Microsoft · SC-200
Detections
SC-200 · Lesson 7 of 14 · 38:12
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the SC-200 exam (Microsoft Certified: Security Operations Analyst Associate). In this lesson: custom detection rules in Defender XDR (required columns, frequencies, continuous NRT, actions, 150 alerts per run), Sentinel scheduled and near-real-time analytics rules, Microsoft security rules and Fusion in the Defender portal, threat intelligence matching, anomaly rules, and the MITRE ATT&CK page. Includes three original practice questions.
Preview the topics
- A custom detection must fire within minutes, and its query reads DeviceProcessEvents only, with no joins. Which frequency fits best?
- A Sentinel rule must alert within about two minutes whenever a break-glass account signs in. Which rule type fits?
- An anomaly rule records far too many anomalies, and the team wants a higher threshold, while comparing results with the current version. What should they do?