How does SC-200 address threat hunting?
SC-200 covers proactive threat hunting using Microsoft Sentinel queries, bookmarks, livestream, and notebooks.
The course includes a dedicated module on threat hunting.Participants learn to develop hypotheses, run queries, and use notebooks for advanced analysis.
Related Information
- Threat hunting is a dedicated module.
- Sentinel queries and notebooks are used.
Expert Insight
Threat hunting complements alert-based detection.
“Perform threat hunting in Microsoft Sentinel.”
What's next?
Explore related training
Browse all: Microsoft TrainingsAZ-500: Microsoft Azure Security Technologies
AZ-500 is a four-day course for IT security professionals who secure Microsoft Azure environments. It focuses on implementing security controls, maintaining security posture, and identifying and remediating vulnerabilities.
View courseSC-300: Microsoft Identity and Access Administrator
Four-day course on implementing and managing identity and access solutions using Microsoft Azure AD. Covers identity configuration, conditional access, application access management, and identity governance. Aligned with Microsoft Identity and Access Administrator Associate certification.
View courseSC-400: Microsoft Information Protection Administrator
SC-400 is a two-day course focused on information protection and governance in Microsoft 365 environments. It covers implementing data loss prevention, sensitive information types, sensitivity labels, retention policies, and message encryption.
View courseRelated Answers
What does the SC-200 course focus on?
SC-200 focuses on investigating, responding to, and hunting cyber threats using Microsoft Sentinel and Microsoft Defender technologies.
byManuel VARTANIAN
How does SC-200 use Microsoft Sentinel?
SC-200 uses Microsoft Sentinel as the central SIEM and SOAR platform for detection, investigation, and response.
byAlexis HIRSCHHORN
What role does KQL play in SC-200?
SC-200 uses KQL to query logs, analyze threats, build detections, and perform threat hunting.
byAlexis HIRSCHHORN
More from SC-200: Microsoft Security Operations Analyst
Who should attend the SC-200 Security Operations course?
SC-200 is designed for Security Operations Analysts responsible for monitoring, investigating, and responding to threats.
What does the SC-200 course focus on?
SC-200 focuses on investigating, responding to, and hunting cyber threats using Microsoft Sentinel and Microsoft Defender technologies.
How does SC-200 use Microsoft Sentinel?
SC-200 uses Microsoft Sentinel as the central SIEM and SOAR platform for detection, investigation, and response.
What role does KQL play in SC-200?
SC-200 uses KQL to query logs, analyze threats, build detections, and perform threat hunting.
Browse all FAQs →
Full knowledge base