Ridgeline Cyber Defence Ridgeline Cyber
Courses
M365 Security Operations M365 Security: From Admin to Defender SOC Analyst Operations
Labs
Resources
FAQ Blog
Pricing About
Get Started Free
Introduction 0.1 Mission and Course Blueprint 0.1 Mission, Course Structure, and Who This Is For 0.2 SC-200 Exam Overview and Study Strategy 0.2 Who This Course Is For 0.3 Curriculum Breakdown 0.3 How to Learn from This Course 0.4 How to Learn from This Course 0.4 Lab Setup: M365 E5 Developer Tenant 0.5 Lab Environment, Resources, and Support 0.5 Lab Setup: Azure Subscription and Sentinel Workspace 0.6 Lab Setup: Sample Data and Validation 0.7 Module Summary 0.8 Check My Knowledge
Introduction 1.1 Introduction to Microsoft Defender XDR Threat Protection 1.2 Mitigate Incidents Using Microsoft Defender XDR 1.3 Remediate Risks with Microsoft Defender for Office 365 1.4 Manage Microsoft Defender for Endpoint Investigations 1.5 Mitigate Threats Using Microsoft Defender for Identity 1.6 Secure Cloud Apps with Microsoft Defender for Cloud Apps 1.7 Unified Portal Operations: Daily SOC Workflow 1.8 Cross-Product Incident Correlation 1.9 Module Summary 1.10 Check My Knowledge
Introduction 1.1 Defender for Endpoint 1.2 Defender for Office 365 1.3 Defender for Identity 1.4 Defender for Cloud Apps 1.5 Entra ID Protection 1.6 Microsoft Sentinel 1.7 Microsoft Purview 1.8 Microsoft Intune 1.9 Microsoft Defender XDR 1.10 How the Ecosystem Integrates 1.11 Licensing, Lab Setup, and Module Assessment
Introduction 2.1 How KQL Works and Key Tables 2.2 Core Operators 2.3 Time Functions and Joins 2.4 Parsing Semi-Structured Data 2.5 Investigation Patterns and Query Organization 2.6 Exam Relevance and References
Introduction 3.1 Portal Layout and Incident Hierarchy 3.2 Working the Incident Queue 3.3 Advanced Hunting 3.4 Response Actions and Automation 3.5 Notifications, RBAC, and Exam Relevance 3.6 Threat Analytics 3.7 Secure Score and Exposure Management 3.8 Email Investigation with Threat Explorer 3.9 Device Investigation Page 3.10 Module Assessment
Introduction 4.1 Two Tables, Not One 4.2 Key Fields in the Sign-In Log 4.3 Investigation Patterns 4.4 Reading a Sign-In Event 4.5 Volume Management and Exam Relevance 4.6 Conditional Access Analysis 4.7 Legacy Authentication Detection 4.8 Token Replay Investigation 4.9 Building Sign-In Baselines 4.10 Module Assessment
Introduction 6.1 Construct KQL Statements for Microsoft Sentinel 6.2 Analyze Query Results Using KQL 6.3 Build Multi-Table Statements Using KQL 6.4 Work with String Data in KQL 6.5 Security-Specific KQL Patterns 6.6 Building an Investigation Query Library 6.7 KQL Performance Optimization and Query Debugging 6.8 Real-World Query Building Exercises 6.9 Module Summary 6.10 Check My Knowledge
Your progress
Loading...

Module : Free Modules

Sections in this module

Course Introduction

Mitigate Threats Using Microsoft Defender XDR

The M365 Security Ecosystem

KQL Fundamentals for Security Analysts

Defender XDR Portal Navigation

Entra ID Sign-In Log Analysis

Create Queries for Microsoft Sentinel Using Kusto Query Language (KQL)

Start: Course Introduction →
Ridgeline Cyber Defence Ridgeline Cyber Defence

Practical M365 security training, toolkits, and services for the people who defend organisations.

Training

Courses Labs Resources Pricing

Company

About Subscribe ridgelinecyber.com

Legal

Privacy Policy Terms of Service Refund Policy

© 2026 Ridgeline Cyber Defence Ltd. All rights reserved.