Tijekom treninga polaznici će usvojiti vještine i znanja kako umanjiti kibernetičke prijetnje što uključuje istraživanje, pronalaženje i odgovaranje na te prijetnje koristeći tehnologije kao što su Microsoft Sentinel, Microsoft Defender for Cloud i Microsoft 365 Defender.
Polaznici će na ovom treningu usvojiti vještine i znanja konfiguriranja i korištenja Microsoft Sentinela i korištenja Kusto Query Languagea (KQL) za otkrivanje, analizu i izvještavanje. Trening je namijenjen osobama koje rade sa sigurnosnim operacijama.
Što ćete naučiti
- Objasniti kako Microsoft Defender for Endpoint i Microsoft Defender for Identity mogu sanirati rizike u vašem okruženju.
- Upravljati Microsoft Defender for Endpoin okolinom.
- Konfigurirati Attack Surface Reduction pravila na Windows uređajima.
- Koristiti Microsoft Defender for Endpoint.
- Istražiti domene i IP adrese u Microsoft Defender for Endpoint.
- Konfigurirati postavke upozorenja u Microsoft 365 Defenderu.
- Objasniti kako se razvija threat landscape.
- Koristiti napredne opcije u Microsoft 365 Defenderu.
- Upravljati incidentima u Microsoft 365 Defenderu.
- Istražiti DLP upozorenja u Microsoft Defenderu za cloud
- Objasniti vrste radnji koje mogu poduzeti u slučaju upravljanja unutarnjim rizikom.
- Konfigurirati automatsko opskrbljivanje u Microsoft Defenderu za cloud
- Sanirati upozorenja u Microsoft Defenderu za cloud
- Konfigurirati KQL izraze.
- Filtrirati pretraživanja na temelju vremena događaja, ozbiljnosti, domene i drugih relevantnih podataka koristeći KQL.
- Izdvojiti podatke iz nestrukturiranih string polja koristeći KQL.
- Upravljati Microsoft Sentinel radnim prostorom.
- Koristiti KQL za pristup popisu za praćenje u Microsoft Sentinelu.
- Upravljati pokazateljima prijetnji u Microsoft Sentinelu.
- Objasniti razlike između Common Event Formata i Syslog connectora u Microsoft Sentinelu.
- Povezati Azure Windows Virtual Machines s Microsoft Sentinelom.
- Konfigurirati Log Analytics agenta za prikupljanje Sysmon događanja.
- Izraditi nova analitička pravila i upite pomoću čarobnjak (engl. wizard) za analitiku.
- Napraviti priručnik (engl. playbook) za automatizaciju odgovora na incident.
- Koristiti upite (engl. queries) za pronalazak prijetnji.
- Promatrati prijetnje pomoću Livestreama.
Kome je namijenjeno
Microsoft Security Operations Analyst surađuje sa stakeholderima u svrhu osiguranja i zaštite IT sustava unutar organizacije. Njihov je cilj smanjiti organizacijski rizik brzim saniranjem aktivnih napada u okruženju, savjetovanjem o poboljšanju načina zaštite od prijetnji i upućivanjem na kršenje organizacijskih politika. Odgovornosti Microsoft Security Operations Analysta su upravljanje prijetnjama, nadgledanje i odgovaranje na prijetnje korištenjem raznih sigurnosnih rješenja.
Preduvjeti
- Osnovno razumijevanje Microsoft 365.
- Temeljno razumijevanje Microsoft Security Complience and Identity proizvoda.
- Razumijevanje Windows 10 sustava.
- Poznavanje Azure usluga, posebno Azure SQL Database i Azure Storage.
- Poznavanje Azure virtualnih strojeva i virtualnog umrežavanja.
- Osnovno razumijevanje koncepata skriptiranja.
Nastavni plan
-
Pregledaj
- Module 1: Mitigate threats using Microsoft 365 Defender
- Explain how the threat landscape is evolving
- Manage incidents in Microsoft 365 Defender
- Conduct advanced hunting in Microsoft 365 Defender
- Investigate alerts in Microsoft 365 Defender
- Describe the investigation and remediation features of Azure Active Directory Identity Protection
- Explain how Cloud Discovery helps you see what's going on in your organization
- Module 2: Mitigate threats using Microsoft Defender for Endpoint
- Define the capabilities of Microsoft Defender for Endpoint
- Configure Microsoft Defender for Endpoint environment settings
- Configure Attack Surface Reduction rules on Windows devices
- Describe device forensics information collected by Microsoft Defender for Endpoint
- Conduct forensics data collection using Microsoft Defender for Endpoint
- Investigate user accounts in Microsoft Defender for Endpoint
- Manage automation settings in Microsoft Defender for Endpoint
- Manage indicators in Microsoft Defender for Endpoint
- Describe Threat and Vulnerability Management in Microsoft Defender for Endpoint
- Module 3: Mitigate threats using Microsoft Defender for Cloud
- Describe Microsoft Defender for Cloud features
- Explain which workloads are protected by Microsoft Defender for Cloud
- Explain how Microsoft Defender for Cloud protections function
- Configure auto-provisioning in Microsoft Defender for Cloud
- Describe manual provisioning in Microsoft Defender for Cloud
- Connect non-Azure machines to Microsoft Defender for Cloud
- Describe alerts in Microsoft Defender for Cloud
- Remediate alerts in Microsoft Defender for Cloud
- Automate responses in Microsoft Defender for Cloud
- Module 4: Create queries for Microsoft Sentinel using Kusto Query Language (KQL)
- Construct KQL statements
- Search log files for security events using KQL
- Filter searches based on event time, severity, domain, and other relevant data using KQL
- Summarize data using KQL statements
- Render visualizations using KQL statements
- Extract data from unstructured string fields using KQL
- Extract data from structured string data using KQL
- Create Functions using KQL
- Module 5: Configure your Microsoft Sentinel environment
- Identify the various components and functionality of Microsoft Sentinel.
- Identify use cases where Microsoft Sentinel would be a good solution.
- Describe Microsoft Sentinel workspace architecture
- Install Microsoft Sentinel workspace
- Manage an Microsoft Sentinel workspace
- Create a watchlist in Microsoft Sentinel
- Use KQL to access the watchlist in Microsoft Sentinel
- Manage threat indicators in Microsoft Sentinel
- Use KQL to access threat indicators in Microsoft Sentinel
- Module 6: Connect logs to Microsoft Sentinel
- Explain the use of data connectors in Microsoft Sentinel
- Explain the Common Event Format and Syslog connector differences in Microsoft Sentinel
- Connect Microsoft service connectors
- Explain how connectors auto-create incidents in Microsoft Sentinel
- Activate the Microsoft 365 Defender connector in Microsoft Sentinel
- Connect Azure Windows Virtual Machines to Microsoft Sentinel
- Connect non-Azure Windows hosts to Microsoft Sentinel
- Configure Log Analytics agent to collect Sysmon events
- Explain the Common Event Format connector deployment options in Microsoft Sentinel
- Configure the TAXII connector in Microsoft Sentinel
- View threat indicators in Microsoft Sentinel
- Module 7: Create detections and perform investigations using Microsoft Sentinel
- Explain the importance of Microsoft Sentinel Analytics
- Create rules from templates
- Manage rules with modifications.
- Explain Microsoft Sentinel SOAR capabilities
- Create a playbook to automate an incident response
- Investigate and manage incident resolution
- Explain User and Entity Behavior Analytics in Microsoft Sentinel
- Explore entities in Microsoft Sentinel
- Visualize security data using Microsoft Sentinel workbooks
- Module 8: Perform threat hunting in Microsoft Sentinel
- Describe threat hunting concepts for use with Microsoft Sentinel
- Define a threat hunting hypothesis for use in Microsoft Sentinel
- Use queries to hunt for threats
- Observe threats over time with livestream
- Explore API libraries for advanced threat hunting in Microsoft Sentinel
- Create and use notebooks in Microsoft Sentinel
Povezani certifikati
- Certifikacijski ispit: Exam SC-200: Microsoft Security Operations Analyst
- Certifikat: Microsoft Certified: Security Operations Analyst Associate