Infoventure

Module 1: Introduction to Microsoft Defender XDR threat protection

• Explore Extended Detection & Response (XDR) response use cases

• Understand Microsoft Defender XDR in a Security Operations Center (SOC)

• Explore Microsoft Security Graph

• Investigate security incidents in Microsoft Defender XDR

Module 2: - Mitigate incidents using Microsoft 365 Defender

• Use the Microsoft Defender portal

• Manage incidents

• Investigate incidents

• Manage and investigate alerts

• Manage automated investigations

• Use the action center

• Explore advanced hunting

• Investigate Microsoft Entra sign-in logs

• Understand Microsoft Secure Score

• Analyze threat analytics

• Analyze reports

• Configure the Microsoft Defender portal

Module 3 : Protect your identities with Microsoft Entra ID Protection

• Microsoft Entra ID Protection overview

• Detect risks with Microsoft Entra ID Protection policies

• Investigate and remediate risks detected by Microsoft Entra ID Protection

Module 4: Remediate risks with Microsoft Defender for Office 365

• Automate, investigate, and remediate

• Configure, protect, and detect

• Simulate attacks

Module 5: Safeguard your environment with Microsoft Defender for Identity

• Configure Microsoft Defender for Identity sensors

• Review compromised accounts or data

• Integrate with other Microsoft tools

Module 6: Secure your cloud apps and services with Microsoft Defender for Cloud Apps

• Understand the Defender for Cloud Apps Framework

• Explore your cloud apps with Cloud Discovery

• Protect your data and apps with Conditional Access App Control

• Walk through discovery and access control with Microsoft Defender for Cloud Apps

• Classify and protect sensitive information

• Detect Threats

Module 7: Fundamentals of Generative AI

• What is generative AI?

• What are language models?

• Using language models

• What are copilots?

• Microsoft Copilot

• Considerations for Copilot prompts

• Extending and developing copilots

Module 8: Describe Microsoft Copilot for Security

• Get acquainted with Microsoft Copilot for Security

• Describe Microsoft Copilot for Security terminology

• Describe how Microsoft Copilot for Security processes prompt requests

• Describe the elements of an effective prompt

• Describe how to enable Microsoft Copilot for Security

Module 9: Describe the core features of Microsoft Copilot for Security

• Describe the features available in the standalone experience of Microsoft Copilot for Security

• Describe the features available in a session of the standalone experience

• Describe the Microsoft plugins available in Microsoft Copilot for Security

• Describe the non-Microsoft plugins supported by Microsoft Copilot for Security

• Describe custom promptbooks

• Describe knowledge base connections

Module 10: Describe the embedded experiences of Microsoft Copilot for Security

• Describe Microsoft Copilot in Microsoft Defender XDR

• Microsoft Copilot in Microsoft Purview

• Microsoft Copilot in Microsoft Entra

• Microsoft Copilot in Microsoft Intune

Module 11: Respond to data loss prevention alerts using Microsoft 365

• Describe data loss prevention alerts

• Investigate data loss prevention alerts in Microsoft Purview

• Investigate data loss prevention alerts in Microsoft Defender for Cloud Apps

Module 12: Manage insider risk in Microsoft Purview

• Insider risk management overview

• Create and manage insider risk policies

• Investigate insider risk alerts

• Take action on insider risk alerts through cases

• Manage insider risk management forensic evidence

• Create insider risk management notice templates

Module 13: Search and investigate with Microsoft Purview Audit

• Microsoft Purview Audit overview

• Configure and manage Microsoft Purview Audit

• Conduct searches with Audit (Standard)

• Audit Microsoft Copilot for Microsoft 365 interactions

• Investigate activities with Audit (Premium)

• Export audit log data

• Configure audit retention with Audit (Premium)

Module 14: Investigate threats with Content search in Microsoft Purview

• Explore Microsoft Purview eDiscovery solutions

• Create a content search

• View the search results and statistics

• Export the search results and search report

• Configure search permissions filtering

• Search for and delete email messages

Module 15: Protect against threats with Microsoft Defender for Endpoint

• Practice security administration

• Hunt threats within your network

Module 16: Deploy the Microsoft Defender for Endpoint environment

• Create your environment

• Understand operating systems compatibility and features

• Onboard devices

• Manage access

• Create and manage roles for role-based access control

• Configure device groups

• Configure environment advanced features

Module 17: Implement Windows security enhancements with Microsoft Defender for Endpoint

• Understand attack surface reduction

• Enable attack surface reduction rules

Module 18: Perform device investigations in Microsoft Defender for Endpoint

• Use the device inventory list

• Investigate the device

• Use behavioral blocking

• Detect devices with device discovery

Module 19: Perform actions on a device using Microsoft Defender for Endpoint

• Explain device actions

• Run Microsoft Defender antivirus scan on devices

• Collect investigation package from devices

• Initiate live response session

Module 20: Perform evidence and entities investigations using Microsoft Defender for Endpoint

• Investigate a file

• Investigate a user account

• Investigate an IP address

• Investigate a domain

Module 21: Configure and manage automation using Microsoft Defender for Endpoint

• Configure advanced features

• Manage automation upload and folder settings

• Configure automated investigation and remediation capabilities

• Block at risk devices

Module 22: Configure for alerts and detections in Microsoft Defender for Endpoint

• Configure advanced features

• Configure alert notifications

• Manage alert suppression

• Manage indicators

Module 23: Utilize Vulnerability Management in Microsoft Defender for Endpoint

• Understand vulnerability management

• Explore vulnerabilities on your devices

• Manage remediation

Module 24: Plan for cloud workload protections using Microsoft Defender for Cloud

• Explain Microsoft Defender for Cloud

• Describe Microsoft Defender for Cloud workload protections

• Enable Microsoft Defender for Cloud

Module 25: Connect Azure assets to Microsoft Defender for Cloud

• Explore and manage your resources with asset inventory

• Configure auto provisioning

• Manual log analytics agent provisioning

Module 26: Connect non-Azure resources to Microsoft Defender for Cloud

• Protect non-Azure resources

• Connect non-Azure machines

• Connect your AWS accounts

• Connect your GCP accounts

Module 27: Manage your cloud security posture management

• Explore Secure Score

• Explore Recommendations

• Measure and enforce regulatory compliance

• Understand Workbooks

Module 28: Explain cloud workload protections in Microsoft Defender for Cloud

• Understand Microsoft Defender for servers

• Understand Microsoft Defender for App Service

• Understand Microsoft Defender for Storage

• Understand Microsoft Defender for SQL

• Understand Microsoft Defender for open-source databases

• Understand Microsoft Defender for Key Vault

• Understand Microsoft Defender for Resource Manager

• Understand Microsoft Defender for DNS

• Understand Microsoft Defender for Containers

• Understand Microsoft Defender additional protections

Module 29: Remediate security alerts using Microsoft Defender for Cloud

• Understand security alerts

• Remediate alerts and automate responses

• Suppress alerts from Defender for Cloud

• Generate threat intelligence reports

• Respond to alerts from Azure resources

Module 30: Construct KQL statements for Microsoft Sentinel

• Understand the Kusto Query Language statement structure

• Use the search operator

• Use the where operator

• Use the let statement

• Use the extend operator

• Use the order by operator

• Use the project operators