SC-5004: Defend against cyberthreats with Microsoft Defender XDR

Implement the Microsoft Defender for Endpoint environment to manage devices, perform investigations on endpoints, manage incidents in Defender XDR, and use Advanced Hunting with Kusto Query Language (KQL) to detect unique threats.

Security Operations Analysts

• Experience using the Microsoft Defender portal
• Basic understanding of Microsoft Defender for Endpoint
• Basic understanding of Microsoft Sentinel
• Experience using Kusto Query Language (KQL) in Microsoft Sentinel
• Access to a Microsoft 365 E5 Tenant with a Microsoft Defender for Endpoint P2 license to perform the exercises

After completing this course, students will be able to:

• Configure a Defender XDR environment
• Manage devices by using Defender for Endpoint
• Use Defender XDR to manage incidents
• Manage investigations on an endpoint
• Perform Advanced Hunting with KQL to detect unique threat

• Mitigate incidents using Microsoft Defender
• Deploy the Microsoft Defender for Endpoint environment
• Configure for alerts and detections in Microsoft Defender for Endpoint
• Configure and manage automation using Microsoft Defender for Endpoint
• Perform device investigations in Microsoft Defender for Endpoint
• Defend against Cyberthreats with Microsoft Defender XDR lab exercises