Azure-Sentinel/Solutions/Training/Azure-Sentinel-Training-Lab

Welcome to Microsoft Sentinel Training Lab

Introduction

These labs help you get ramped up with Microsoft Sentinel and provide hands-on practical experience for product features, capabilities, and scenarios.

The lab deploys a Microsoft Sentinel workspace and ingests pre-recorded data to simulate scenarios that showcase various Microsoft Sentinel features. You should expect very little or no cost at all due to the size of the data (~10 MB), and the fact that Microsoft Sentinel offers a 30-day free trial on new workspaces.

Prerequisites

To deploy the Microsoft Sentinel Training Lab, you must have a Microsoft Azure subscription. If you do not have an existing Azure subscription, you can sign up for a free trial here.

Last release notes

• Version 1.0 - Microsoft Sentinel Training Lab

Getting started

All the modules that are part of this lab are listed below. Although in general they can be completed in any order, you must start with Module 1 as this deploys the lab environment itself.

Modules

Module 1 - Setting up the environment

• The Microsoft Sentinel workspace
• Deploy the Microsoft Sentinel Training Lab Solution
• Configure Microsoft Sentinel Playbook

Module 2 - Data Connectors

• Enable Azure Activity data connector
• Enable Azure Defender data connector
• Enable Threat Intelligence TAXII data connector

Module 3 - Analytics Rules

• Analytics Rules overview
• Enable Microsoft incident creation rule
• Review the Fusion rule (Advanced Multistage Attack Detection)
• Create a custom analytics rule
• Review the resulting security incident

Module 4 - Incident Management

• Review Microsoft Sentinel incident tools and capabilities
• Handling the Incident "Sign-ins from IPs that attempt sign-ins to disabled accounts"
• Handling the incident "Solorigate Network Beacon"
• Hunting for more evidence
• Addding IOCs to Threat Intelligence
• Incident handover

Module 5 - Hunting

• Hunt for a specific MITRE technique
• Bookmark hunting query results
• Promote a bookmark to an incident

Module 6 - Watchlists

• Create a Watchlist
• Allow-list IP addresses in an analytics rule

Module 7 - Threat Intelligence

• Threat Intelligence data connectors
• Explore the Threat Intelligence menu
• Analytics Rules based on Threat Intelligence data
• Threat Intelligence Workbook

Module 8 - Microsoft Sentinel Content hub

• Explore Microsoft Sentinel Content hub
• Deploy a new content solution
• Review and enable deployed artifacts