Targeted attacks, malicious use of generative AI and increasing regulatory pressure are reshaping the Security Operations Analyst role. This SC-200 training prepares you to operate a modern SOC powered by the Microsoft ecosystem: Microsoft Sentinel for scalable detection, Microsoft Defender XDR for cross-domain correlation, and Microsoft Security Copilot to accelerate investigation.
Over four days, you learn to configure Microsoft Sentinel data connectors, write advanced KQL queries, conduct proactive threat hunting and orchestrate incident response with SOAR playbooks. You also work on Microsoft Defender for Cloud to protect multi-cloud and hybrid workloads. The training is delivered in Geneva and Lausanne by Microsoft Certified Trainers.
Module 1 : Introduction to Microsoft Defender XDR threat protection
Module 2 : Mitigate incidents using Microsoft Defender
Module 3 : Remediate threats using Microsoft Defender
Module 4 : Manage Microsoft Entra Identity Protection
Module 5 : Safeguard your environment with Microsoft Defender for Identity
Module 6 : Secure your cloud apps and services with Microsoft Defender for Cloud Apps
Module 7 : Introduction to generative AI and agents
Module 8 : Describe Microsoft Security Copilot
Module 9 : Describe the core features of Microsoft Security Copilot
Module 10 : Describe the embedded experiences of Microsoft Security Copilot
Module 11 : Explore use cases of Microsoft Security Copilot
Module 12 : Investigate and respond to Microsoft Purview Data Loss Prevention alerts
Module 13 : Investigate insider risk alerts and related activity
Module 14 : Search and investigate with Microsoft Purview Audit
Module 15 : Search for content with Microsoft Purview eDiscovery
Module 16 : Protect against threats with Microsoft Defender for Endpoint
Module 17 : Deploy the Microsoft Defender for Endpoint environment
Module 18 : Implement Windows security enhancements with Microsoft Defender for Endpoint
Module 19 : Perform device investigations in Microsoft Defender for Endpoint
Module 20 : Perform actions on a device using Microsoft Defender for Endpoint
Module 21 : Perform evidence and entities investigations using Microsoft Defender for Endpoint
Module 22 : Configure and manage automation using Microsoft Defender for Endpoint
Module 23 : Configure for alerts and detections in Microsoft Defender for Endpoint
Module 24 : Utilize Vulnerability Management in Microsoft Defender for Endpoint
Module 25 : Plan for cloud workload protections using Microsoft Defender for Cloud
Module 26 : Connect Azure assets to Microsoft Defender for Cloud
Module 27 : Connect non-Azure resources to Microsoft Defender for Cloud
Module 28 : Manage your cloud security posture management
Module 29 : Explain cloud workload protections in Microsoft Defender for Cloud
Module 30 : Remediate security alerts using Microsoft Defender for Cloud
Module 31 : Construct KQL statements for Microsoft Sentinel
Module 32 : Analyze query results using KQL
Module 33 : Build multi-table statements using KQL
Module 34 : Work with data in Microsoft Sentinel using Kusto Query Language
Module 35 : Introduction to Microsoft Sentinel
Module 36 : Create and manage Microsoft Sentinel workspaces
Module 37 : Query logs in Microsoft Sentinel
Module 38 : Use watchlists in Microsoft Sentinel
Module 39 : Utilize threat intelligence in Microsoft Sentinel
Module 40 : Integrate Microsoft Defender XDR with Microsoft Sentinel
Module 41 : Connect data to Microsoft Sentinel using data connectors
Module 42 : Connect Microsoft services to Microsoft Sentinel
Module 43 : Connect Microsoft Defender XDR to Microsoft Sentinel
Module 44 : Connect Windows hosts to Microsoft Sentinel
Module 45 : Connect Common Event Format logs to Microsoft Sentinel
Module 46 : Connect syslog data sources to Microsoft Sentinel
Module 47 : Connect threat indicators to Microsoft Sentinel
Module 48 : Threat detection with Microsoft Sentinel analytics
Module 49 : Automation in Microsoft Sentinel
Module 50 : Threat response with Microsoft Sentinel playbooks
Module 51 : Security incident management in Microsoft Sentinel
Module 52 : Identify threats with Behavioral Analytics
Module 53 : Data normalization in Microsoft Sentinel
Module 54 : Query, visualize, and monitor data in Microsoft Sentinel
Module 55 : Manage content in Microsoft Sentinel
Module 56 : Explain threat hunting concepts in Microsoft Sentinel
Module 57 : Threat hunting with Microsoft Sentinel
Module 58 : Use Search jobs in Microsoft Sentinel
Module 59 : Hunt for threats using notebooks in Microsoft Sentinel
This course prepares you to the SC-200: Microsoft Security Operations Analyst exam.
Security Operations Centers (SOCs) face unprecedented alert volume and pressure on mean time to detect (MTTD) and respond (MTTR). Consolidation around Microsoft Sentinel and Microsoft Defender XDR answers this equation: a cloud-native scalable SIEM coupled with an XDR platform that correlates endpoint, identity, email, cloud apps and cloud infrastructure signals. The SC-200 training prepares you to operate this set within an Azure / Microsoft 365 / multi-cloud environment.
Microsoft Sentinel concentrates log ingestion (Azure, AWS, GCP, third-party sources via syslog or API), detection via analytics rules and hunting, visual investigation of entities and response orchestration via playbooks. During the training, you work on workspace design, retention costs, Fusion and machine learning rules, and the creation of custom workbooks for CISO reporting.
Defender XDR (formerly Microsoft 365 Defender) unifies Defender for Endpoint, Defender for Identity, Defender for Office 365 and Defender for Cloud Apps in a single console. You learn to investigate multi-domain incidents, leverage the attack graph, manage exclusions and configure Attack Surface Reduction on Windows and Linux endpoints.
Kusto Query Language is the key to efficient operation of Sentinel and Defender. The training covers syntax (where, project, summarize, join, mv-expand), advanced analytical functions (parse, extend, lookup) and detection patterns (rare process, lateral movement, beaconing C2). You leave the training able to write your own hunting queries.
Microsoft Security Copilot is integrated into the program: promptbooks to automate recurring investigations, KQL generation in natural language, incident summaries for tier 1 analysts, and integration with Sentinel and Defender XDR. The SC-200 program reflects the SOC evolution toward analyst augmentation through generative AI, without replacing human judgment.
This training targets tier 1 and 2 SOC analysts, security engineers, threat hunters and system administrators in charge of operational security. Basic Azure knowledge (equivalent to AZ-900) and Microsoft security fundamentals (equivalent to SC-900) are recommended. Mastery of a query language (SQL, Splunk SPL) is a plus but not required.
The SC-200 course prepares you for the SC-200: Microsoft Security Operations Analyst exam, which leads to the Microsoft Certified: Security Operations Analyst Associate certification. The exam evaluates skills on Microsoft Sentinel, Microsoft Defender XDR, Microsoft Defender for Cloud and Microsoft Security Copilot. The certification is among the most sought-after credentials in SOC managed services in Switzerland and France.
What is the difference between SC-200 and AZ-500 training?
SC-200 focuses on SOC operations: detection, investigation, threat hunting and response. AZ-500 covers Azure infrastructure security from a cloud security engineer perspective (identity, network, platform). Both are complementary in a Microsoft security career path.
Does the SC-200 course cover Microsoft Security Copilot?
Yes. The latest program update integrates Security Copilot use cases in Sentinel and Defender XDR: promptbooks, KQL generation, incident summaries and AI-augmented investigation.
Do I need to be a developer to follow the SC-200 training?
No, the training is operational. KQL is a query language, not a development language. You learn to read and write analytic rules and hunting queries, not develop applications.
Does the SC-200 training include hands-on labs?
Yes. Microsoft Learn labs allow you to configure a Sentinel workspace, ingest Azure and endpoint logs, write analytic rules, create SOAR playbooks and investigate simulated incidents on Defender XDR.
What jobs lead to the Microsoft Security Operations Analyst Associate certification?
SOC analyst tier 1 to 3, Microsoft Sentinel engineer, threat hunter, incident responder, Microsoft security consultant, managed services SOC architect.
Monday to Friday
8:30 AM to 6:00 PM
Tel. 058 307 73 00
ITTA
Route des jeunes 35
1227 Carouge, Suisse
Monday to Friday, from 8:30 am to 06:00 pm.
