SC-200 · CHEAT SHEET

Microsoft Certified: Security Operations Analyst Associate

Key concepts grouped by official exam weight.

Download as PDF (free, no sign-up)

1. Manage a security operations environment

40–45%

Configure automation for Microsoft Defender XDR and Microsoft Sentinel

Under Settings > Microsoft Defender XDR > Email notifications there are three rule types: Incidents (by alert severity, source and device group), Actions (manual or automated, completed or failed) and Threat analytics (new or updated reports, by type or tag). You need the Manage security settings permission, or Security Administrator or a higher role.
Alert tuning rules can hide (Defender for Endpoint alerts only), resolve or convert expected alerts into behaviors; built-in rules do not affect AIR or email notifications. Correlation groups alerts into incidents and merges them unless one is closed or owners or classifications differ; analytics rules are included or excluded with #INC_CORR# or #DONT_CORR#.
Defender for Endpoint advanced features are turned on under Settings > Endpoints > Advanced features. They include EDR in block mode (works even when the antivirus is passive), auto-resolve alerts, allow or block file, custom network indicators, tamper protection, hiding duplicate devices and restricting correlation to scoped device groups.
Settings > Endpoints > Rules manages indicators (files, IPs, URLs and domains, certificates), with actions such as allow, audit, warn or block, plus automation uploads and automation folder exclusions for automated investigation. For IP and URL conflicts Allow wins over Warn and Block; a certificate block indicator overrides a file hash allow indicator.
Custom data collection extends default telemetry with rules filtered by table, action and conditions; it does not replace it. Events are sent to a Microsoft Sentinel workspace and queried in DeviceCustom* tables. Devices are targeted with dynamic tags from Asset Rule Management, not with manual tags.

Configure the Microsoft Sentinel SIEM and platform

Microsoft Sentinel uses Azure RBAC roles: Reader (view), Responder (plus manage incidents), Contributor (plus create resources and install solutions), Playbook Operator (run playbooks) and Automation Contributor (so Sentinel can run playbooks from automation rules). They are best assigned at the resource group; the data lake uses Entra roles such as Security operator.
In Sentinel each table lives in the Analytics tier (analytics retention for rules, hunting and workbooks, plus total retention mirrored to the data lake) or only in the Data lake tier, which is cheaper but offers no real-time analytics. XDR data is kept 30 days in advanced hunting and can be extended. Manage it under Microsoft Sentinel > Configuration > Tables.
Sentinel workbooks are based on Azure Monitor workbooks and are Azure resources governed by RBAC. They are created from a template installed with a Content hub solution (save, then edit) or from scratch with Add workbook, using the Logs data source and Log Analytics resource type. ASIM parsers are recommended in queries, and creating or deleting workbooks needs the Workbook Contributor role.
SOC optimization generates tailored recommendations: data value (little-used tables: turn on rules, change plan or stop ingestion), threat-based or risk-based coverage (turn on templates or connect sources) and similar organizations. Each recommendation can be completed, dismissed or reactivated, and it completes itself when the environment makes it irrelevant.

Ingest data into the Microsoft Sentinel SIEM and platform

The connector depends on the source: Windows Security Events via AMA sends security events to SecurityEvent, Windows Forwarded Events (with a WEC) to WindowsEvent, Syslog and CEF via AMA (Linux forwarder) to Syslog and CommonSecurityLog, and Azure services use diagnostic settings. Non-Azure machines need Azure Arc.
The Windows Security Events via AMA connector creates data collection rules (DCRs) that choose the machines and the event set: All, Common, Minimal or Custom using XPath 1.0 queries in the LogName!Query form. The agent filters at the source, writes to SecurityEvent and requires Azure Arc on machines that are not Azure VMs.
With WEF, machines forward events to a Windows Event Collector server through push or pull subscriptions, with Kerberos encryption in a domain and an access list per subscription. WEF is passive: audit policy must be applied separately. For Sentinel, the WEC runs the Azure Monitor Agent and events go to the WindowsEvent table.
Syslog via AMA and CEF via AMA use the Azure Monitor Agent on a Linux forwarder (or the machine itself) with an rsyslog or syslog-ng daemon. A DCR defines facilities and levels; Syslog goes to the Syslog table and CEF to CommonSecurityLog. Avoid duplicates when using the same facility, and non-Azure forwarders need Azure Arc.
The activity log is collected by default, but to analyze it in Sentinel you must send it with a diagnostic setting to the AzureActivity table; resource logs are not collected without one either. At scale, assign an Azure Policy initiative (Owner role at the scope) with a remediation task for existing resources.

Configure detections

A custom detection rule is built on an advanced hunting query that should return columns such as Timestamp, ReportId and DeviceId so alerts are tagged correctly. You set the frequency, impacted entities and automatic actions (device, file, user or email). Continuous (NRT) frequency only supports single-table queries without joins or unions.
In Hunting > Custom detection rules you see each rule with its last run, the status of that run, the next run and whether it is on. From the details page you can run it right away, edit it, modify its query, turn it off or delete it, and review the alerts and actions it produced. To edit a rule you need permissions on the devices in its scope.
Scheduled rules run a KQL query at intervals with a lookback that must not be shorter than the interval. NRT rules run every minute and query by ingestion time. The threat intelligence, Fusion and ML Behavior Analytics templates create a single rule with little configuration, and Microsoft security rules stop being available once Sentinel is onboarded to the Defender portal.
The MITRE ATT&CK page in Microsoft Sentinel shows the coverage of active scheduled and NRT rules by default, and lets you simulate the possible coverage with available detections that are not yet configured. Techniques are assigned to rules, incidents and hunting queries, and from each technique you can jump to its associated hunting queries.
Sentinel anomaly rules use machine learning to set a baseline and record unusual behavior in the Anomalies table, without raising alerts of their own. Built-in rules cannot be edited: you duplicate one, tune the copy in Flighting mode and, if it performs well, switch it to Production, at which point the original moves to Flighting.

2. Respond to security incidents

35–40%

Respond to alerts and incidents in Microsoft Defender XDR

AIR in Defender for Office 365 Plan 2 investigates alerts such as user submissions and queues remediation actions, such as soft deleting emails or clusters, for SecOps to approve. In Threat Explorer you can start an investigation manually. Automatic attack disruption contains users and devices at the incident level and the team can undo its actions.
With Data sharing turned on in Insider Risk Management, insider risk alerts reach the Defender alert and incident queues, grouped by user and correlated with DLP or Entra ID alerts. Viewing them requires a Defender role plus membership in an Insider Risk Management role group. In Purview you confirm an alert and create a case, or dismiss it; advanced hunting uses AlertInfo, DataSecurityEvents and DataSecurityBehaviors.
Defender for Cloud alerts come from the workload protection plans, are prioritized by severity and are correlated into incidents. The Take action tab offers mitigation steps, recommendations, a logic app trigger and a suppression rule; workflow automation runs logic apps automatically. For containers, the Defender portal can isolate, restrict or terminate pods.
In Defender for Cloud Apps every anomaly alert is classified as a true positive, benign true positive or false positive, and the guidance gives the recommended remediation, such as suspending the user, resetting the password or confirming the user as compromised. Risky OAuth apps are found by filtering on permission level and community use, then revoked or banned.
Entra ID Protection separates user risk from sign-in risk. The first option is self-remediation through Conditional Access (MFA or a secure password change); when that is not possible, an administrator resets the password, blocks the user or revokes sessions. After investigating, the risk is marked compromised, safe or dismissed; dismissing does not change the password.

Respond to alerts and incidents in Microsoft Defender for Endpoint

A device timeline shows the events and alerts observed on the device in chronological order. You can filter by date, flag events, view the process tree and MITRE ATT&CK techniques, and use Hunt for related events to query nearby events on the same endpoint. Firewall events require the Windows audit policy to be enabled.
From the device page you can isolate it while keeping its connection to Defender for Endpoint, restrict app execution, run an antivirus scan or collect a zipped investigation package. Live response offers a remote console with basic and advanced commands, and scripts must be uploaded to the library before the run command can execute them.
Defender for Endpoint provides entity pages for files, IP addresses, URLs and domains, and user accounts that show related alerts and the organization devices involved. From a file you can run deep analysis, stop and quarantine it, or create a block indicator. IP and URL search only returns entities observed on devices in the organization.
Automatic attack disruption correlates signals from several products and, with high confidence, contains devices, IPs and users to stop lateral movement. The incident shows the Attack Disruption tag and the status of the assets. After investigating, you release assets from the incident or the Action center, and you can track results in advanced hunting.

Investigate Microsoft 365 activities to identify threats

Microsoft Purview Audit records user and admin operations in a unified log. To search you need the Audit Logs or View-Only Audit Logs role, and you can filter by activities, users or files and export to CSV. MailItemsAccessed helps scope a compromised mailbox, and retention policies extend how long records are kept.
Content search in Microsoft Purview eDiscovery queries Exchange Online mailboxes, SharePoint sites, OneDrive, Teams, Microsoft 365 Groups and Viva Engage in a single search, using keywords, KeyQL and conditions. The Statistics and Sample views help you refine the query before you export, and deleting messages requires the Search And Purge role, which is separate from searching.
Microsoft Graph activity logs are an audit trail of every HTTP request that Microsoft Graph receives for the tenant. You turn them on with a diagnostic setting that targets Log Analytics, storage or Event Hubs, query them in the MicrosoftGraphActivityLogs table, and correlate them with sign-ins by using SignInActivityId and UniqueTokenIdentifier.

3. Perform threat hunting

20–25%

Detect threats by using Microsoft Defender XDR

Choosing the right table from the advanced hunting schema depends on the kind of activity: DeviceProcessEvents for processes, DeviceNetworkEvents for connections, EmailEvents for email, UrlClickEvents for link clicks, IdentityQueryEvents for Active Directory lookups and CloudAppEvents for cloud apps. Each table depends on the Defender service that populates it.
Advanced hunting uses Kusto Query Language: a table followed by piped operators such as where, summarize, join, project and top. For effective, durable queries, filter early by time, prefer has over contains, identify processes by file name, and use kind=inner when you need every left-side row of a join.
On the advanced hunting page you can create queries in guided mode (visual query builder) or advanced mode (KQL). Save queries in My queries or Shared queries, chart results with summarize and render, and turn them into custom detection rules by returning Timestamp, ReportId and an entity identifier such as DeviceId.
Threat analytics combines Microsoft threat intelligence reports with data from your environment: related incidents, impacted assets, alerts over time, endpoints exposure and recommended actions. Reports are classified as Activity, Actor, Technique, Tool, Vulnerability and other categories, and include hunting queries you can run or turn into detections.
The hunting graph in Defender advanced hunting renders entities as nodes and edges and offers predefined scenarios (prebuilt queries) with filters to trace attack paths. In an incident, View blast radius shows the possible paths from a node to critical targets, limited to your RBAC scope. Its value grows as more data and critical assets are defined.

Detect threats by using the Microsoft Sentinel platform

Sentinel hunting queries, whether built in, shipped by Content hub solutions or custom, run from the Queries tab of Hunting and map to MITRE ATT&CK tactics and techniques. You monitor them through result counts and Results delta columns, bookmarks and hunts; a high-value query can become an analytics rule. Livestreams are replaced by KQL jobs, rules or playbooks.
KQL jobs run a one-time or scheduled query over data lake data and federated tables, and can promote the results to an analytics-tier table (suffix _KQL_CL) or write them to the data lake. They are created from the query editor or the Jobs page; they do not support adx(), arg(), externaldata() or ingestion_time(), and you should allow for ingestion latency.
Summary rules aggregate large volumes of data from any log tier in the background and store the result in a custom table (suffix _CL) with the Analytics plan, ready for fast queries or to feed analytics rules. The query should not include a time filter, the bin size and delay control when each aggregation runs, and LASummaryLogs lets you watch for failures.
Jupyter notebooks, run in VS Code with the Sentinel extension on Spark pools, read data lake tables through MicrosoftSentinelProvider and bring Python, external data and machine learning to threat hunting. The Sentinel MCP server offers tool collections (data exploration, triage, agent creation) usable from compatible clients with at least the Security Reader role.

Practice this certification