Threat Hunting and Incident Response with KQL
Writing KQL, advanced hunting, Sentinel hunting and notebooks, and managing incidents end to end, for the SC-200 exam.
MSAZ-342 12 lessons planned ▶ Video lessons coming soon
Offered by HSM University · Microsoft Certification Prep
Course content
- 1KQL fundamentals for securityComing
- 2Filtering, aggregating and joiningComing
- 3Time series and parsingComing
- 4Advanced hunting in Defender XDRComing
- 5Hunting in SentinelComing
- 6Hunting with the MITRE ATT&CK frameworkComing
- 7Notebooks for investigationComing
- 8Managing incidents and evidenceComing
- 9Security Copilot in investigationsComing
- 10Containment, eradication and recoveryComing
- 11Post-incident reviewComing
- 12A full investigation walkthroughComing
Requirements
- MSAZ-340 Security Operations with Microsoft Defender XDR
- MSAZ-341 Microsoft Sentinel: Data, Detection and Automation
Recommended background. You can start any course at any time.
Description
Writing KQL, advanced hunting, Sentinel hunting and notebooks, and managing incidents end to end, for the SC-200 exam.