Microsoft · SC-200
Hunting in Defender XDR
SC-200 · Lesson 13 of 14 · 1:31:49
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SC-200 exam (Microsoft Certified: Security Operations Analyst Associate). In this lesson: advanced hunting (30 days of data, Sentinel tables, guided and advanced modes, 100,000 rows), choosing the right table (device, email, identity, cloud app, alert tables), KQL operators (where, summarize, dcount, project, extend, join), threat analytics reports, and the hunting graph, blast radius, and Microsoft Sentinel graph. Includes three original practice questions.
Preview the topics
- A hunter needs every PowerShell process started with an encoded command, on any device, in the past week. Which table should the query start from?
- A new threat analytics report covers a ransomware group, and the CISO asks how many of your devices are exposed to the vulnerabilities it uses. Where should the analyst look?
- Before patching, a hunter wants to see every route from any device to a sensitive key vault, without writing a query. What should they use?