Last updated: May 18th 2022
Do you want to become a ninja for Microsoft Defender for Endpoint? We can help you get there! We collected content for two roles: “Security Operations (SecOps)” and “Security Administrator (SecAdmin)”. The content is structured into three different knowledge levels, with multiple modules: Fundamentals, Intermediate, and Expert. Some topics can be relevant for SecOps as well as for SecAdmins and are listed for both roles. We will keep updating this training on a regular basis.
In addition, after each level, we offer you a knowledge check based on the training material you have just finished! Since there’s a lot of content, the goal of the knowledge checks is to help ensure understanding of the key concepts that were covered. Lastly, there’ll be a fun certificate issued at the end of the training: Disclaimer: This is not an official Microsoft certification and only acts as a way of recognizing your participation in this training content.
If you already did the training, you can focus on the latest updates (August 2021 update)
Table of Contents
Security Operations Fundamentals
Module 3. Threat and vulnerability management
Module 4. Attack surface reduction
Module 5. Next generation protection
Module 6. Investigation – Incident
Module 8. Automated investigation and remediation
Module 9. Microsoft Threat Experts
Security Operations Intermediate
Module 2. Threat and vulnerability management
Module 3. Next generation protection.
Module 5. Automated investigation and remediation
Module 7. Unified indicators of compromise (IOCs)
Module 9. Community (blogs, webinars, GitHub)
Module 1. Responding to threats
Module 5. Unified indicators of compromise IOCs
Module 7. Community (blogs, webinars, GitHub)
Security Administrator Fundamentals
Module 3. Grant and control access
Module 4. Security configuration
Security Administrator Intermediate
Module 1. Threat and vulnerability management (TVM)
Module 2. Attack surface reduction
Module 3. Next generation protection
Module 6. Microsoft Cloud App Security (MCAS)
Module 7. Community (blogs, webinars, GitHub)
Module 1. Custom reporting (PowerBI)
Module 3. Custom Integrations, APIs
Learn about our partner integrations
Legend:
|
|
|
|
|
|
|
|
|
⤴ External |
|
Security Operations Fundamentals
Module 1. Technical overview
Module 2. Getting started
Portal overview
Welcome to Microsoft 365 Defender!
How to use RBAC
Module 3. Threat and vulnerability management
"Bringing IT & security together: How Microsoft is reinventing threat and vulnerability management"
Reduce organizational risk with threat and vulnerability management
Module 4. Attack surface reduction
Module 5. Next generation protection
Module 6. Investigation – Incident
-
Module 7. Alert handling
Module 8. Automated investigation and remediation
Module 9. Microsoft Threat Experts
Module 10. Reporting
Module 11. Evaluation Lab
> Ready for the Fundamentals Knowledge Check?
Security Operations Intermediate
Module 1.Architecture
Module 2. Threat and vulnerability management
Module 3. Next generation protection
Module 4. Advanced hunting
Module 5. Automated investigation and remediation
Module 6. Threat analytics
Module 7. Unified indicators of compromise (IOCs)
Module 8. Evaluation lab
Module 9. Community (blogs, webinars, GitHub)
> Ready for the Intermediate Knowledge Check?
Module 1. Responding to threats
Module 2. Alert handling
Module 3. File analysis
Module 4. Advanced hunting
Module 5. Unified indicators of compromise IOCs
Module 6. Custom reporting
Module 7. Community (blogs, webinars, GitHub)
> Ready for the Expert Knowledge Check?
Security Administrator Fundamentals
Module 1. Architecture
Module 2. Onboarding
Module 3. Grant and control access
Module 4. Security configuration
Module 5. Reporting
Module 6. SIEM Integration
> Ready for the Fundamentals Knowledge Check?
Security Administrator Intermediate
Module 1. Threat and vulnerability management (TVM)
Custom TVM reports on GitHub
Module 2. Attack surface reduction
Module 3. Next generation protection
Module 4. Advanced hunting
Module 5. Conditional access
Module 6. Microsoft Defender for Cloud Apps
Module 7. Community (blogs, webinars, GitHub)
Module 8. Migration
> Ready for the Intermediate Knowledge Check?
Module 1. Custom reporting (PowerBI)
Module 2. Advanced hunting
Module 3. Custom Integrations, APIs
Learn about our partner integrations
> Ready for the Expert Knowledge Check?
Once you’ve finished the training and the knowledge checks, please click here to request your certificate (you'll see it in your inbox within 3-5 business days.)