If you've already completed the training, you can focus on the latest updates (June 2022 update).

Do you want to become a Microsoft Defender for Office 365 ninja? We can help you get there! We collected content for two roles: “Security Operations (SecOps)” and “Email Security\" teams. The content is structured into three different knowledge levels (Fundamentals, Intermediate, and Advanced) with multiple modules per level. Some of the topics are relevant for SecOps as well as for Email Security teams. This training will be updated on a regular basis to ensure you have access to the most current information available.

Short Link: aka.ms/MDONinja

NEW: After each level, we will offer you a knowledge check based on the training material you have just finished! Since there’s a lot of content, the goal of the knowledge checks is to help ensure understanding of the key concepts that were covered. Lastly, there’ll be a fun certificate issued at the end of the training! Disclaimer: This is not an official Microsoft certification and only acts as a way of recognizing your participation in this training content.

Note: Threat protection product names from Microsoft have recently changed. Read more about this and other updates here.

\n
Microsoft 365 Defender (previously Microsoft Threat Protection)
\n
\n
Microsoft Defender for Endpoint (previously Microsoft Defender Advanced Threat Protection)
\n
\n
Microsoft Defender for Office 365 (previously Office 365 Advanced Threat Protection)
\n
\n
Microsoft Defender for Identity (previously Azure Advanced Threat Protection)
\n
Microsoft Defender for Cloud Apps (previously Microsoft Cloud Apps Security)

Please let us know what you think about this training here: https://aka.ms/MDONinjasurvey

P.S. I wanted to give my colleague, HeikeRitter a big thank you for laying the groundwork for Ninja Training and for all of her help, along with Giulian Garruba & Bruno Nowak! Thank you!

_____________________________________________________________________________________

Table of Contents

Email Security - Fundamentals

(Deployment / Migration)

Module 1. Technical overview

Module 2. Getting started

(Prevention & Detection)

Module 3. Configuration (Part I)

Module 4. Protection Feature

(Awareness)

Module5. General Awareness

Email Security - Intermediate

(Prevention & Detection)

Module 1. Configuration (Part II)

Module 2. Alert Management

Module 3. Mail flow

Module 4. Zero Hour Auto-Purge (ZAP)

(Investigation & Hunting)

Module 5. Investigating Alerts

Module 6. Advanced hunting (overview)

Module 7. Automated Investigation and Remediation (AIR)

Module 8. Threat Insights

(Response & Remediation)

Module 9. Alert Handling

Module 10. Manage Quarantined Messages

(Reporting)

Module 11. Reporting

Security Operations - Advanced

(SOC Flows)

Module 1. SIEM Integration & APIs

Module 2. False Positive/False Negative Management Flows

Module 3. Automation

Module 4. Migration

(Investigation & Hunting)

Module 5. Advanced hunting (Kusto training)

(Training)

Module 6. Attack Simulation Training

(Awareness)

Module 7. Security Operations

Module 8. Other Advance Topics

(Supplemental)

Supplemental Content (Tech Community links)

Legend:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

\n DOCS: Docs on Microsoft \n	\n BLOG: Blogs on Microsoft \n
\n VIDEO: Product videos \n	\n WEBC: Webcast recordings \n
\n MTC: Microsoft Tech Community \n	\n IG: Interactive guides \n
\n EXT: External \n	\n GIT: GitHub \n

Email Security - Fundamentals

(Deployment / Migration)

Module 1. Technical overview

\n
DOCS Understanding where Microsoft Defender for Office 365 fits in the Microsoft 365 Security Center
\n
\n
DOCS What is Microsoft Defender for Office 365?
\n
\n
BLOG Introducing Microsoft Defender for Office 365
\n
\n
DOCS Secure by default in Office 365
\n
\n
DOCS The unified Microsoft 365 security center overview
\n
\n
IG Interactive guide to Microsoft Defender for Office 365
\n
\n
BLOG Get the most out of Office 365 ATP (Microsoft Defender for Office 365) in the shift to remote work
\n

Module 2. Getting started

\n
DOCS Evaluate Microsoft Defender for Office 365
\n
\n
DOCS Configuration analyzer for protection policies in EOP and Microsoft Defender for Office 365
\n
\n
GIT ORCA (Office 365 Advanced Threat Protection Recommended Configuration A nalyzer)
\n
EXT Reviewing your configuration with ORCA
\n
BLOG Enhanced Filtering for Connectors: Supporting hybrid mail routing configurations in Office 365
\n
\n
DOCS Threat Explorer and Real-time detections
\n
\n
BLOG Evaluate Defender for Office 365 in your environment! [New!]
\n
EXT Microsoft Defender for Office 365 setup guide (licensed partners access only) [New]

(Prevention & Detection)

Module 3. Configuration (Part I)

\n
VIDEO Mastering Configuration in Microsoft Defender for Office 365
\n
\n
BLOG Mastering Configuration Blog Series
\n
\n
DOCS Preset security policies in Exchange Online Protection and Microsoft Defender for Office 365
\n
\n
DOCS Recommended settings for Exchange Online Protection and Microsoft Defender for Office 365 security
\n
\n
DOCS Protect against threats
\n
\n
DOCS Report messages and files to Microsoft
\n
\n
DOCS User submissions policies (add-in for end users)
\n
\n
DOCS Use Admin Submission to submit suspected spam, phish, URLs, and files to Microsoft
\n
\n
BLOG Configurable impersonation protection and scope for Preset Security policies [New!]
\n

Module 4. Protection Feature

\n
VIDEO Protect against malicious links with Safe Links in Microsoft Defender for Office 365
\n
\n
BLOG Introducing differentiated protection for priority accounts in Microsoft Defender for Office 365 [New!]
\n

(Awareness)

Module 5. General Awareness

\n
BLOG Protecting against coronavirus themed phishing attacks
\n
\n
BLOG New Threat analytics report shares the latest intelligence on recent nation-state cyber attacks
\n
\n
BLOG New Home for Microsoft Defender for Office 365 [New!]
\n

>Ready for the Fundamentals Knowledge Check?

____________________________________________________________________________________________

Email Security - Intermediate

(Prevention & Detection)

Module 1. Configuration (Part II)

\n
DOCS Email authentication (SPF, DMARC, DKIM)
\n
\n
DOCS Configure outbound spam filtering
\n
DOCS Impersonation settings in anti-phishing policies in Microsoft Defender for Office 365
\n
BLOG Improving “Defense in Depth” with Trusted ARC Sealers for Microsoft Defender for Office 365 [New!]
\n

Module 2. Alert Management

\n
DOCS Managing Alerts: Alert policies in the Security & Compliance Center
\n
\n
VIDEO Managing alerts in Microsoft Defender for Office 365
\n
\n
BLOG Announcing Priority Account Protection in Defender for Office 365
\n
\n
VIDEO Protect your most visible and most targeted user with Microsoft Defender for 365
\n

Module 3. Mail flow

\n
DOCS Outbound spam protection in Exchange Online Protection
\n
\n
DOCS Mail flow insights in the Security & Compliance Center
\n
\n
DOCS Mail flow rules (transport rules) in standalone Exchange Online Protection
\n
\n
DOCS Message trace in the Security & Compliance Center
\n

Module 4. Zero-Hour Auto Purge

\n
DOCS Zero-Hour Auto Purge (ZAP) in Exchange Online
\n
\n
VIDEO Zero-Hour Auto Purge (ZAP) in Microsoft Defender for Office 365
\n

(Investigation & Hunting)

Module 5. Investigating Alerts

\n
VIDEO Get more out of Microsoft Defender for Office 365 with Microsoft 365 Defender
\n
\n
BLOG Investigating alerts
\n
\n
VIDEO Incident correlation with Microsoft Defender for Office 365
\n
\n
BLOG Microsoft Defender for Office 365 investigation improvements coming soon
\n
\n
BLOG Investigate malicious email that was delivered in Office 365
\n

Module 6. Advanced Hunting (overview)

\n
VIDEO Hunting in Microsoft Defender for Office 365
\n

Module 7. Automated Investigation and Remediation

\n
DOCS AIR Overview: Automated investigation and response (AIR) in Microsoft Defender for Office 365
\n
\n
DOCS How automated investigation and response works in Microsoft Defender for Office 365
\n
\n
DOCS Details and results of an automated investigation in Microsoft 365
\n
\n
BLOG Self-healing in Microsoft 365 Defender
\n

Module 8. Threat Insights

\n
DOCS Walkthrough - Spoof intelligence insight in Microsoft Defender for Office 365
\n
\n
BLOG Business Email: Uncompromised – Part One
\n
\n
BLOG Business Email: Uncompromised – Part Two
\n
\n
BLOG Business Email: Uncompromised – Part Three
\n
\n
VIDEO How to prevent business email compromise using Microsoft Defender for Office 365
\n

(Response & Remediation)

Module 9. Alert handling

\n
DOCS Remediation actions in Microsoft Defender for Office 365
\n
\n
DOCS Review and manage remediation actions in Office 365
\n
\n
VIDEO Campaign Views in Microsoft Defender for Office 365
\n
BLOG Announcing Campaign Views and Compromised User Detection and Response
\n
VIDEO Detect and respond to compromise in Microsoft Defender for Office 365
\n
\n
BLOG Email remediation actions now available in unified Action Center [New!]
\n

Module 10. Manage quarantined messages

\n
DOCS Manage quarantined messages and files as an administrator
\n
\n
VIDEO Managing the user quarantine in Microsoft Defender for Office 365
\n
\n
VIDEO Manage the admin quarantine in Microsoft Defender for Office 365
\n
\n
BLOG Simplifying the Quarantine Experience - Part One [New!]
\n
\n
BLOG Simplifying the Quarantine Experience - Part Two [New!]
\n

(Reporting)

Module 11. Reports / Custom Reporting

\n
DOCS Smart reports and insights in the Security & Compliance Center
\n
\n
DOCS View Defender for Office 365 reports in the Reports dashboard in the Security & Compliance Center
\n
\n
BLOG Reporting an email in Microsoft Defender for Office 365 [New!]
\n

>Ready for the Intermediate Knowledge Check?

____________________________________________________________________________________________

Security Operations - Advanced

(SOC Flows)

Module 1. SIEM Integration & APIs

\n
BLOG Say hello to the new Microsoft Threat Protection APIs!
\n
\n
BLOG Best practices for leveraging Microsoft 365 Defender API's - Episode One
\n
\n
BLOG Best practices for leveraging Microsoft 365 Defender API's - Episode Two
\n
\n
BLOG Improve the Effectiveness of your SOC with Office 365 ATP and the O365 Management API
\n
\n
DOCS Custom or third-party reporting solutions for Microsoft Defender for Office 365
\n

Module 2. False Positive / False Negative Management Flows

\n
DOCS Manually submit messages to Microsoft for analysis (FP/FN submission)
\n
\n
DOCS Handle FPs/FNs: How to report false positives/negatives in automated investigation and response capabilities
\n

Module 3. Automation

\n
VIDEO Use Office Advanced Threat Protection automation for efficient Incident Response
\n

Module 4. Migration

\n
BLOG Introducing the Microsoft Defender for Office 365 Migration Guide
\n
\n
VIDEO Microsoft Defender for Office 365 Migration Overview
\n
\n
DOCS Migration from a third-party protection Service to Microsoft Defender for Office 365
\n

(Investigation & Hunting)

Module 5. Advanced Hunting (Kusto training)

\n
VIDEO KQL part 1 of 3: Learn the KQL you need (part of Azure Sentinel webinar series)
\n
\n
VIDEO KQL part 2 of 3: KQL hands-on lab exercises (part of Azure Sentinel webinar series)
\n
\n
VIDEO KOL part 3 of 3: Optimizing KQL queries (part of Azure Sentinel webinar series)
\n
EXT Pluralsight KQL training

(Training)

Module 6. Attack Simulation Training

\n
BLOG Attack simulation training in Microsoft Defender for Office 365 now Generally Available
\n
\n
VIDEO Attack Simulation Training with Microsoft
\n
\n
DOCS Get started using Attack Simulation Training in Microsoft Defender for Office 365
\n
\n
BLOG Setting up a New Phish Simulation Program - Part One
\n
\n
BLOG Setting up a New Phish Simulation Program - Part Two
\n
\n
BLOG Announcing Attack Simulation Training Read APIs - Now in Beta! [New!]
\n
\n
BLOG End user email notifications are now customizable [New!]
\n
\n
BLOG Attack Simulation Training: User tags based targeting in simulations - now live [New!]
\n
\n
BLOG End user email notifications are now customizable - Part 2 [New!]
\n
\n
BLOG Introducing Additional Dynamic Tags in Attack Simulation [New!]
\n
\n
BLOG Customize login pages in Attack Simulation Training [New!]
\n

(Awareness)

Module 7. Security Operations

\n
VIDEO Improving your SecOps efficiency with Defender for Office 365 Workflow)
\n
\n
VIDEO Microsoft Defender for Office 365 The Unified SecOps Experience
\n
\n
DOCS Microsoft Defender for Office 365 Security Operations Guide [New!]
\n
\n
DOCS Manage incidents and alerts from Microsoft Defender for Office 365 in Microsoft 365 Defender [New!]
\n
\n
BLOG Introducing the UrlClickEvents table in advanced hunting with Microsoft Defender for Office 365[New!]
\n

Module 8. Other Advance Topics

DOCS Connect Microsoft Defender for Office 365 to Microsoft Sentinel [New!]

>Ready for the Experts Knowledge Check?

____________________________________________________________________________________________

Supplemental Content

\n
MTC Microsoft Defender for Office 365 - Microsoft Tech Community
\n
\n
MTC Microsoft Security and Compliance - Microsoft Tech Community
\n
\n
MTC Microsoft Defender for Office 365 - Homepage
\n

Once you’ve finished the training and the knowledge checks, please click here to request your certificate. You'll see it in your inbox within 3-5 business days.

Please let us know what you think about this training here: https://aka.ms/MDONinjasurvey

Interested in other ninja trainings? There are also ninja trainings for:

Microsoft Defender for Endpoint (MDE) - http://aka.ms/mdeninja

Microsoft Defender for Cloud Apps (MDCA) - http://aka.ms/mdcaninja

Microsoft Defender for Identity (MDI) - http://aka.ms/mdininja

Follow us on LinkedIn as #DefenderForOffice365. Bookmark the Security blog to keep up with expert coverage on security matters. Also, follow @MSFTSecurity on Twitter and Microsoft Security on LinkedIn for the latest news and updates on cybersecurity.

If you've already completed the training, you can focus on the latest updates (June 2022 update).

Short Link: aka.ms/MDONinja

Note: Threat protection product names from Microsoft have recently changed. Read more about this and other updates here.

\n
Microsoft 365 Defender (previously Microsoft Threat Protection)
\n
\n
Microsoft Defender for Endpoint (previously Microsoft Defender Advanced Threat Protection)
\n
\n
Microsoft Defender for Office 365 (previously Office 365 Advanced Threat Protection)
\n
\n
Microsoft Defender for Identity (previously Azure Advanced Threat Protection)
\n
Microsoft Defender for Cloud Apps (previously Microsoft Cloud Apps Security)

Please let us know what you think about this training here: https://aka.ms/MDONinjasurvey

P.S. I wanted to give my colleague, a big thank you for laying the groundwork for Ninja Training and for all of her help, along with & ! Thank you!

_____________________________________________________________________________________

Table of Contents

Email Security - Fundamentals

(Deployment / Migration)

Module 1. Technical overview

Module 2. Getting started

(Prevention & Detection)

Module 3. Configuration (Part I)

Module 4. Protection Feature

(Awareness)

Module5. General Awareness

Email Security - Intermediate

(Prevention & Detection)

Module 1. Configuration (Part II)

Module 2. Alert Management

Module 3. Mail flow

Module 4. Zero Hour Auto-Purge (ZAP)

(Investigation & Hunting)

Module 5. Investigating Alerts

Module 6. Advanced hunting (overview)

Module 7. Automated Investigation and Remediation (AIR)

Module 8. Threat Insights

(Response & Remediation)

Module 9. Alert Handling

Module 10. Manage Quarantined Messages

(Reporting)

Module 11. Reporting

Security Operations - Advanced

(SOC Flows)

Module 1. SIEM Integration & APIs

Module 2. False Positive/False Negative Management Flows

Module 3. Automation

Module 4. Migration

(Investigation & Hunting)

Module 5. Advanced hunting (Kusto training)

(Training)

Module 6. Attack Simulation Training

(Awareness)

Module 7. Security Operations

Module 8. Other Advance Topics

(Supplemental)

Supplemental Content (Tech Community links)

Legend:

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n

\n DOCS: Docs on Microsoft \n	\n BLOG: Blogs on Microsoft \n
\n VIDEO: Product videos \n	\n WEBC: Webcast recordings \n
\n MTC: Microsoft Tech Community \n	\n IG: Interactive guides \n
\n EXT: External \n	\n GIT: GitHub \n

Email Security - Fundamentals

(Deployment / Migration)

Module 1. Technical overview

\n
DOCS Understanding where Microsoft Defender for Office 365 fits in the Microsoft 365 Security Center
\n
\n
DOCS What is Microsoft Defender for Office 365?
\n
\n
BLOG Introducing Microsoft Defender for Office 365
\n
\n
DOCS Secure by default in Office 365
\n
\n
DOCS The unified Microsoft 365 security center overview
\n
\n
IG Interactive guide to Microsoft Defender for Office 365
\n
\n
BLOG Get the most out of Office 365 ATP (Microsoft Defender for Office 365) in the shift to remote work
\n

Module 2. Getting started

\n
DOCS Evaluate Microsoft Defender for Office 365
\n
\n
DOCS Configuration analyzer for protection policies in EOP and Microsoft Defender for Office 365
\n
\n
GIT ORCA (Office 365 Advanced Threat Protection Recommended Configuration A nalyzer)
\n
EXT Reviewing your configuration with ORCA
\n
BLOG Enhanced Filtering for Connectors: Supporting hybrid mail routing configurations in Office 365
\n
\n
DOCS Threat Explorer and Real-time detections
\n
\n
BLOG Evaluate Defender for Office 365 in your environment! [New!]
\n
EXT Microsoft Defender for Office 365 setup guide (licensed partners access only) [New]

(Prevention & Detection)

Module 3. Configuration (Part I)

\n
VIDEO Mastering Configuration in Microsoft Defender for Office 365
\n
\n
BLOG Mastering Configuration Blog Series
\n
\n
DOCS Preset security policies in Exchange Online Protection and Microsoft Defender for Office 365
\n
\n
DOCS Recommended settings for Exchange Online Protection and Microsoft Defender for Office 365 security
\n
\n
DOCS Protect against threats
\n
\n
DOCS Report messages and files to Microsoft
\n
\n
DOCS User submissions policies (add-in for end users)
\n
\n
DOCS Use Admin Submission to submit suspected spam, phish, URLs, and files to Microsoft
\n
\n
BLOG Configurable impersonation protection and scope for Preset Security policies [New!]
\n

Module 4. Protection Feature

\n
VIDEO Protect against malicious links with Safe Links in Microsoft Defender for Office 365
\n
\n
BLOG Introducing differentiated protection for priority accounts in Microsoft Defender for Office 365 [New!]
\n

(Awareness)

Module 5. General Awareness

\n
BLOG Protecting against coronavirus themed phishing attacks
\n
\n
BLOG New Threat analytics report shares the latest intelligence on recent nation-state cyber attacks
\n
\n
BLOG New Home for Microsoft Defender for Office 365 [New!]
\n

>Ready for the Fundamentals Knowledge Check?

____________________________________________________________________________________________

Email Security - Intermediate

(Prevention & Detection)

Module 1. Configuration (Part II)

\n
DOCS Email authentication (SPF, DMARC, DKIM)
\n
\n
DOCS Configure outbound spam filtering
\n
DOCS Impersonation settings in anti-phishing policies in Microsoft Defender for Office 365
\n
BLOG Improving “Defense in Depth” with Trusted ARC Sealers for Microsoft Defender for Office 365 [New!]
\n

Module 2. Alert Management

\n
DOCS Managing Alerts: Alert policies in the Security & Compliance Center
\n
\n
VIDEO Managing alerts in Microsoft Defender for Office 365
\n
\n
BLOG Announcing Priority Account Protection in Defender for Office 365
\n
\n
VIDEO Protect your most visible and most targeted user with Microsoft Defender for 365
\n

Module 3. Mail flow

\n
DOCS Outbound spam protection in Exchange Online Protection
\n
\n
DOCS Mail flow insights in the Security & Compliance Center
\n
\n
DOCS Mail flow rules (transport rules) in standalone Exchange Online Protection
\n
\n
DOCS Message trace in the Security & Compliance Center
\n

Module 4. Zero-Hour Auto Purge

\n
DOCS Zero-Hour Auto Purge (ZAP) in Exchange Online
\n
\n
VIDEO Zero-Hour Auto Purge (ZAP) in Microsoft Defender for Office 365
\n

(Investigation & Hunting)

Module 5. Investigating Alerts

\n
VIDEO Get more out of Microsoft Defender for Office 365 with Microsoft 365 Defender
\n
\n
BLOG Investigating alerts
\n
\n
VIDEO Incident correlation with Microsoft Defender for Office 365
\n
\n
BLOG Microsoft Defender for Office 365 investigation improvements coming soon
\n
\n
BLOG Investigate malicious email that was delivered in Office 365
\n

Module 6. Advanced Hunting (overview)

\n
VIDEO Hunting in Microsoft Defender for Office 365
\n

Module 7. Automated Investigation and Remediation

\n
DOCS AIR Overview: Automated investigation and response (AIR) in Microsoft Defender for Office 365
\n
\n
DOCS How automated investigation and response works in Microsoft Defender for Office 365
\n
\n
DOCS Details and results of an automated investigation in Microsoft 365
\n
\n
BLOG Self-healing in Microsoft 365 Defender
\n

Module 8. Threat Insights

\n
DOCS Walkthrough - Spoof intelligence insight in Microsoft Defender for Office 365
\n
\n
BLOG Business Email: Uncompromised – Part One
\n
\n
BLOG Business Email: Uncompromised – Part Two
\n
\n
BLOG Business Email: Uncompromised – Part Three
\n
\n
VIDEO How to prevent business email compromise using Microsoft Defender for Office 365
\n

(Response & Remediation)

Module 9. Alert handling

\n
DOCS Remediation actions in Microsoft Defender for Office 365
\n
\n
DOCS Review and manage remediation actions in Office 365
\n
\n
VIDEO Campaign Views in Microsoft Defender for Office 365
\n
BLOG Announcing Campaign Views and Compromised User Detection and Response
\n
VIDEO Detect and respond to compromise in Microsoft Defender for Office 365
\n
\n
BLOG Email remediation actions now available in unified Action Center [New!]
\n

Module 10. Manage quarantined messages

\n
DOCS Manage quarantined messages and files as an administrator
\n
\n
VIDEO Managing the user quarantine in Microsoft Defender for Office 365
\n
\n
VIDEO Manage the admin quarantine in Microsoft Defender for Office 365
\n
\n
BLOG Simplifying the Quarantine Experience - Part One [New!]
\n
\n
BLOG Simplifying the Quarantine Experience - Part Two [New!]
\n

(Reporting)

Module 11. Reports / Custom Reporting

\n
DOCS Smart reports and insights in the Security & Compliance Center
\n
\n
DOCS View Defender for Office 365 reports in the Reports dashboard in the Security & Compliance Center
\n
\n
BLOG Reporting an email in Microsoft Defender for Office 365 [New!]
\n

>Ready for the Intermediate Knowledge Check?

____________________________________________________________________________________________

Security Operations - Advanced

(SOC Flows)

Module 1. SIEM Integration & APIs

\n
BLOG Say hello to the new Microsoft Threat Protection APIs!
\n
\n
BLOG Best practices for leveraging Microsoft 365 Defender API's - Episode One
\n
\n
BLOG Best practices for leveraging Microsoft 365 Defender API's - Episode Two
\n
\n
BLOG Improve the Effectiveness of your SOC with Office 365 ATP and the O365 Management API
\n
\n
DOCS Custom or third-party reporting solutions for Microsoft Defender for Office 365
\n

Module 2. False Positive / False Negative Management Flows

\n
DOCS Manually submit messages to Microsoft for analysis (FP/FN submission)
\n
\n
DOCS Handle FPs/FNs: How to report false positives/negatives in automated investigation and response capabilities
\n

Module 3. Automation

\n
VIDEO Use Office Advanced Threat Protection automation for efficient Incident Response
\n

Module 4. Migration

\n
BLOG Introducing the Microsoft Defender for Office 365 Migration Guide
\n
\n
VIDEO Microsoft Defender for Office 365 Migration Overview
\n
\n
DOCS Migration from a third-party protection Service to Microsoft Defender for Office 365
\n

(Investigation & Hunting)

Module 5. Advanced Hunting (Kusto training)

\n
VIDEO KQL part 1 of 3: Learn the KQL you need (part of Azure Sentinel webinar series)
\n
\n
VIDEO KQL part 2 of 3: KQL hands-on lab exercises (part of Azure Sentinel webinar series)
\n
\n
VIDEO KOL part 3 of 3: Optimizing KQL queries (part of Azure Sentinel webinar series)
\n
EXT Pluralsight KQL training

(Training)

Module 6. Attack Simulation Training

\n
BLOG Attack simulation training in Microsoft Defender for Office 365 now Generally Available
\n
\n
VIDEO Attack Simulation Training with Microsoft
\n
\n
DOCS Get started using Attack Simulation Training in Microsoft Defender for Office 365
\n
\n
BLOG Setting up a New Phish Simulation Program - Part One
\n
\n
BLOG Setting up a New Phish Simulation Program - Part Two
\n
\n
BLOG Announcing Attack Simulation Training Read APIs - Now in Beta! [New!]
\n
\n
BLOG End user email notifications are now customizable [New!]
\n
\n
BLOG Attack Simulation Training: User tags based targeting in simulations - now live [New!]
\n
\n
BLOG End user email notifications are now customizable - Part 2 [New!]
\n
\n
BLOG Introducing Additional Dynamic Tags in Attack Simulation [New!]
\n
\n
BLOG Customize login pages in Attack Simulation Training [New!]
\n

(Awareness)

Module 7. Security Operations

\n
VIDEO Improving your SecOps efficiency with Defender for Office 365 Workflow)
\n
\n
VIDEO Microsoft Defender for Office 365 The Unified SecOps Experience
\n
\n
DOCS Microsoft Defender for Office 365 Security Operations Guide [New!]
\n
\n
DOCS Manage incidents and alerts from Microsoft Defender for Office 365 in Microsoft 365 Defender [New!]
\n
\n
BLOG Introducing the UrlClickEvents table in advanced hunting with Microsoft Defender for Office 365[New!]
\n

Module 8. Other Advance Topics

DOCS Connect Microsoft Defender for Office 365 to Microsoft Sentinel [New!]

>Ready for the Experts Knowledge Check?

____________________________________________________________________________________________

Supplemental Content

\n
MTC Microsoft Defender for Office 365 - Microsoft Tech Community
\n
\n
MTC Microsoft Security and Compliance - Microsoft Tech Community
\n
\n
MTC Microsoft Defender for Office 365 - Homepage
\n

Once you’ve finished the training and the knowledge checks, please click here to request your certificate. You'll see it in your inbox within 3-5 business days.

Please let us know what you think about this training here: https://aka.ms/MDONinjasurvey

Interested in other ninja trainings? There are also ninja trainings for:

Microsoft Defender for Endpoint (MDE) - http://aka.ms/mdeninja

Microsoft Defender for Cloud Apps (MDCA) - http://aka.ms/mdcaninja

Microsoft Defender for Identity (MDI) - http://aka.ms/mdininja