-
Book Overview & Buying
-
Table Of Contents
Microsoft Security Operations Analyst Exam Ref SC-200 Guide - Second Edition
By :
At this stage, you are already working with detections and investigations. This chapter moves into how analysts actively search through Microsoft Sentinel data, work with larger or older datasets, and use advanced analysis methods when standard queries are not enough.
This chapter focuses on detecting threats by using Microsoft Sentinel. It aligns with the SC-200 exam objectives and addresses the following Skills Measured:
By the end of this chapter, you will be able to explain how Microsoft Sentinel hunting queries support manual threat exploration, how Search Jobs are used to query larger or older datasets in the data lake, and how summary rules improve performance when repeated analysis is required. You will...