Investigating incidents and responding on devices

SC-200 · Manage incident response · Updated

Work incidents in Defender XDR, use device response actions, live response commands and investigation packages to contain threats.

This lesson is part of full SC-200 access

The first 2 SC-200 lessons are free. Full access opens every lesson with its practice questions, and the exam-style SC-200 question bank.

In this lesson
  • The incident
  • Device response actions
  • Live response
  • Related tools
  • Exam traps
  • Practice questions

Get full access Try the free practice exam Log in

SC-200 course outline

All 9 lessons · Course overview
  1. Microsoft Sentinel workspaces, roles and data connectorsManage a security operations environment Free
  2. Defender for Endpoint onboarding, device groups and rolesManage a security operations environment Free
  3. Defender for Cloud plans, servers and security postureConfigure protections and detections Full access
  4. Sentinel analytics rules, UEBA and threat intelligenceConfigure protections and detections Full access
  5. Defender XDR custom detections and alert tuningConfigure protections and detections Full access
  6. Sentinel automation rules and playbooksManage incident response Full access
  7. Investigating incidents and responding on devicesManage incident response Full access
  8. KQL essentials for threat huntingPerform threat hunting Full access
  9. Hunting tools in Sentinel and Defender XDRPerform threat hunting Full access