How does SC-200 use Microsoft Sentinel?
SC-200 uses Microsoft Sentinel as the central SIEM and SOAR platform for detection, investigation, and response.
Microsoft Sentinel is a core component of SC-200. The course covers configuring Sentinel workspaces, connecting data sources, creating detections, and managing incidents.Sentinel is also used for automation and threat hunting.
Related Information
- Microsoft Sentinel is the primary SIEM platform.
- Detection and response workflows are covered.
Expert Insight
Sentinel provides centralized visibility across environments.
Topics
Related Answers
How does SC-200 address threat hunting?
SC-200 covers proactive threat hunting using Microsoft Sentinel queries, bookmarks, livestream, and notebooks.
byAlexis HIRSCHHORN
What does the SC-200 course focus on?
SC-200 focuses on investigating, responding to, and hunting cyber threats using Microsoft Sentinel and Microsoft Defender technologies.
byManuel VARTANIAN
What role does KQL play in SC-200?
SC-200 uses KQL to query logs, analyze threats, build detections, and perform threat hunting.
byAlexis HIRSCHHORN