Chapter 1 of 3 · Microsoft SC-200
Manage a Security Operations Environment
Defender XDR automation, Sentinel configuration, data ingestion and detection rules.
- 8topics
- 48 minfast track
- 4diagrams and exhibits
- 40–45%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Defender XDR Notifications and Endpoint SettingsSC-200 Defender XDR settings: email notifications, alert tuning, endpoint advanced features, rules settings, custom data…6 min
- 2Automated Investigation, Attack Disruption and Device GroupsSC-200 Defender automation: automated investigation, automation levels, device groups and permissions, and automatic attack…6 min
- 3Sentinel Automation Rules and PlaybooksSC-200 Sentinel automation: automation rules with triggers and actions, Logic App playbooks, managed identities and the roles…Diagram6 min
- 4Sentinel Roles, Retention and WorkbooksSC-200 Sentinel platform: roles, Analytics, Data lake and XDR tiers with retention up to 12 years, customer managed keys…Diagram6 min
- 5Data Connectors and Windows, Syslog and CEF CollectionSC-200 Sentinel ingestion: choosing connectors, Windows Security Events via AMA, Windows Event Forwarding, Syslog and CEF…Diagram6 min
- 6Azure Activity, Threat Indicators and Custom TablesSC-200 Sentinel ingestion: Azure activity logs with Azure Policy, threat indicators, custom tables, the Logs Ingestion API and…6 min
- 7Custom Detection Rules in Defender XDRSC-200 custom detections: rules from advanced hunting queries, run frequencies and continuous NRT, required columns, response…Diagram6 min
- 8Sentinel Analytics Rules, MITRE and AnomaliesSC-200 Sentinel detections: scheduled, NRT, threat intelligence and ML rules, entity mapping, alert grouping, MITRE ATT&CK…6 min
About this chapter
What this chapter covers
This is the largest domain of the exam, at 40 to 45 percent. It is about building the security operations environment that analysts work in: the settings and automation of Microsoft Defender XDR, the configuration of Microsoft Sentinel, the data that flows into it, and the detection rules that turn that data into alerts.
The questions are practical. They describe a setup problem, such as logs that do not arrive or an automation that does not run, and ask which setting or role fixes it.
How the topics fit together
The pages follow how a SOC is built, from the tools to the data to the detections.
- Defender XDR notifications and endpoint settings covers email and alert notifications, tuning, advanced features, rules settings, custom data collection and attack surface reduction.
- Automated investigation, attack disruption and device groups covers automation levels, device groups, permissions and automatic attack disruption.
- Sentinel automation rules and playbooks covers automation rules, triggers, playbooks and the permissions they need.
- Sentinel roles, retention and workbooks covers roles, table tiers and retention including the data lake, workbooks and SOC optimization.
- Data connectors and Windows, Syslog and CEF collection covers choosing connectors and collecting events with the Azure Monitor Agent.
- Azure activity, threat indicators and custom tables covers Azure logs, threat intelligence and custom log tables.
- Custom detection rules in Defender XDR covers writing and managing custom detections.
- Sentinel analytics rules, MITRE and anomalies covers rule types, ATT&CK coverage and anomalies.
A lot of answers depend on where a setting lives. Learn whether it belongs to Defender XDR, Defender for Endpoint, Sentinel, a data collection rule or Azure itself.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with examples and tables.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full Microsoft SC-200 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.