book

Microsoft Security Operations Analyst Exam Ref SC-200 Guide - Second Edition

Name: Microsoft Security Operations Analyst Exam Ref SC-200 Guide - Second Edition
ISBN: 9781836204411

by Steve Miles, Junaid Mumtaz, Trevor Stuart, Joe Anich

June 2026

Intermediate to advanced

298 pages

8h 39m

English

Packt Publishing

Read now

Unlock full access

Preface
Free benefits with your book
Part 1: Readiness and Security Operations Foundations
Chapter 1: Preparing for Your Microsoft Exam and SC-200 Objectives
Technical requirementsPreparing for a Microsoft examIntroducing the resources available and accessing Microsoft LearnStudy guide for the SC-200 exam: Microsoft Security Operations AnalystCreating a Microsoft demo tenantSummary
Chapter 2: The Evolution of Security and Security Operations
Understanding the traditional approach to securityIntroducing the modern approach to securityGetting to know traditional SOC issuesTooling, tooling, and toolingAlert fatigueSlow triage timesExploring modern ways to resolve traditional SOC issuesSummary
Part 2: Manage a Security Operations Environment
Chapter 3: Configure the Microsoft Sentinel SIEM and Platform
Specifying Microsoft Sentinel rolesUnderstanding the Microsoft Sentinel RBAC modelUsing built-in Microsoft Sentinel rolesAligning roles to SOC responsibilitiesExtending role assignment across tenantsManaging data retention for XDR and Microsoft Sentinel tables, including analytics, data lake, and XDR tiersConfiguring log analytics workspace retentionUnderstanding data ingestion and retention relationshipsUsing Microsoft Sentinel table plans (Analytics, Basic, Auxiliary)Working with data tiers (analytics tier and data lake tier)Understanding Microsoft Defender XDR data retentionCreating and configuring Microsoft Sentinel workbooksUnderstanding the purpose of workbooksConnecting workbooks to data sourcesUsing built-in workbook templatesDeploying workbooks through Content HubOptimizing the Microsoft Sentinel platform, including SOC optimization recommendationsUnderstanding SOC optimization recommendationsSummaryExam Readiness Drill – Chapter Review QuestionsLink to this Chapter's Quiz
Chapter 4: Ingest Data into Microsoft Sentinel
Selecting data connectors based on data source requirements, including Windows logs and security eventsUnderstanding connector prerequisites and configuration requirementsService-to-service connector prerequisitesAzure resource connector prerequisitesAgent-based connector prerequisitesCollector-based connector prerequisitesUnderstanding data ingestion destination and workspace rolesMulti-workspace and multi-tenant considerationsUnderstanding connector types and data mappingTypes of Microsoft Sentinel connectorsHow connectors map to tables in the workspaceManaging data ingestion volume and cost considerationsBasic logs vs.analytics logsData caps and daily ingestion limitsCommitment tiers and pricing modelsCost optimization techniques in data ingestionConfiguring collection of Windows security events by using Windows Security Events via Azure Monitor Agent, including data collection rulesDeploying AMA to Windows systemsCreating and configuring Data Collection RulesConfiguring Windows Security event collectionPlanning and configuring collection of Windows Security events by using Windows Event Forwarding (WEF)Designing Windows Event Forwarding architectureConfiguring WEF subscriptionsConfiguring event forwarding to collector systemsPlanning and configuring Syslog via AMA and CEF via AMA connectorsConfiguring Syslog data collection using AMAConfiguring Syslog facilities and severity levelsConfiguring Linux-based collectors for Syslog and CEFConfiguring CEF data connectorsConfiguring collection of Azure activities by using Azure Policy and resource diagnostic settingsConfiguring Azure Activity Log ingestionConfiguring resource logs using diagnostic settingsRouting logs to Microsoft Sentinel through workspaceEnforcing logging using Azure PolicyIngesting threat indicators into Microsoft SentinelConnecting threat intelligence platformsTAXII connectorsManual indicator uploadIndicator expirationIndicator scoringThreat intelligence table structureUsing threat indicators in analytics and detectionCreating custom log tables in the workspace to store ingested dataIngesting custom log data into a workspaceMethods for ingesting custom log dataSummaryExam Readiness Drill – Chapter Review QuestionsLink to this Chapter's Quiz
Part 3: Configure and Detect Threats
Chapter 5: Configure Detections
Creating custom detection rules using advanced hunting in Microsoft Defender XDRAdvanced hunting data and query modelConverting hunting queries into detection rulesDetection rule execution configurationAlert generation and investigation contextAutomated response actions in Microsoft Defender XDRManaging custom detection rules in Microsoft Defender XDRDetection rule lifecycle managementDetection tuning and optimizationMonitoring detection effectivenessConfiguring and managing analytics rules in Microsoft Sentinel SIEMAnalytics rule detection model in Microsoft SentinelScheduled analytics rules (KQL-based)Near-real-time (NRT) analytics rulesThreat intelligence analytics rulesMachine learning analytics rulesEntity mapping and investigation contextAlert grouping and incident configurationRule management and tuningAutomation integration (automation rules and playbooks)Analyzing attack vector coverage using MITRE ATT&CK matrixMITRE ATT&CK mapping and coverage modelCoverage visualization in Microsoft SentinelIdentifying and addressing coverage gapsOperational use of MITRE mappingConfiguring anomalies in Microsoft SentinelAnomaly detection model in Microsoft SentinelAnomaly alert generation and investigation contextInterpreting anomaly resultsSummaryExam Readiness Drill – Chapter Review QuestionsLink to this Chapter's Quiz
Chapter 6: Detect Threats by Using Microsoft Defender XDR
Identifying appropriate table to use in a KQL queryAdvanced hunting schema and table structureMapping investigation scenarios to tablesMulti-table scope in advanced huntingIdentifying threats by using KQLFiltering and time scoping in KQLAggregation and pattern detectionCorrelation for threat identificationCreating advanced hunting queriesQuery construction flow in advanced huntingBuilding multi-stage hunting queriesShaping query output for investigationsInterpreting threat analytics in Microsoft Defender XDRPurpose and scope of threat analyticsThreat context and exposure analysisMitigation guidance and prioritizationDistinction from hunting and alertsCreating hunting graphs, including blast radiusGraph-based investigation in Defender XDRExpanding investigations from an alert or entityUnderstanding blast radiusInvestigation context of Defender graphsAnalyzing relationships between entities using Sentinel GraphSentinel Graph data model and scopeRelationship and attack chain modeling across datasetsCross-dataset investigation using Sentinel GraphSummaryExam Readiness Drill – Chapter Review QuestionsLink to this Chapter's Quiz

Chapter 7: Detect Threats by Using the Microsoft Sentinel Platform
Create and monitor hunting queriesHunting queries and the Sentinel hunting workflowData sources for hunting queries (Log Analytics tables)Hunting queries vs analytics rules vs log queriesSaving and reusing hunting queriesUsing bookmarks in hunting investigationsCreate and manage KQL jobs in data lakeData lake tier and archived data in SentinelSearch jobs vs.standard log queriesExecution model of search jobs (asynchronous processing)Search job results and results tablesManaging the search job lifecycleCreate and manage summary rule tables for queryingSummary rules vs.search jobs vs.standard queriesSummary tables and preprocessed dataScheduling and data freshness in summary rulesHunt for threats using notebooks, including connection to Microsoft Sentinel MCP ServerNotebooks vs KQL queries and hunting queriesData enrichment and visualization in notebooksSentinel MCP Server integrationWhen to use notebooks for threat huntingSummaryExam Readiness Drill – Chapter Review QuestionsLink to this Chapter's Quiz
Part 4: Investigate and Respond to Incidents
Chapter 8: Investigate Microsoft 365 Activities to Identify Threats
Investigate threats by using Audit from Microsoft PurviewInitiation and scoping of audit investigationsAudit Standard and Audit Premium investigation impactInterpretation of audit record dataActivity analysis across Microsoft 365 workloadsTimeline reconstruction and event sequencingCorrelation and pivoting across audit recordsValidation of activity and investigation findingsInvestigate threats by using Content Search in Microsoft PurviewContent search scope and limitationsContent search scope and location targetingQuery construction and condition-based filteringContent identification and evidence discoveryAnalysis of retrieved content for investigative contextExport and handling of investigation dataCorrelation of content with audit activitiesInvestigate threats using Microsoft Graph activity logsMicrosoft Graph audit fields used in application investigationsIdentification of application and service principal activitiesAnalysis of API-driven operations across Microsoft 365Permission and access analysisInvestigation of OAuth consent and permission grantsDetection of abnormal application behaviorCorrelation with audit and identity dataSummaryExam Readiness Drill – Chapter Review QuestionsLink to this Chapter's Quiz
Chapter 9: Respond to Alerts and Incidents in Microsoft Defender XDR
Investigating and remediating threats using Microsoft Defender for Office 365Email entity investigation within Defender XDR incidentsAutomated investigation and response (AIR) execution and outcomesAutomatic attack disruption and containment actionsAnalyst-driven validation and remediation decisionsInvestigating and remediating threats or compromised entities identified by Microsoft PurviewAudit log search and activity timeline reconstructionContent search and review using eDiscoveryInsider risk case investigation and activity correlationData loss prevention alert investigation and context analysisPurview-based remediation and response handlingInvestigating and remediating alerts and incidents identified by Microsoft Defender for Cloud workload protectionsWorkload alert interpretation and threat context analysisResource activity investigation and event tracingWorkload-specific threat behavior identificationWorkload remediation and containment actionsSentinel integration for workload alert correlationInvestigating and remediating security risks identified by Microsoft Defender for Cloud AppsCloud app activity analysis and user behavior investigationRisky application and OAuth permissions investigationData access and session activity investigationUser, session, and application remediation actionsCross-signal correlation with identity and endpoint dataInvestigating and remediating compromised identities identified by Microsoft Entra IDRisky user investigation and compromise assessmentRisky sign-in investigation and authentication analysisDifferentiation and validation of identity risk signalsIdentity remediation and risk reduction actionsCorrelation of identity risk with security incidentsInvestigating and remediating security alerts from Microsoft Defender for IdentityIdentity alert analysis and attack technique identificationEntity-based investigation of users and related assetsIdentity-focused detection of lateral movement activitiesCorrelation within Defender XDR incident contextContainment and remediation of identity-based threatsInvestigating and remediating alerts and incidents identified by Microsoft SentinelSentinel incident investigation using aggregated alertsIncident workflow management and trackingAutomated responses using automation rules and playbooksSIEM-based investigation using multisource dataInvestigating incidents using agentic AI, including embedded Copilot for SecurityEmbedded Copilot usage within investigation workflowsAI-assisted incident summarization and data interpretationContext-aware analysis based on security telemetryAnalyst validation and decision-making based on AI outputInvestigating complex attacks, such as multi-stage, multi-domain, and lateral movementsMulti-domain correlation across security data sourcesMulti-stage attack sequence reconstructionLateral movement detection across identities and systemsFull attack scope determination through entity correlationManaging security incidents using case managementCase coordination, task ownership, and lifecycle trackingSummaryExam Readiness Drill – Chapter Review QuestionsLink to this Chapter's Quiz
Chapter 10: Respond to Alerts and Incidents in Microsoft Defender for Endpoint
Investigating device timelinesTimeline access and event scopingEvent correlation within the timelinePivoting from timeline events to entitiesExporting timeline data for analysisPerforming actions on the device, including live response and collecting investigation packagesContainment vs.investigation actions on a deviceDevice isolation and network state controlEndpoint threat control actionsLive response for interactive investigationInvestigation package collection and forensic artifactsAuditing device response actionsPerforming evidence and entity investigationsEvidence and entity identification in investigationsEntity pivoting across investigationsEntity-relationship mappingFile and process investigationUser and network investigationsCorrelating entities in an attack chainInvestigating and remediating incidents identified by automatic attack disruptionIncident correlation and scope definitionIdentifying attacker-controlled assetsAutomatic containment during attack disruptionVisibility of disruption actions within incidentsAnalyst validation and continued investigationRemediation and recovery of affected assetsTracking actions and investigation statesSummaryExam Readiness Drill – Chapter Review QuestionsLink to this Chapter's Quiz
Part 5: Automate Security Operations
Chapter 11: Configure Automation for Microsoft Defender XDR and Microsoft Sentinel
Configure email notifications in Microsoft Defender XDR, including incidents, actions, and threat analyticsNotification trigger sources and event typesConfiguration of notification conditions and severityRecipient targeting and distribution configurationConfigure alert notifications in Microsoft Defender XDR, including tuning, suppression, and correlationAlert generation from detection logic sourcesAlert tuning and sensitivity adjustmentsAlert suppression rule configurationAlert correlation into incidentsConfigure Microsoft Defender for Endpoint advanced featuresIdentification and enabling of advanced featuresConfigure rules settings in Microsoft Defender for EndpointDefinition of detection rules and logic behaviorConfiguration of rule settings and behavior adjustmentsConfigure custom data collection in Microsoft Defender for EndpointDefinition of custom telemetry collection scopeConfiguration of data collection settingsAvailability and usage of collected telemetry in endpoint analysisConfigure security policies for Microsoft Defender for Endpoint, including attack surface reduction (ASR) rulesPolicy definition and assignment to devices and groupsConfiguration of ASR rules within policiesEnforcement behavior of policies and ASR controlsManage automated investigation and response capabilities in Microsoft Defender XDRAutomated investigation workflow executionConfiguration of automation levels and response controlsManagement and review of automated actionsConfigure automatic attack disruption in Microsoft Defender XDRDetection of active attack sequencesExecution of automated disruption actionsSeparation of disruption from investigation workflowsConfigure and manage device groups, permissions, and automation levels in Microsoft Defender for EndpointDevice group creation and classification logicConfiguration of permissions and access controlAssignment and management of automation levelsCreate and configure automation rules in Microsoft SentinelTrigger conditions and incident-based executionConfiguration of rule actions for incident managementSeparation of automation rules from response executionCreate and configure Microsoft Sentinel playbooksPlaybook creation using Logic AppsTriggering mechanisms for playbook executionExecution of response actions across systemsSummaryExam Readiness Drill – Chapter Review QuestionsLink to this Chapter's Quiz
Chapter 12: Unlock Your Exclusive Benefits
Unlock this Book's Free Benefits in 3 Easy Steps
Other Books You May Enjoy
Index

Content preview from Microsoft Security Operations Analyst Exam Ref SC-200 Guide - Second Edition

8 Investigate Microsoft 365 Activities to Identify Threats

At this stage, you are already working through investigations using alerts and platform data. This chapter focuses on Microsoft 365 activity, where investigations rely on audit records, content, and application-driven operations to reconstruct user and application actions.

In this chapter, you will learn how to investigate Microsoft 365 activities to identify threats. It aligns with the SC-200 exam objectives and addresses the following Skills Measured:

Investigate threats by using Audit from Microsoft Purview
Investigate threats by using Content Search in Microsoft Purview
Investigate threats by using Microsoft Graph activity logs

By the end of this chapter, you will be able to work ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Exam Ref SC-200 Microsoft Security Operations Analyst, 2nd Edition

Publisher Resources

ISBN: 9781836204411

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Microsoft Security Operations Analyst Exam Ref SC-200 Guide - Second Edition

by Steve Miles, Junaid Mumtaz, Trevor Stuart, Joe Anich

8

Investigate Microsoft 365 Activities to Identify Threats

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.