How Sentinel turns logs into alerts and incidents, the seven analytics rule types and the anatomy of a scheduled rule, the incident lifecycle, UEBA tables, threat intelligence feeds and the TI tables, watchlists in detections, MITRE coverage, and how all of it changes once the workspace is in the Defender portal.
How Sentinel automation rules evaluate triggers, conditions and actions in order, how Logic Apps playbooks authenticate with a managed identity and which roles they need, common response patterns such as MDE isolate and Entra disable, the automation health log, the permissions model, cost, and what still works in the Defender portal.
How data gets into Microsoft Sentinel, connector by connector type, what the Defender XDR connector really brings and costs, how DCRs and transformations shape what lands in the workspace, and how to pick a tier per table.
The Defender for Identity alert catalogue by kill-chain phase, what replaced lateral movement paths, entity tags, exclusions versus alert tuning, identity posture assessments, response actions and the action account, and the Identity* Advanced Hunting tables with ready KQL.
The KQL operators a security engineer actually uses in Sentinel, the tables worth knowing, ASIM parsers, functions, the hunting blade, workbooks, notebooks, query cost and performance, search jobs and restore, with 15 ready-to-paste queries.
The eight Defender for Cloud Apps policy types, what the built-in anomaly detections flag and how to scope them, file policies with Purview labels, per-app governance actions, the activity log, the alert lifecycle in Defender XDR, Sentinel paths, the Activities and Alerts API, and a troubleshooting table for the whole product.
Time-of-click URL scanning in email, Office apps and Teams, attachment detonation with Block and Dynamic Delivery, Safe Attachments for SharePoint, OneDrive and Teams, Safe Documents, ZAP for Teams, and which settings live in a policy versus the global switch.
How Defender for Cloud alerts are built, scored and retired, what suppression and email notifications do, how workflow automation and continuous export move alerts out of the portal, and how the Sentinel connector and the Defender XDR integration fit together without creating duplicate incidents.
How SOC optimization finds unused tables and missing detections, what the Defender portal adds to Sentinel and what stays in Azure, the one-primary-workspace rule, running Sentinel for many tenants with Lighthouse, B2B and the multitenant portal, health and audit tables, content as code, and a 30-60-90 day plan for a mid-size SOC.
The Defender for Office 365 investigation toolset, Threat Explorer and Real-time detections, the email entity page, quarantine and quarantine policies, admin and user submissions, automated investigation and response, message trace, and the Email tables in Advanced Hunting with working KQL.
App registration vs service principal vs managed identity, application vs delegated permissions, admin consent, secrets vs certificates vs federated credentials, Workload ID Premium, the app registration hardening checklist, and how to monitor service principal credentials and sign-ins.