Welcome to ONLC Training Centers

Express: Microsoft Security Operations Course

Need a price quote?

Follow the link to our self-service price quote form to generate an email with a price quote.

Need a class for a group?

We can deliver this class for your group. Follow the link to request more information.

Email Alert

Receive an email when this class is available as "Ready to Run" or "Early Notice" status.

Train from your home or office

If you have high-speed internet and a computer you can likely take this class from your home or office.


Express: Microsoft Security Operations Course

 

Special Note to New Hampshire Residents
This course has not yet been approved by the New Hampshire Department of Education. Please contact us for an update on when the class will be available in New Hampshire.

Overview

Modernize Microsoft security operations for the AI era. This Express workshop helps SOC analysts, incident responders, and threat hunters triage, investigate, hunt, and automate across Defender XDR, Microsoft Sentinel, Defender for Cloud workload signals, KQL, and Security Copilot-assisted workflows.
A hybrid SOC and analyst acceleration course using SC-200 concepts plus Security Copilot, Defender XDR, Microsoft Sentinel, Defender for Cloud AI workload signals, KQL, AI-era investigations, hunting, and automation. It is not a compressed SC-200 replacement.

Who should attend

SOC analysts, security operations analysts, incident responders, threat hunters, detection engineers, and security engineers supporting Microsoft security operations.

Prerequisites

Security operations fundamentals. Familiarity with Microsoft security tools, logs, incidents, and basic KQL concepts recommended.
Recommended prior course or experience: SC-900 or equivalent security fundamentals; Secure AI and Cloud Workloads Express for architects wanting preventive controls first.

Course Outline

Microsoft security operations landscape

  • SOC analyst role and the security platform
  • Detect, triage, investigate, respond, hunt
  • Defender XDR, Sentinel, and Security Copilot
  • Escalation points and evidence standards

Defender XDR incidents and unified investigation

  • Microsoft Defender portal orientation
  • Incidents, alerts, entities, incident graph
  • Automated investigation and response
  • Advanced hunting across Defender data

Microsoft Sentinel as SIEM and SOAR

  • Data connectors, solutions, and content hub
  • Incidents, case management, and tasks
  • Workbooks, dashboards, and reporting
  • Unified operations in the Defender portal

KQL for detection, analysis, and hunting

  • KQL structure: filters, summarize, joins
  • Sentinel investigation queries
  • Defender advanced hunting queries
  • Turning questions into reusable KQL

Detection engineering and analytics

  • Built-in analytics rules and custom detections
  • Entity mapping, grouping, and tuning
  • Threat intelligence and MITRE ATT&CK
  • Detection lifecycle: query, test, tune, retire

Incident response and remediation

  • Triage severity, confidence, scope, impact
  • Reconstruct attack timelines across tools
  • Containment, remediation, and response
  • Documentation, closure, and lessons learned

Security Copilot-assisted SOC workflows

  • Prompting for summaries and next steps
  • Promptbooks for triage and reporting
  • Copilot with Defender XDR and Sentinel
  • Human validation and analyst accountability

AI workload and cloud signal scenarios

  • Defender for Cloud workload alerts
  • AI workload signals and resource context
  • Pivot from cloud alerts to identity and data
  • Escalation to cloud security architecture

Automation and operational improvement

  • Sentinel automation rules and playbooks
  • SOAR handoffs and approvals
  • Reusable notebooks and query libraries
  • SOC metrics and continuous improvement

Capstone SOC scenario

  • Triage a hybrid endpoint and identity incident
  • Use KQL, Defender, Sentinel, and Copilot
  • Write findings and escalation recommendations

 

View outline in Word

LXSCOP

Attend hands-on, instructor-led Express: Microsoft Security Operations training classes at ONLC's nationwide locations. Not near one of our locations? Attend these same live classes from your home/office PC via our Remote Classroom Instruction (RCI) technology.

For additional training options, check out our list of Courses and select the one that's right for you.

GENERAL INFO

Class Format
Class Policies
Student Reviews


HAVE QUESTIONS?
First Name

Last Name

Company

Phone

Email

Location

Question/Comment



ONLC TRAINING CENTERS
800-288-8221
www.onlc.com