Microsoft Sentinel and Modern SOC Operations in Kuala Lumpur, Malaysia

This course offers a deep dive into Microsoft Sentinel, Microsoft's cloud-native Security Information and Event Management (SIEM) and Security Orchestration Automated Response (SOAR) solution. Participants will learn how to design, deploy, and manage a modern Security Operations Center (SOC) using Sentinel. The curriculum covers threat detection, incident response, automation, and integration with other security tools, empowering learners to build a proactive and efficient security posture.

Introduction to Microsoft Sentinel and Modern SOC

• Overview of SIEM and SOAR
• Evolution of SOC operations
• Microsoft Sentinel architecture and key features
• Licensing and deployment considerations

Hands-on exercises

Workspace Deployment and Configuration

• Creating and managing Sentinel workspaces
• Configuring permissions and roles
• Setting up data retention and archival
• Integrating with Azure Lighthouse

Hands-on exercises

Data Ingestion and Connectors

• Understanding data sources and connectors
• Connecting Microsoft services (Azure AD, Office 365, Defender)
• Connecting third-party solutions (Syslog, CEF, AWS)
• Custom log ingestion using Log Analytics agent

Hands-on exercises

Analytics and Threat Detection

• Built-in analytics rules and templates
• Creating custom analytics rules
• Using KQL for advanced queries
• Managing alert rules and incidents

Hands-on exercises

Incident Management and Investigation

• Incident lifecycle and management
• Investigation tools and graph
• Entity behavior analytics
• Case management and collaboration

Hands-on exercises

Automation and SOAR

• Introduction to automation rules
• Creating and managing playbooks
• Using Logic Apps for automation
• Automating incident response

Hands-on exercises

Threat Intelligence and Hunting

• Integrating threat intelligence feeds
• Using TI indicators in analytics
• Proactive threat hunting with KQL
• Hunting bookmarks and queries

Hands-on exercises

Workbooks, Reporting, and Visualization

• Designing custom workbooks
• Using built-in workbook templates
• Creating dashboards and reports
• Exporting data for external reporting

Hands-on exercises

Compliance, Governance, and Best Practices

• Compliance standards and Sentinel
• Governance policies and RBAC
• Cost management and optimization
• Best practices for SOC operations

Hands-on exercises