Microsoft 365 Defender Ninja Training: August 2021 update

Product videos

Webcast recordings

Tech Community

Docs on Microsoft

 Blogs on Microsoft

 GitHub

⤴ External

 Interactive guides

Module

What's new

Security Operations Fundamentals

Module 1. Technical overview

•  Unified experiences across endpoint and email

Security Operations Fundamentals

•  Incidents trend graph view

•  Responding to my first incident, a tutorial and walkthrough for new-to-role analysts

•  Alert page for incident detections  

•  Email Entity page

Security Operations Fundamentals

•  Threat analytics
•  Overview of Threat Analytics

Security Operations Fundamentals

•  Professional security services catalog 

Security Operations Intermediate

•  Microsoft Cloud App Security: The Hunt in a multi-stage incident
•  Hunting with Microsoft Cloud App Security data
•  Microsoft Cloud App Security: The Hunt for Insider Risk
•  Limitless Advanced Hunting with Azure Data Explorer (ADX)
•  Take action on advanced hunting query results
•  Advanced Hunting in portal Schema Reference 
• DeviceFromIP() function in advanced hunting

Security Operations Intermediate

•  Updated Automated investigation and response articles

Security Operations Intermediate

•  Microsoft Threat Experts

Security Operations Expert

Module 1. Incidents

•  Deep-dive attack playbooks from the DART team for seasoned analysts
•  Incident response overview

Security Operations Experts

Module 3. APIs, custom reports, SIEM & other integrations

•  Best practices for leveraging API's - Episode Two
•  Streaming API Announcement blog
•  Overview of the Streaming API
•  Stream Microsoft 365 Defender events
•  Azure Sentinel and Microsoft 365 Defender incident integration
•  Overview Azure Sentinel integration
•  Azure Sentinel integration