Course Overview

Microsoft Sentinel is a cloud-native SIEM and security analytics platform that helps organizations collect security data, detect threats, investigate incidents, and automate responses across hybrid and cloud environments. Its integration with Azure services, virtual machines, analytics rules, and automation capabilities makes it an important platform for modern Security Operations Centers. This course begins with setting up a Microsoft Sentinel environment, including Resource Groups, Log Analytics Workspaces, Data Collection Endpoints, and RBAC permissions. It then covers Windows and Ubuntu virtual machine preparation, Azure Monitor Agent deployment, Data Collection Rules, log validation, PowerShell auditing, threat detection through analytics rules, and automated incident response using Sentinel playbooks. You will gain practical experience deploying Sentinel, onboarding endpoints, detecting common threats, creating analytics rules, and automating security responses.

What You Will Learn

  • Understand Microsoft Sentinel architecture.
  • Build and configure a complete Sentinel lab.
  • Onboard and monitor data sources.
  • Create and manage analytics rules.
  • Respond to incidents using automation.
  • Use Kusto Query Language (KQL) for investigation.
  • Understand real-world security use cases.

Program Curriculum

  • Meet Your Instructor
  • Lab Infrastructure
  • Training Objectives
  • Chapter 1 Quiz

  • What You’ll Learn in This Module
  • Creating a Resource Group
  • Creating a Log Analytic Workspace
  • Creating a Data Collection Endpoint
  • Enabling Microsoft Sentinel
  • RBAC and Permissions
  • Wrap-up
  • Chapter 2 Quiz

  • What You’ll Learn in This Module
  • Creating a Windows 10 Virtual Machine
  • Creating an Ubuntu 22.04 LTS Virtual Machine
  • Wrap-up
  • Chapter 3 Quiz

  • What You’ll Learn in This Module
  • Installing AMA on Windows 10 Virtual Machine
  • Configuring Data Collection Rule for Windows 10 Virtual Machine
  • Installing AMA on Ubuntu 22.04 LTS Virtual Machine
  • Configuring Data Collection Rule for Ubuntu 22.04 LTS Virtual Machine
  • Wrap-up
  • Chapter 4 Quiz

  • What You’ll Learn in This Module
  • Enabling PowerShell Auditing
  • Creating a Failed Analytic Rule
  • Enabling PowerShell Block Logging
  • Creating a Suspicious PowerShell Analytic Rule
  • Creating a SSH Brute Force Analytic Rule
  • Creating an Impossible Login Location Analytic Rule
  • Wrap-up
  • Chapter 5 Quiz

  • What You’ll Learn in This Module
  • Automation Blade
  • Creating a Playbook
  • Connecting a Playbook
  • Trigger and Test the Playbook
  • Wrap-up
  • Chapter 6 Quiz
Load more modules

Instructor

Yasir Mehmood

Yasir holds industry-recognized certifications including GIAC GCIH, GSEC, GFACT, EC-Council CEH, CompTIA Security+, Microsoft SC-200, and MS-500. His teaching philosophy is simple: learn by doing. Through real-world enterprise labs, practical demonstrations, and step-by-step guidance, he helps learners understand not just how technologies work, but why and where they are applied. His goal is to empower cybersecurity professionals with practical skills, confidence, and expertise to advance their careers.

Join over 1 Million professionals from the most renowned Companies in the world!

certificate

Fastest Way to Level Up Your Cybersecurity Skills

Invest in your future with flexible subscription plans that give you access to the world’s largest online cybersecurity course library. Whether you're exploring cybersecurity courses for beginners or advancing your expertise,
access in-demand courses, practical labs, and CTF challenges designed to support continuous learning.

Monthly Plans
Annual Plans
Save 20% with our annual plans!

Pro

Build your cybersecurity skills with 900+ bite-sized courses and curated learning paths designed for continuous learning.

$ 69.00
Billed monthly or $599.00 billed annually

What is included

  • 880+ Premium Short Courses
  • 70+ Structured Learning Paths
  • Validation of Completion with all courses and learning paths
  • New Courses added every month
Early Access Offer

Pro +

Develop real-world cybersecurity skills through hands-on labs and CTF challenges designed for practical learning.

$ 79.00
Billed monthly or $699.00 billed annually

Everything in Pro, Plus:

  • 1600+ Hands-on lab exercises with guided instructions
  • 150+ CTF Challenges with detailed walkthroughs
  • New Hands-on Labs and Challenges added every month

Related Courses

1 of 50