Skip to main content
Ace Skills Consulting
Microsoft logoIntermediate

SC-200: Security Operations Analyst

Hunt, investigate and respond to threats with Microsoft Defender XDR and Microsoft Sentinel, and prepare for the SC-200 exam.

  • 32 hours of live, hands-on SOC sessions
  • Simulated attacks investigated end to end
  • KQL taught from basics to hunting queries
  • Sentinel analytics rules, playbooks and workbooks
  • Mapped to the SC-200 skill areas
Aligned to Microsoft exam SC-200
Duration
4 Days | 32 Hrs
Next batch
Batches on request
Delivery
Live Online · Onsite · Corporate
Level
Intermediate
Exam
SC-200
Language
English

Why learn SC-200 with Ace Skills

  • Think like an analyst

    You follow simulated attacks from first alert to containment, learning the investigation order a real SOC uses.

  • KQL that you can actually write

    Queries are built step by step until you can write your own hunting and detection logic with confidence.

  • Automate the routine

    Playbooks and automation rules handle repetitive triage so analysts focus on incidents that need judgement.

  • SOC-ready skills

    The skills map directly to L1 and L2 SOC roles that are in demand across India and the Gulf.

Course overview

A security operations analyst spends the day separating real threats from noise, investigating what happened and containing it before damage spreads. Microsoft Defender XDR and Microsoft Sentinel are central tools for that work in many organisations. This four-day course trains you to use them the way a working SOC does.

Day one sets up the security operations environment: connecting data sources to Sentinel, configuring Defender XDR settings, and learning Kusto Query Language from first principles, because almost every later task depends on it. Day two configures protections and detections — Defender for Endpoint policies, attack surface reduction, Defender for Office 365 and identity protections, and custom detection and analytics rules.

Day three focuses on incident response: triaging incidents in the unified portal, investigating alerts across email, endpoint, identity and cloud apps, and automating response with Sentinel playbooks and automation rules. Day four covers threat hunting, threat intelligence, workbooks and reporting, followed by exam preparation.

Throughout the course you investigate simulated attacks — phishing, credential theft and lateral movement — so the tools are learned in the order an analyst actually uses them.

The course is aligned to the SC-200 exam. Microsoft security products change frequently and the outline is revised periodically, so check the current skills measured on Microsoft Learn before booking.

Key features

  • Simulated attack scenarios investigated end to end
  • KQL from first principles to hunting queries
  • Sentinel data connectors, analytics rules and workbooks
  • Automation with playbooks and automation rules
  • Defender XDR incident triage and response
  • Threat hunting and threat intelligence labs
  • 30 days of post-training doubt support

Who should attend

  • SOC analysts and incident responders
  • Security engineers working with Microsoft security tools
  • IT administrators moving into security operations
  • Threat hunters and detection engineers
  • SC-900 holders progressing to associate level

Prerequisites

  • Understanding of Microsoft 365 and Azure basics
  • Familiarity with common attack techniques and security concepts (SC-900 level)
  • Basic scripting or query experience helps

Curriculum

4 Days · 32 Hours · 13 Modules · 11 Labs

  1. Microsoft Sentinel set-up

    • Workspace design and roles
    • Data connectors for Microsoft and third-party sources
    • Syslog and CEF ingestion
    • Data retention and cost
    • Lab: Deploy Sentinel and connect Microsoft data sources · 45 min

    Defender XDR environment

    • Unified security operations portal
    • Role-based access
    • Device groups and settings
    • Integrating Sentinel with Defender XDR
    • Lab: Configure Defender XDR settings and device groups · 35 min

    Kusto Query Language

    • Query structure, where and project
    • Summarise, extend and render
    • Joins and unions
    • Working with time and dynamic data
    • Parsing logs
    • Lab: Write KQL queries against sign-in and device logs · 60 min

  2. Endpoint protection

    • Defender for Endpoint onboarding
    • Attack surface reduction rules
    • Vulnerability management
    • Device isolation and live response
    • Lab: Configure ASR rules and investigate a device alert · 50 min

    Email, identity and cloud apps

    • Defender for Office 365 policies
    • Defender for Identity detections
    • Defender for Cloud Apps policies
    • Defender for Cloud workload alerts
    • Lab: Investigate a phishing campaign in Defender for Office 365 · 45 min

    Detection engineering

    • Scheduled and near-real-time analytics rules
    • Custom detection rules in Defender XDR
    • Entity mapping
    • Tuning false positives
    • Lab: Create and tune an analytics rule · 50 min

  3. Triage and investigation

    • Incident queue and prioritisation
    • Alert correlation and attack stories
    • Investigation graphs
    • Evidence and entities
    • Lab: Investigate a credential theft and lateral movement incident · 60 min

    Response actions

    • Containing users and devices
    • Automated investigation and response
    • Remediation and closure
    • Documenting incidents
    • Lab: Contain a compromised account and device · 35 min

    Automation

    • Automation rules
    • Playbooks with Logic Apps
    • Enrichment and notification patterns
    • Lab: Build a playbook that enriches and notifies on incidents · 45 min

  4. Threat hunting

    • Hypothesis-driven hunting
    • Advanced hunting in Defender XDR
    • Sentinel hunting queries and bookmarks
    • MITRE ATT&CK mapping
    • Lab: Hunt for persistence techniques with KQL · 50 min

    Threat intelligence

    • Threat intelligence indicators
    • Microsoft Defender Threat Intelligence overview
    • Watchlists
    • Lab: Match indicators against logs with a watchlist · 30 min

    Workbooks and reporting

    • Sentinel workbooks
    • SOC metrics and reporting
    • Copilot for Security overview

    Exam readiness

    • Exam structure and case studies
    • Practice questions with review
Download full syllabus (PDF)

Skills you will gain

  • Security operations
  • Microsoft Sentinel
  • Microsoft Defender XDR
  • Defender for Endpoint
  • Defender for Office 365
  • KQL
  • Analytics rules
  • Incident response
  • Threat hunting
  • Playbooks
  • MITRE ATT&CK
  • Threat intelligence

Tools & technologies

  • Microsoft Defender portal
  • Microsoft Sentinel
  • Azure Logic Apps
  • Log Analytics
  • Microsoft Defender for Endpoint
  • Azure portal

Certification exam

Exam details
Exam nameMicrosoft Certified: Security Operations Analyst Associate
Exam codeSC-200
Duration100 minutes
Passing score700 / 1000 (scaled)
Voucher includedNo — book directly with the vendor
Question formatMultiple choice, Multiple response, Drag and drop, Case study
DeliveryOnline proctored or Test centre
Validity & renewal1 year (free online renewal assessment)

Skill areas measured

  1. Manage a security operations environment
  2. Configure protections and detections
  3. Manage incident response
  4. Manage security threats

Exam details are pending verification. Vendors change exams; confirm on the official vendor page before booking. Official exam page (opens in a new tab)

Schedule & Pricing

Live Online

Individual

Price on request

  • 32 hours of live, trainer-led sessions
  • 11 hands-on labs
  • Ace Skills course completion certificate

Onsite

At your office or our centre

Pricing depends on location, group size and dates.

  • Delivered at your premises or an Ace centre
  • Same curriculum and labs as live online
  • Dates planned around your team

Corporate / Team

Private batch for your organisation

A private batch with content adapted to your environment and goals.

  • Customised curriculum
  • Private batch, online or onsite
  • Progress and assessment reports
  • GST invoice and PO-based billing

No public batches scheduled — Talk to an Advisor for a private batch.

Projects & labs you will build

  • Day 1 · 60 min

    Write KQL queries against sign-in and device logs

  • Day 3 · 60 min

    Investigate a credential theft and lateral movement incident

Your certificate

Certificate of Completion — Ace Skills Consulting

Awarded on completing the course. It records the course title and training hours, and you can share it on your LinkedIn profile.

The Microsoft certification itself is awarded by Microsoft when you pass exam SC-200.

Frequently asked questions

Do I need to know KQL before joining?

No. KQL is taught from first principles on Day 1 and used throughout the course.

Are the attack scenarios realistic?

Yes. Labs use simulated phishing, credential theft and lateral movement data so you investigate the kind of incidents a SOC sees.

Is SC-200 suitable for freshers?

It is best after SC-900 or some IT experience. Complete beginners should start with SC-900 or a security fundamentals course.

What happens if Microsoft updates the SC-200 exam?

We map the curriculum to the current published skills outline and revise it when Microsoft changes the exam. Always check the latest outline on Microsoft Learn before booking.

Do you run weekend batches?

Yes. Weekend batches cover the same 32 hours across consecutive Saturdays and Sundays, with timings in IST that also suit learners in the Gulf.

Can you run a private batch for our team?

Yes. We run private online or onsite batches for corporate teams, and we can weight the labs towards your SOC’s tools and use cases. Request a corporate quote with your team size and preferred dates.

Related courses

Explore more

All Microsoft Data, 365 & Security courses Microsoft certifications

Microsoft, Azure, Microsoft 365, Power BI and Microsoft Entra are trademarks of the Microsoft group of companies.

Train your team on SC-200

Private batches online or at your office in India and the GCC, with a curriculum adapted to your environment.