SC-200: Microsoft Security Operations Analyst

Fundamentals of Microsoft Security Copilot

How Copilot integrates with Defender XDR and Sentinel

Case studies: Copilot use cases in security investigations

Investigating threats using Microsoft Purview Audit logs

Threat investigation via Content Search

Responding to alerts with Purview tools

How Microsoft Defender for Endpoint protects devices

Onboarding devices and configuring detection settings

Investigating domains, IPs, and user activity

Incident response workflows for Endpoint alerts

Enabling and configuring Defender for Cloud

Cloud workload threat detection

Remediating cloud security alerts within the Defender console

QL fundamentals

Filtering search results and working with common operators

Creating queries for analytics and threat hunting

Summarizing and visualizing security data

Creating and configuring a Sentinel workspace

Log Analytics workspace integration

Data ingestion and table structures

Connecting Microsoft Defender and third-party data sources

Connecting Windows and Linux hosts

Connecting Defender XDR & other Microsoft sources

Syslog and Common Event Format (CEF) connectors

Creating and modifying analytics rules

Using rule templates and custom detections

Responding to incidents in Sentinel

Orchestration with playbooks (SOAR)

Workbooks and visualization

Threat hunting methodologies

Using bookmarks and livestream data

Hunting with KQL and notebooks

Review of core components: Defender XDR, Sentinel, Defender for Cloud

Best practices for SOC workflows

Tips for real-world operations and exam success