Defend against cyberthreats with Microsoft Defender XDR

After completing this course, students will be able:

• Create a Microsoft Defender for Endpoint environment
• Onboard devices to be monitored by Microsoft Defender for Endpoint
• Configure Microsoft Defender for Endpoint environment settings
• Configure alert settings in Microsoft Defender for Endpoint
• Manage indicators in Microsoft Defender for Endpoint
• Configure advanced features of Microsoft Defender for Endpoint
• Manage automation settings in Microsoft Defender for Endpoint
• Use the device page in Microsoft Defender for Endpoint
• Describe device forensics information collected by Microsoft Defender for Endpoint
• Describe behavioral blocking by Microsoft Defender for Endpoint
• Configure the Microsoft Defender XDR environment
• Deploy Microsoft Defender for Endpoint
• Mitigate threats using Microsoft Defender for Endpoint
• Investigate and respond to incidents using Microsoft Defender XDR

Security Operations Analyst
 

• Experience using the Microsoft Defender portal
• Basic understanding of Microsoft Defender for Endpoint
• Basic understanding of Microsoft Sentinel
• Experience using Kusto Query Language (KQL) in Microsoft Sentinel

Mitigate incidents using Microsoft Defender

• Introduction
• Use the Microsoft Defender portal
• Manage incidents
• Investigate incidents
• Manage and investigate alerts
• Manage automated investigations
• Use the action center
• Explore advanced hunting
• Investigate Microsoft Entra sign-in logs
• Understand Microsoft Secure Score
• Analyze threat analytics
• Analyze reports
• Configure the Microsoft Defender portal
• Knowledge check

Deploy the Microsoft Defender for Endpoint environment

• Introduction
• Create your environment
• Understand operating systems compatibility and features
• Onboard devices
• Manage access
• Create and manage roles for role-based access control
• Configure device groups
• Configure environment advanced features
• Knowledge check

Configure for alerts and detections in Microsoft Defender for Endpoint

• Introduction
• Configure advanced features
• Configure alert notifications
• Manage alert suppression
• Manage indicators
• Knowledge check

Configure and manage automation using Microsoft Defender for Endpoint

• Introduction
• Configure advanced features
• Manage automation upload and folder settings
• Configure automated investigation and remediation capabilities
• Block at risk devices
• Knowledge check

Perform device investigations in Microsoft Defender for Endpoint

• Introduction
• Use the device inventory list
• Investigate the device
• Use behavioral blocking
• Detect devices with device discovery
• Knowledge check

Defend against Cyberthreats with Microsoft Defender XDR lab exercises

• Introduction
• Configure the Microsoft Defender XDR environment
• Deploy Microsoft Defender for Endpoint
• Mitigate Attacks with Microsoft Defender for Endpoint
• Summary