Microsoft · SC-200
Hunting in the Sentinel platform
SC-200 · Lesson 14 of 14 · 1:37:38
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SC-200 exam (Microsoft Certified: Security Operations Analyst Associate). In this lesson: Sentinel hunting queries and results deltas, hunts and bookmarks, KQL jobs on the data lake and federated tables (_KQL_CL tables), summary rules, Jupyter notebooks in Visual Studio Code, and the Microsoft Sentinel MCP server for AI-assisted hunting. Includes three original practice questions.
Preview the topics
- A hunter must check a year of proxy logs, kept only in the data lake, for an indicator published today. What should they use?
- Firewall logs are huge, and kept in a low-cost tier, but a dashboard needs hourly connection counts per destination, fast. What should the engineer create?
- A hunter in Visual Studio Code wants an AI assistant to explore Sentinel data lake tables in natural language, with no infrastructure to deploy. What should they connect?