Defender XDR custom detections and alert tuning

SC-200 · Configure protections and detections · Updated

Write KQL for Defender XDR custom detection rules, meet the required columns, and tune false positives with suppression rules.

This lesson is part of full SC-200 access

The first 2 SC-200 lessons are free. Full access opens every lesson with its practice questions, and the exam-style SC-200 question bank.

In this lesson
  • What the query must return
  • Schedule and actions
  • Alert tuning
  • Attack surface reduction
  • Exam traps
  • Practice questions

Get full access Try the free practice exam Log in

SC-200 course outline

All 9 lessons · Course overview
  1. Microsoft Sentinel workspaces, roles and data connectorsManage a security operations environment Free
  2. Defender for Endpoint onboarding, device groups and rolesManage a security operations environment Free
  3. Defender for Cloud plans, servers and security postureConfigure protections and detections Full access
  4. Sentinel analytics rules, UEBA and threat intelligenceConfigure protections and detections Full access
  5. Defender XDR custom detections and alert tuningConfigure protections and detections Full access
  6. Sentinel automation rules and playbooksManage incident response Full access
  7. Investigating incidents and responding on devicesManage incident response Full access
  8. KQL essentials for threat huntingPerform threat hunting Full access
  9. Hunting tools in Sentinel and Defender XDRPerform threat hunting Full access