Hunting tools in Sentinel and Defender XDR

SC-200 · Perform threat hunting · Updated

Use hunting queries, bookmarks, livestream, notebooks and advanced hunting in the Defender portal, plus Copilot for Security basics.

This lesson is part of full SC-200 access

The first 2 SC-200 lessons are free. Full access opens every lesson with its practice questions, and the exam-style SC-200 question bank.

In this lesson
  • The hunting loop
  • Tool comparison
  • Advanced hunting in Defender XDR
  • Copilot for Security
  • Exam traps
  • Practice questions

Get full access Try the free practice exam Log in

SC-200 course outline

All 9 lessons · Course overview
  1. Microsoft Sentinel workspaces, roles and data connectorsManage a security operations environment Free
  2. Defender for Endpoint onboarding, device groups and rolesManage a security operations environment Free
  3. Defender for Cloud plans, servers and security postureConfigure protections and detections Full access
  4. Sentinel analytics rules, UEBA and threat intelligenceConfigure protections and detections Full access
  5. Defender XDR custom detections and alert tuningConfigure protections and detections Full access
  6. Sentinel automation rules and playbooksManage incident response Full access
  7. Investigating incidents and responding on devicesManage incident response Full access
  8. KQL essentials for threat huntingPerform threat hunting Full access
  9. Hunting tools in Sentinel and Defender XDRPerform threat hunting Full access