Microsoft Sentinel and Log Analytics queries

AZ-500 · Secure Azure using Microsoft Defender for Cloud and Microsoft Sentinel · Updated

Data connectors, analytics rules, incidents, playbooks and the KQL basics used to hunt failed sign-ins in Microsoft Sentinel.

This lesson is part of full AZ-500 access

The first 2 AZ-500 lessons are free. Full access opens every lesson with its practice questions, and the exam-style AZ-500 question bank.

In this lesson
  • Building blocks
  • KQL in practice
  • Exam traps
  • Practice questions

Get full access Try the free practice exam Log in

AZ-500 course outline

All 8 lessons · Course overview
  1. Conditional Access and MFA in Microsoft Entra IDSecure identity and access Free
  2. Privileged Identity Management and Azure RBACSecure identity and access Free
  3. App registrations and managed identitiesSecure identity and access Full access
  4. NSGs, ASGs and Azure FirewallSecure networking Full access
  5. Private endpoints, service endpoints and BastionSecure networking Full access
  6. Azure Key Vault and disk encryptionSecure compute, storage and databases Full access
  7. Microsoft Defender for Cloud essentialsSecure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Full access
  8. Microsoft Sentinel and Log Analytics queriesSecure Azure using Microsoft Defender for Cloud and Microsoft Sentinel Full access