SC-200: Microsoft Security Operations Analyst
A live, hands-on course on detecting, investigating and responding to threats with Microsoft Sentinel and Microsoft Defender XDR. Built for people who want to do the job with confidence, not just pass a test.
Course overview
SC-200 Security Operations Analyst is a live, hands-on programme on detecting, investigating and responding to threats with Microsoft Sentinel and Microsoft Defender XDR. You practise the real security-operations workflow, from tuning detections to hunting with Kusto Query Language.
The course covers managing a security operations environment, configuring detections and automation, responding to incidents across the Microsoft stack, and threat hunting with KQL, aligned to the current SC-200 skills measured.
What you will learn
- ✓ Manage a security operations environment across Defender XDR and Sentinel
- ✓ Configure detections, automation and attack disruption
- ✓ Investigate and respond to incidents across the Microsoft stack
- ✓ Hunt for threats using Kusto Query Language (KQL)
- ✓ Mitigate threats with Microsoft Defender for Endpoint
- ✓ Connect data sources and tune analytics rules in Sentinel
- ✓ Use the MITRE ATT&CK matrix to assess coverage
Skills you will gain
SC-200 skills blueprint
The areas this exam measures, and the order we teach them live.
Course modules
Manage the SecOps environment
Defender XDR and Sentinel configuration, automation rules, playbooks, and attack surface reduction.
Configure detections and data
Data connectors, analytics rules, custom detections, and the MITRE ATT&CK matrix.
Respond to incidents
Investigating and remediating incidents across Defender for Endpoint, Office 365, Cloud and Identity.
Threat hunting with KQL
Advanced hunting, building KQL queries, hunting queries, and notebooks.
Exam readiness
Revision sets, practice scenarios, and a live readiness check before you book the exam.
Prerequisites
Recommended before you join. We start from a clear baseline, so these help but are not strict gates.
- ✓ Familiarity with Microsoft 365 and Azure services
- ✓ Understanding of security concepts and Windows or Linux operating systems
- ✓ SC-900 level knowledge is helpful, not required
Who this is for
Security operations analysts and engineers who monitor and respond to threats and want the SC-200 certification with real Sentinel and Defender practice.
The SC-200 exam at a glance
Exam is booked separately with Microsoft. Figures are indicative of the current format; we confirm the specifics during your programme.
Where this can take you
Common questions
Is this live or recorded?
Every session is live and instructor-led over Microsoft Teams. There are no pre-recorded videos. You learn with a real trainer and a small group.
When does the next batch start?
Batches form on a rolling basis. Send an enquiry and we will reply with the next available start date and times that fit your schedule.
How are session times decided?
Once you enquire, we set up a short Microsoft Teams call to agree the days and times that work for the batch.
Do you include hands-on labs?
Yes. You practise in a real environment throughout the SC-200 course, so the exam tasks feel routine by the time you sit it.
Does the price include the exam voucher?
Tell us during your enquiry and we will confirm what is included for your batch.
Ready to join the next SC-200 batch?
Send an enquiry and we will confirm the next live start date, then set a time together over Teams.