudIdentify and remediate devices at risk by using Microsoft Defender Vulnerability ManagementMitigate risk by using Exposure Management in Microsoft Defender XDRDesign and configure a Microsoft Sentinel workspacePlan a Microsoft Sentinel workspaceConfigure Microsoft Sentinel rolesSpecify Azure RBAC roles for Microsoft Sentinel configurationDesign and configure Microsoft Sentinel data storage, including log types and log retentionIngest data sources in Microsoft SentinelIdentify data sources to be ingested for Microsoft SentinelImplement and use Content hub solutionsConfigure and use Microsoft connectors for Azure resources, including Azure Policy and diagnostic settingsPlan and configure Syslog and Common Event Format (CEF) event collectionsPlan and configure collection of Windows Security events by using data collection rules, including Windows Event Forwarding (WEF)Create custom log tables in the workspace to store ingested dataMonitor and optimize data ingestionConfigure protections and detectionsConfigure protections in Microsoft Defender security technologiesConfigure policies for Microsoft Defender for Cloud AppsConfigure policies for Microsoft Defender for Office 365Configure security policies for Microsoft Defender for Endpoints, including attack surface reduction (ASR) rulesConfigure cloud workload protections in Microsoft Defender for CloudConfigure detections in Microsoft Defender XDRConfigure and manage custom detection rulesManage alerts, including tuning, suppression, and correlationConfigure deception rules in Microsoft Defender XDRConfigure detections in Microsoft SentinelClassify and analyze data by using entitiesConfigure and manage analytics rulesQuery Microsoft Sentinel data by using ASIM parsersImplement behavioral analyticsManage incident responseRespond to alerts and incidents in the Microsoft Defender portalInvestigate and remediate threats by using Microsoft Defender for Office 365Investigate and remediate ransomware and business email compromise incidents identified by automatic attack disruptionInvestigate and remediate compromised entities identified by Microsoft Purview data loss prevention (DLP) policiesInvestigate and remediate threats identified by Microsoft Purview insider risk policiesInvestigate and remediate alerts and incidents identified by Microsoft Defender for Cloud workload protectionsInvestigate and remediate security risks identified by Microsoft Defender for Cloud AppsInvestigate and remediate compromised identities that are identified by Microsoft Entra IDInvestigate and remediate security alerts from Microsoft Defender for IdentityRespond to alerts and incidents identified by Microsoft Defender for EndpointInvestigate device timelinesPerform actions on the device, including live response and collecting investigation packagesPerform evidence and entity investigationInvestigate Microsoft 365 activitiesInvestigate threats by using the unified audit logInvestigate threats by using Content SearchInvestigate threats by using Microsoft Graph activity logsRespond to incidents in Microsoft SentinelInvestigate and remediate incidents in Microsoft SentinelCreate and configure automation rulesCreate and configure Microsoft Sentinel playbooksRun playbooks on on-premises resourcesImplement and use Microsoft Security CopilotCreate and use promptbooksManage sources for Security Copilot, including plugins and filesIntegrate Security Copilot by implementing connectorsManage permissions and roles in Security CopilotMonitor Security Copilot capacity and costIdentify threats and risks by using Security CopilotInvestigate incidents by using Security CopilotManage security threatsHunt for threats by using Microsoft Defender XDRIdentify threats by using Kusto Query Language (KQL)Interpret threat analytics in the Microsoft Defender portalCreate custom hunting queries by using KQLHunt for threats by using Microsoft SentinelAnalyze attack vector coverage by using the MITRE ATT & CK matrixManage and use threat indicatorsCreate and manage huntsCreate and monitor hunting queriesUse hunting bookmarks for data investigationsRetrieve and manage archived log dataCreate and manage search jobsCreate and configure Microsoft Sentinel workbooksActivate and customize workbook templatesCreate custom workbooks that include KQLConfigure visualizations

Skills

Reviews