Microsoft Defender training

Lesson 1 • Navigating the Microsoft Defender Portal

Orients students to the unified Defender portal interface and key navigation paths. Enables efficient daily use of dashboards and investigation tools.

Lesson 2 • Core Defender Architecture

Explains the shared architectural principles across Defender products. Connects agent-based and agentless models to deployment decisions.

Lesson 3 • Threat Intelligence Foundations

Introduces Microsoft threat intelligence signals that power Defender detections. Grounds students in how global signal data translates to local alerts.

Lesson 1 • Attack Surface Reduction Rules

Explains ASR rules that block common attack vectors before execution. Students configure and tune rules to balance security and productivity.

Lesson 2 • Endpoint Vulnerability Management

Introduces the built-in vulnerability management module for asset exposure tracking. Students prioritize and remediate software vulnerabilities using risk scoring.

Lesson 3 • Onboarding Endpoints to Defender

Covers supported platforms and onboarding methods for Windows, macOS, Linux, and mobile. Prepares students to deploy sensors at scale.

Lesson 4 • Automated Investigation and Remediation

Covers AIR workflows that automatically investigate and remediate threats. Students learn to review, approve, and override automated actions.

Lesson 1 • Identity Threat Detection Concepts

Establishes how attackers exploit identity infrastructure and how Defender for Identity counters these tactics. Grounds students in AD attack patterns.

Lesson 2 • Protecting Privileged Accounts

Focuses on monitoring and hardening high-value accounts using Defender for Identity insights. Students apply sensitive account tagging and honeytoken strategies.

Lesson 3 • Investigating Identity Alerts

Teaches alert triage and investigation using the identity alert queue and entity pages. Students trace attack paths from initial access to lateral movement.

Lesson 1 • Email Threat Landscape

Surveys modern email attack techniques including phishing, spear-phishing, and BEC. Provides context for every protection policy covered in this chapter.

Lesson 2 • Attack Simulation Training

Configures and runs simulated phishing campaigns to measure and improve user resilience. Students analyse simulation results and assign targeted training.

Lesson 3 • Safe Attachments and Safe Links

Teaches detonation-based attachment scanning and URL rewriting for link protection. Students configure policies for users, SharePoint, and Teams.

Lesson 4 • Anti-Phishing and Anti-Spoofing Policies

Covers configuration of anti-phishing policies including impersonation and spoof intelligence settings. Students tune policies to reduce false positives.

Lesson 1 • App Connectors and API Integration

Covers native API connectors that provide deep visibility into sanctioned SaaS apps. Students connect major platforms and validate data ingestion.

Lesson 2 • Access and Session Policies

Teaches Conditional Access App Control for real-time session monitoring and control. Students create policies that block downloads or watermark sensitive files.

Lesson 3 • Cloud App Discovery and Shadow IT

Explains how traffic logs and endpoint signals reveal unsanctioned app usage. Students generate discovery reports and assess app risk scores.

Lesson 1 • Defender Plans for Workload Protection

Covers workload-specific Defender plans for servers, containers, databases, and storage. Students enable plans and understand their detection capabilities.

Lesson 2 • Security Alerts and Threat Detection

Teaches how Defender for Cloud generates and enriches security alerts for cloud workloads. Students triage alerts and map them to MITRE ATT&CK tactics.

Lesson 3 • Cloud Security Posture Management

Introduces Secure Score and security recommendations for Azure, AWS, and GCP workloads. Students prioritise and remediate misconfigurations to improve posture.

Lesson 1 • Incident Management in Sentinel

Covers Sentinel incident lifecycle from creation through closure using Defender-sourced alerts. Students assign, investigate, and document incidents systematically.

Lesson 2 • SOAR Playbooks for Defender Alerts

Designs Logic Apps-based playbooks that automate responses to Defender alerts in Sentinel. Students trigger, test, and monitor playbook execution.

Lesson 3 • Threat Hunting with KQL

Applies KQL hunting queries against Defender telemetry to proactively find hidden threats. Students build, save, and share hunting queries as bookmarks.

Lesson 4 • Analytics Rules and Detection Engineering

Builds scheduled and near-real-time analytics rules using KQL to detect threats across Defender data. Students tune rules to reduce alert fatigue.

Lesson 1 • Microsoft Defender XDR Incident Correlation

Explains how Defender XDR correlates alerts across products into unified incidents. Students investigate multi-stage attacks spanning endpoint, identity, and email.

Lesson 2 • Security Metrics and Reporting

Builds executive and operational reports using Defender portal data and Power BI. Students define KPIs that demonstrate security programme effectiveness.

Lesson 3 • Defender Configuration and Policy Governance

Covers centralised policy management, configuration baselines, and drift detection across Defender products. Students enforce consistent security settings at scale.

Lesson 4 • Advanced Hunting Across Defender XDR

Uses the unified Advanced Hunting interface to query all Defender data sources with KQL. Students build complex multi-table queries for proactive threat detection.