Microsoft Sentinel
You can download the Microsoft Sentinel Bootcamp hands-on lab step-by-step instructions here
These labs help you get ramped up with Microsoft Sentinel and provide hands-on practical experience for product features, capabilities, and scenarios.
The lab deploys an Microsoft Sentinel workspace and ingests pre-recorded data to simulate scenarios that showcase various Microsoft Sentinel features. You should expect very little or no cost at all due to the size of the data (~10 MBs) and the fact that Microsoft Sentinel offers a 30-day free trial.
In this video, we will go through Microsoft Sentinel hands-on lab bootcamp exercises.
Prerequisites
To deploy Microsoft Sentinel Trainig Lab, you must have a Microsoft Azure subscription. If you do not have an existing Azure subscription, you can learn how to sign up for an Azure free trial here.
LAB 01: Setting up the environment
This module guides you through the deployment of the Microsoft Sentinel Training Lab solution that will be used in all subsequent modules.
Lab 01 Task List:
Exercise 1: The Microsoft Sentinel workspace
Exercise 2: Deploy the Microsoft Sentinel Training Lab Solution
Exercise 3: Configure Microsoft Sentinel Playbook
LAB 02: Data Connectors
In this module you will learn how to enable Data Connectors in Microsoft Sentinel to bring alerts and/or telemtry from different sources.
Lab 02 Task List:
Exercise 1: Enable Azure Activity data connector
Exercise 2: Enable Microsoft Defender for Cloud data connector
Exercise 3: Enable Threat Intelligence TAXII data connector
LAB 03: Analytics Rules
This module guides you through the Analytics Rule part in Microsoft Sentinel, and shows you how to create diffrent type of rules (Security Detections)
Lab 03 Task List:
Exercise 1: Analytics Rules overview
Exercise 2: Enable Microsoft incident creation rule
Exercise 3: Review Fusion Rule (Advanced Multistage Attack Detection)
Exercise 4: Create Microsoft Sentinel custom analytics rule
LAB 04: Incident Management
This module guides you through the SOC Analyst experience using Microsoft Sentinel's incident management capabilities.
Lab 04 Task List:
Exercise 1: Review Microsoft Sentinel incident tools and capabilities
Exercise 2: Handling Incident "Sign-ins from IPs that attempt sign-ins to disabled accounts"
Exercise 3: Handling "Solorigate Network Beacon" incident
Exercise 4: Hunting for more evidence
Exercise 5: Add IOC to Threat Intelligence
Exercise 6: Handover incident
LAB 05: Hunting
This module will guide you through a proactive threat hunting procedure and will review Microsoft Sentinel’s rich hunting features.
Lab 05 Task List:
Exercise 1: Hunting on a specific MITRE technique
Exercise 2: Bookmarking hunting query results
Exercise 3: Promote a bookmark to an incident
LAB 06: Watchlists
This module will show you how to use Microsoft Sentinel watchlists in event correlation and enrichment. Once created, you can use watchlists in your search, detection rules, threat hunting, and response playbooks.
Lab 06 Task List:
Exercise 1: Create a watchlist
Exercise 2: Whitelist IP addresses in the analytics rule
LAB 07: Threat Intelligence
This module will demonstrate how to use Microsoft Sentinel Threat Intelligence (TI) features and product integration points. During this module we rely on TI data that we ingested in Lab 2, so please make sure you have completed that module. In this module we will also discover how to visualize and use this data as part of investigation and detection.
Lab 07 Task List:
Exercise 1: Threat Intelligence data connectors
Exercise 2: Explore the Threat Intelligence menu
Exercise 3: Analytics Rules based on Threat Intelligence data
Exercise 4: Treat Intelligence workbook
LAB 08: Microsoft Sentinel Content Hub
In this module you will learn how to use the Microsoft Sentinel Content Hub to discover and deploy new content. Our official documentation on this topic is available here: Microsoft Sentinel Content hub catalog.
Lab 08 Task List:
Exercise 1: Explore Microsoft Sentinel Content hub
Exercise 2: Deploy a new solution
Exercise 3: Review and enable deployed artifacts
