CertifyDeckCargando contenido…
The official Microsoft Certified: Security Operations Analyst Associate syllabus, organized by domain. Check off each point as you review it.
Inicia sesión para guardar tu progreso entre sesiones.
Configure automation for Microsoft Defender XDR and Microsoft Sentinel
Under Settings > Microsoft Defender XDR > Email notifications there are three rule types: Incidents (by alert severity, source and device group), Actions (manual or automated, completed or failed) and Threat analytics (new or updated reports, by type or tag). You need the Manage security settings permission, or Security Administrator or a higher role.
Get incident notifications by email ↗Get email notifications for response actions ↗
Alert tuning rules can hide (Defender for Endpoint alerts only), resolve or convert expected alerts into behaviors; built-in rules do not affect AIR or email notifications. Correlation groups alerts into incidents and merges them unless one is closed or owners or classifications differ; analytics rules are included or excluded with #INC_CORR# or #DONT_CORR#.
Investigate alerts in Microsoft Defender XDR ↗Alert correlation and incident merging in the Microsoft Defender portal ↗
Defender for Endpoint advanced features are turned on under Settings > Endpoints > Advanced features. They include EDR in block mode (works even when the antivirus is passive), auto-resolve alerts, allow or block file, custom network indicators, tamper protection, hiding duplicate devices and restricting correlation to scoped device groups.
Configure advanced features in Microsoft Defender for Endpoint ↗
Settings > Endpoints > Rules manages indicators (files, IPs, URLs and domains, certificates), with actions such as allow, audit, warn or block, plus automation uploads and automation folder exclusions for automated investigation. For IP and URL conflicts Allow wins over Warn and Block; a certificate block indicator overrides a file hash allow indicator.
Overview of indicators in Microsoft Defender for Endpoint ↗Configure automation folder exclusions ↗
Custom data collection extends default telemetry with rules filtered by table, action and conditions; it does not replace it. Events are sent to a Microsoft Sentinel workspace and queried in DeviceCustom* tables. Devices are targeted with dynamic tags from Asset Rule Management, not with manual tags.
Custom data collection in Microsoft Defender for Endpoint ↗Create and manage custom data collection rules in Microsoft Defender for Endpoint ↗
ASR rules in Microsoft Defender Antivirus (Block, Audit, Warn and Not configured modes) require Defender Antivirus active as the primary antivirus, real-time protection and cloud protection. Defender for Endpoint does not deploy them itself: you use Intune or Defender portal endpoint security policies. They are tested in Audit first, except the standard protection rules.
ASR rules overview ↗Manage endpoint security policies in Microsoft Defender for Endpoint ↗
The Action center unifies pending and completed remediation actions: on the Pending tab you approve or reject them, and on the History tab you audit them and undo some (isolate device, quarantine a file, contain user). Email remediation always waits for approval. Automatic attack disruption acts at incident level, is tagged Attack Disruption and supports exclusions.
Go to the Action center to view and approve your automated investigation and remediation tasks ↗Automatic attack disruption in Microsoft Defender ↗
Automatic attack disruption correlates Defender signals into a high-confidence incident and contains the assets the attacker controls (device, user, IP). It needs the relevant Defender products deployed, Standard device discovery to contain devices, and supports excluding users, device groups and IP addresses. Actions are reviewed and undone from the incident or the Action center.
Configure automatic attack disruption in Microsoft Defender XDR ↗Exclude assets from automated response in attack disruption ↗
Defender for Endpoint device groups are defined by rules on device name, domain, tags and OS platform; a device joins only the highest-ranked matching group. Each group sets its automation level (full, semi-automated or no automated response) and can limit access to Microsoft Entra user groups that hold RBAC roles. Unmatched devices land in the ungrouped devices group.
Create and manage device groups in Microsoft Defender for Endpoint ↗Automation levels in automated investigation and remediation ↗
Sentinel automation rules fire when an incident is created or updated or an alert is created, evaluate conditions and run actions in order: assign owner, change status or severity, add tags, add tasks or run a playbook. They can expire, have an order number per trigger type, and can only run playbooks that use the same trigger.
Automate threat response in Microsoft Sentinel with automation rules ↗Create and use Microsoft Sentinel automation rules to manage response ↗
Sentinel playbooks are Azure Logic Apps workflows (Consumption or Standard) that start with an incident, alert or entity trigger. The incident trigger is recommended and is what incident automation rules run. They authenticate with a managed identity or service principal holding Responder or Contributor to change incidents, and Sentinel needs the Automation Contributor role.
Automate Threat Response with Playbooks in Microsoft Sentinel ↗Supported triggers and actions in Microsoft Sentinel playbooks ↗
Configure the Microsoft Sentinel SIEM and platform
Microsoft Sentinel uses Azure RBAC roles: Reader (view), Responder (plus manage incidents), Contributor (plus create resources and install solutions), Playbook Operator (run playbooks) and Automation Contributor (so Sentinel can run playbooks from automation rules). They are best assigned at the resource group; the data lake uses Entra roles such as Security operator.
In Sentinel each table lives in the Analytics tier (analytics retention for rules, hunting and workbooks, plus total retention mirrored to the data lake) or only in the Data lake tier, which is cheaper but offers no real-time analytics. XDR data is kept 30 days in advanced hunting and can be extended. Manage it under Microsoft Sentinel > Configuration > Tables.
Manage data tiers and retention in Microsoft Sentinel ↗Configure Table Settings in Microsoft Sentinel ↗
Sentinel workbooks are based on Azure Monitor workbooks and are Azure resources governed by RBAC. They are created from a template installed with a Content hub solution (save, then edit) or from scratch with Add workbook, using the Logs data source and Log Analytics resource type. ASIM parsers are recommended in queries, and creating or deleting workbooks needs the Workbook Contributor role.
Visualize your Data by using Workbooks in Microsoft Sentinel ↗Commonly used Microsoft Sentinel workbooks ↗
SOC optimization generates tailored recommendations: data value (little-used tables: turn on rules, change plan or stop ingestion), threat-based or risk-based coverage (turn on templates or connect sources) and similar organizations. Each recommendation can be completed, dismissed or reactivated, and it completes itself when the environment makes it irrelevant.
Ingest data into the Microsoft Sentinel SIEM and platform
The connector depends on the source: Windows Security Events via AMA sends security events to SecurityEvent, Windows Forwarded Events (with a WEC) to WindowsEvent, Syslog and CEF via AMA (Linux forwarder) to Syslog and CommonSecurityLog, and Azure services use diagnostic settings. Non-Azure machines need Azure Arc.
Connect Microsoft Sentinel to other Microsoft services with a Windows agent-based data connector ↗Microsoft Sentinel data connectors ↗
The Windows Security Events via AMA connector creates data collection rules (DCRs) that choose the machines and the event set: All, Common, Minimal or Custom using XPath 1.0 queries in the LogName!Query form. The agent filters at the source, writes to SecurityEvent and requires Azure Arc on machines that are not Azure VMs.
Connect Microsoft Sentinel to other Microsoft services with a Windows agent-based data connector ↗Windows security event sets that can be sent to Microsoft Sentinel ↗
With WEF, machines forward events to a Windows Event Collector server through push or pull subscriptions, with Kerberos encryption in a domain and an access list per subscription. WEF is passive: audit policy must be applied separately. For Sentinel, the WEC runs the Azure Monitor Agent and events go to the WindowsEvent table.
Use Windows Event Forwarding to help with intrusion detection ↗Connect Microsoft Sentinel to other Microsoft services with a Windows agent-based data connector ↗
Syslog via AMA and CEF via AMA use the Azure Monitor Agent on a Linux forwarder (or the machine itself) with an rsyslog or syslog-ng daemon. A DCR defines facilities and levels; Syslog goes to the Syslog table and CEF to CommonSecurityLog. Avoid duplicates when using the same facility, and non-Azure forwarders need Azure Arc.
Syslog and Common Event Format (CEF) via AMA connectors for Microsoft Sentinel ↗Ingest syslog and CEF messages to Microsoft Sentinel with the Azure Monitor Agent ↗
The activity log is collected by default, but to analyze it in Sentinel you must send it with a diagnostic setting to the AzureActivity table; resource logs are not collected without one either. At scale, assign an Azure Policy initiative (Owner role at the scope) with a remediation task for existing resources.
Connect Microsoft Sentinel to other Microsoft services by using diagnostic settings-based connections ↗Activity log in Azure Monitor ↗
Threat indicators arrive through the Threat Intelligence - TAXII connector (API root and collection ID), the Defender Threat Intelligence connector, the STIX upload API (Entra app with Microsoft Sentinel Contributor on the workspace, no connector) or the legacy TIP connector, which is being retired. Ingestion rules only affect data connectors.
Threat intelligence in Microsoft Sentinel ↗Connect your threat intelligence platform to Microsoft Sentinel with the upload API (Preview) ↗
Custom tables in a Log Analytics workspace end in _CL (the portal adds the suffix for you; with other methods you type it) and need a TimeGenerated column. Data arrives through a data collection rule whose stream must point at that table, and if you change the schema you must update the rule. Each table uses a plan: Analytics, Basic or Auxiliary / Lake.
Add or Delete Tables and Columns in Azure Monitor Logs ↗Azure Monitor Logs ↗
Configure detections
A custom detection rule is built on an advanced hunting query that should return columns such as Timestamp, ReportId and DeviceId so alerts are tagged correctly. You set the frequency, impacted entities and automatic actions (device, file, user or email). Continuous (NRT) frequency only supports single-table queries without joins or unions.
Create custom detection rules in Microsoft Defender XDR ↗Overview of custom detections in Microsoft Defender XDR ↗
In Hunting > Custom detection rules you see each rule with its last run, the status of that run, the next run and whether it is on. From the details page you can run it right away, edit it, modify its query, turn it off or delete it, and review the alerts and actions it produced. To edit a rule you need permissions on the devices in its scope.
Manage custom detection rules in Microsoft Defender XDR ↗Create custom detection rules in Microsoft Defender XDR ↗
Scheduled rules run a KQL query at intervals with a lookback that must not be shorter than the interval. NRT rules run every minute and query by ingestion time. The threat intelligence, Fusion and ML Behavior Analytics templates create a single rule with little configuration, and Microsoft security rules stop being available once Sentinel is onboarded to the Defender portal.
Threat detection in Microsoft Sentinel ↗Scheduled analytics rules in Microsoft Sentinel ↗
The MITRE ATT&CK page in Microsoft Sentinel shows the coverage of active scheduled and NRT rules by default, and lets you simulate the possible coverage with available detections that are not yet configured. Techniques are assigned to rules, incidents and hunting queries, and from each technique you can jump to its associated hunting queries.
Sentinel anomaly rules use machine learning to set a baseline and record unusual behavior in the Anomalies table, without raising alerts of their own. Built-in rules cannot be edited: you duplicate one, tune the copy in Flighting mode and, if it performs well, switch it to Production, at which point the original moves to Flighting.
Work with anomaly detection analytics rules in Microsoft Sentinel ↗Use customizable anomalies to detect threats in Microsoft Sentinel ↗