Learning with the Microsoft Sentinel Training Lab

Microsoft

Nov 11, 2021

In our conversations with Microsoft Sentinel customers/partners, one very common ask is: “How do I get hands-on experience with Microsoft Sentinel? Is there a lab that I can spin Up and get going?“

In these cases, we normally suggest the customer/partner to spin up a workspace in their Azure subscription and start connecting all the typical data sources, like Azure AD, Azure Activity, Office 365. Then they can enable alerts and try to generate telemetry that triggers incidents to triage, investigate or do hunting on.

And yes, that is a possible solution, but it does involve a lot of manual tasks. It’s also not easy to generate the appropriate data that will trigger our analytics rules and provides a complete experience on how to use the product.

Because of this, we are happy to announce the Microsoft Sentinel Training Lab solution! This solution ingests sample data into your Microsoft Sentinel workspace which will trigger incidents that allow you to explore Microsoft Sentinel features without Additional effort.

To help you more easily onboard to Microsoft Sentinel, you can use this lab in Combination with our 31-day free trial. For more information on the free trial please visit Our pricing page.

How do I use it?

To use this solution, you need an existing Microsoft Sentinel workspace. Doesn’t matter if it already has data or if it’s brand new, you can deploy this solution on top of the workspace and all the artifacts will be deployed on top of it.

This solution also comes with a training guide, that provides step-by-step instructions on how to navigate the different features of the product, while using the artifacts created at deployment time. The scenarios explained in the guide are built to simulate real world incidents, so you can get a feel of how Microsoft Sentinel works. This guide currently includes a total of 8 modules, reviewing topics like incident management, hunting and threat intelligence among others.

To deploy the training lab, go to the Content Hub from the Microsoft Sentinel portal and search for “Training Lab”:

Click Install and follow the instructions in the wizard. If you already have an existing Microsoft Sentinel workspace to deploy this lab to, you can jump directly to our step-by-step guide here. If you need to deploy a workspace, start here.

Important note: the full deployment process takes ~15min, the main reason behind this, is to make sure that once you start using the lab, all the data is fully ready for you to use.

What does it include?

This training package includes pre-recorded data that will be ingested into the selected Microsoft Sentinel Workspace. Don’t worry about ingestion costs, the sample data is only 20 MBs in size! This pre-recorded data will land in the following custom log tables: SecurityEvent_CL, SigninLogs_CL, OfficeActivity_CL, AzureActivity_CL, Cisco_Umbrella_dns_CL.

On top of this ingested data, the solution deploys several artifacts to simulate scenarios that showcase various Microsoft Sentinel features. These artifacts are:

3 x Analytics Rules
2 x Hunting queries
2 x Parsers

1 x Workbook
1 x Playbook

During the guided lab you will also deal with Data Connectors, Bookmarks, and other parts of the product.

How does it work?

Microsoft Sentinel Training Lab stores the telemetry to be ingested in CSV format in here. At deployment time, a PowerShell script uses the Log Analytics Data Collector API to push that telemetry into the Microsoft Sentinel workspace. As you may know, if you send telemetry using this API, the data will land in a custom log table. The rest of the artifacts (analytics rules, hunting queries, workbook, etc.) have been modified to use these custom log tables so the experience is completely transparent for you :smiling_face_with_smiling_eyes:.

As mentioned before, the deployment takes around 15 minutes. This is intended because the data can take a while to be available for queries and we want to make sure the lab is fully usable when the deployment finishes.

In summary

The new Microsoft Sentinel Training lab solution allows users to have a full Microsoft Sentinel hands-on experience without having to deploy any additional resources or having to generate any data.

As always, we are open to feedback and suggestions about this training lab, to do so you can open a GitHub issue here.

Have a great learning!

Javier and Yaniv

Updated Nov 11, 2021

Version 1.0

microsoft sentinel

security

YanivSh

Microsoft

Joined September 02, 2018

View Profile

Microsoft Sentinel Blog

Microsoft Sentinel is a cloud-native SIEM, enriched with AI and automation to provide expansive visibility across your digital environment.

When evaluating various solutions, your peers value hearing from people like you who’ve used the product. Review Microsoft Sentinel by filling out a Gartner Peer Insights survey and receive a $25 USD gift card (for customers only). Here are the Privacy/Guideline links: Microsoft Privacy Statement, Gartner’s Community Guidelines & Gartner Peer Insights Review Guide.

12 Comments

imhemantchaubey
Copper Contributor
Oct 31, 2024
Good Day everyone,
Can someone please confirm if this Training Lab solution is still available in Sentinel Content Hub?
Preparing an environment to demo the MS Security Stack, including Defender XDR suite, Purview, Sentinel, Security Copilot & etc. to the customers. I already have other products running in an environment or rather say tenant, so just concerned how will the alerts and incidents injected through the "Training Lab" will work, as entities and certain things might be different on tenant and am not sure what the Training Lab will bring on
Kindly provide any response, or advise you might have, thanks 🙂
SantoshH2490
Copper Contributor
Oct 25, 2024
ArranPON Even with GA it doesnt work for me. Below is my error.

{
    "status": "Failed",
    "error": {
        "code": "BadRequest",
        "message": "{\"error\":{\"code\":\"BadRequest\",\"message\":\"Workspace 'Workspace2' is not onboarded to Microsoft Sentinel. Please onboard through the portal (https://learn.microsoft.com/en-us/azure/sentinel/quickstart-onboard) or use the OnboardingStates ARM api to onboard to Sentinel (https://learn.microsoft.com/en-us/rest/api/securityinsights/sentinel-onboarding-states/create?view=rest-securityinsights-2024-03-01).\"}}"
    }
}
ArranPON
Copper Contributor
Jul 02, 2024
For anyone having the same issue as Youssef6dh if using a dev tenant - I found that I needed to run this using a GA in the original tenant to populate properly. Delegated owner permissions did not work. Hope that helps someone.
JamesRyce
Copper Contributor
Jun 14, 2022
What do you do if you leave the lab for a day, week or so and then come back ... How can you refresh the data so that you do not have to go back 30 days in queries to find results in the data?
rajiulhaque
Copper Contributor
Jun 09, 2022
Love it. I am going thru it.
Youssef6dh
Copper Contributor
May 26, 2022
Hello How can I solve this error when trying to deploying the Microsoft sentinel lab
I have two errors
Sentinel-traning-lab-ws/Microsoft.SecurityInsights/azuresentinel.azure-sentinel-solution-azuretraininglab
{
    "status": "Failed",
    "error": {
        "code": "BadRequest",
        "message": "{\"error\":{\"code\":\"BadRequest\",\"message\":\"Workspace 'Sentinel-traning-lab-ws' is not onboarded to Microsoft Sentinel.\"}}"
    }
}
alertRules
{
"status": "Failed",
"error": {
"code": "DeploymentFailed",
"message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
"details": [
{
"code": "BadRequest",
"message": "{\r\n \"error\": {\r\n \"code\": \"BadRequest\",\r\n \"message\": \"{\\\"error\\\":{\\\"code\\\":\\\"BadRequest\\\",\\\"message\\\":\\\"Workspace 'Sentinel-traning-lab-ws' is not onboarded to Microsoft Sentinel.\\\"}}\"\r\n }\r\n}"
},
{
"code": "BadRequest",
"message": "{\r\n \"error\": {\r\n \"code\": \"BadRequest\",\r\n \"message\": \"{\\\"error\\\":{\\\"code\\\":\\\"BadRequest\\\",\\\"message\\\":\\\"Workspace 'Sentinel-traning-lab-ws' is not onboarded to Microsoft Sentinel.\\\"}}\"\r\n }\r\n}"
},
{
"code": "Unauthorized",
"message": "{\r\n \"error\": {\r\n \"code\": \"Unauthorized\",\r\n \"message\": \"{\\\"error\\\":{\\\"code\\\":\\\"Unauthorized\\\",\\\"message\\\":\\\"Unauthorized access while trying to fetch Azure workspace details: 'Subscription: 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx', ResourceGroup: 'MSSentinelLab', WorkspaceName: 'Sentinel-traning-lab-ws'' under the tenant: 'xxxxxxxxxxxxxxxxxxxxxxxxxxx'\\\"}}\"\r\n }\r\n}"
}
]

Thank you
JamesEduard
Brass Contributor
Nov 19, 2021
awesome thanks for sharing
FreddieKisambu
Copper Contributor
Nov 18, 2021
This is excellent, great job!
JTOLW
Copper Contributor
Nov 15, 2021
Great Initiative!
susanthasilva
Brass Contributor
Nov 13, 2021
Very cool idea. BTW if we apply this to production setup can we remove those sample dataset safely?