Tech Study DeckTechnical study guides and structured courses
Menu

Course curriculum

Microsoft Security Operations Analyst (SC-200)

Build practical security-operations skills across Microsoft Sentinel, incident investigation, detection, and automation.

2 modules4 lessons

Curriculum

Modules and lessons

← Course library
Module 01

Microsoft Sentinel Foundations

Understand the data, detection, and investigation building blocks of a Sentinel workspace.

2 lessons
  1. 01Sentinel Data and ArchitectureUnderstand how security data reaches a Log Analytics workspace and becomes useful for detection and investigationOpen lesson →
  2. 02Analytics Rules and DetectionsBuild the mental model for scheduled detections, incidents, entities, and tuningOpen lesson →
Module 02

Incident Response and Automation

Move from alert review into evidence-based triage, investigation, and repeatable response.

2 lessons
  1. 01Incident Triage WorkflowUse evidence, entities, and timelines to decide what deserves escalationOpen lesson →
  2. 02Automation Rules and PlaybooksSeparate orchestration decisions from response actions when automating Sentinel operationsOpen lesson →