Oversikt over relevante kurs innen Sikkerhetskurs for IT i Hvam

Kurs i cybersikkerhet med Carsten Maartmann-Moe. Du lærer om cyberkriminelle,  og de største risikoene for angrep. Cybersikkerhet eller IT-sikkerhet er i nyhetene nesten hver dag, men hva er fakta og hva er fiksjon? Kan du bli hacket når som helst? Er alle ute etter din virksomhet? Hva er de største risikoene, og hvordan kan man effektivt redusere dem? I dette kurset lærer du hvordan cyberkriminelle opererer, hva de største risikoene er, og hvordan nyanser og kompleksitet påvirker hvilke sikringstiltak som fungerer. Vi vil også lære hvordan den undergrunnsøkonomien i cyberverden fungerer, slik at du kan ta gode beslutninger for å beskytte din egen og din virksomhets informasjon.    Være i stand til å forklare hva cyberkriminalitet er, og hvorfor cybersikkerhet er viktig Være i stand til å forstå hvorfor cybersikkerhet er komplekst Være i stand til å analysere hvilke risikoer som du og din virksomhet står ovenfor Være i stand til å finne og beskytte din mest verdifulle informasjon Være i stand til å håndtere sikkerhetsbrudd på en betryggende måte Morgendagens trusler   Introduksjon til kurset Hvordan er det å bli hacket Hvem er hackerene? God cybersikkerhet – en forutsetning for vellykket digitalisering Hvordan ser cyberspace ut? Å jobbe strukturert med cybersikkerhet 4 myter om cybersikkerhet Personvern og cybersikkerhet Hva er risiko, og hvordan måler du den? Vurdere og redusere risiko – tips og triks Hvordan kommunisere med ledelsen om risiko? Digitalisering og tilpasning til din virksomhet Effektive sikkerhetstiltak for din virksomhet Effektive sikkerhetstiltak for deg som person Rammeverk og verktøy Fremtidige utfordringer Hjelp jeg har blitt hacket Hvem som kan hjelpe Oppsummering og videre læring [-]

  Certificate of Cloud Security Knowledge (CCSK)    CCSK er et bevis på at innehaveren forstår hovedkonseptene i de tre dokumentene CSA bruker som kunnskapsbase for CCSK: CSAs eget rammeverk for beste praksis innen skysikkerhet, «Security Guidance for Critical Areas of Focus in Cloud Computing, v4.0” ENISAs – det europeiske byrået for nettverks- og informasjonssikkerhet – white paper «Cloud Computing: Benefits, Risks and Recommendations for Information Security.» ENISA er EUs ekspertisesenter for internettsikkerhet i Europa. CSA har i en årrekke hatt et tett samarbeid med ENISA. «CSA Cloud Controls Matrix» er et verktøy for å evaluere skytjenester opp mot en lang rekke standarder og rammeverk, for enklere å forstå hvor godt den enkelte skytjeneste er egnet til å understøtte deg og din bedrift i deres forpliktelser. I tillegg til det offisielle materialet, får kursdeltakere fra kraftbransjen tilgang til Berigos egenutviklede materiale som utvider Cloud Controls Matrix til også å omfatte kraftberedskapsforskriften.   [-]

Studieår: 2013-2014   Gjennomføring: Høst og vår Antall studiepoeng: 5.0 Forutsetninger: IFUD1012 Internett og sikkerhet Innleveringer: Øvinger: 3 av 5 må være godkjent. Vurderingsform: Skriftlig eksamen, 3 timer (60 %). Det gjennomføres 3 obligatoriske større øvingsarbeider gruppevis underveis i kurset. Disse får en midlertidig vurdering/tilbakemelding og kan deretter leveres på nytt til en samlet sluttvurdering som teller 40 % på karakteren. Ansvarlig: Ole Christian Eidheim Eksamensdato: 12.12.13 / 26.05.14         Læremål: Etter å ha gjennomført emnet Informasjonssikkerhetsstyring skal studenten ha følgende samlede læringsutbytter: KUNNSKAPER:Kandidaten:- kan gjøre rede for hva informasjonssikkerhet betyr for en bedrifts økonomi og omdømme- kan gjøre rede for hva standardene ISO 27001 og ISO 27002 inneholder og hvordan de benyttes i sikkerhetsarbeidet- kjenner til prinsippene i Demmings sirkel og kunne redegjøre for betydningen av disse for det kontinuerlige sikkerhetsarbeidet- kjenner til en trinnvis plan for innføring av et styringssystem for informasjonssikkerhet (ISMS) og kunne redegjøre for de kritiske suksessfaktorene i hver av fasene- kan redegjøre for forutsetninger og tiltak for å skape en sikkerhetskultur i en bedrift- kan redegjøre for den trinnvise prosessen frem mot sertifisering av et ISMS eller produkt- kan redegjøre for rollen til målinger og evalueringer i sikkerhetsarbeidet FERDIGHETER:Kandidaten kan:- kartlegge trusselbildet for en konkret bedrift- gjennomføre en risikoanalyse for en bedrift på en strukturert og systematisk måte- innføre tiltak for å redusere risikoverdien for kartlagte trusler som har for høy risikoverdi- velge og utarbeide relevante sikkerhetspolicyer for en konkret bedrift- utarbeide forslag til en organisasjonsstruktur for sikkerhetsarbeidet i en konkret bedrift- analysere behovet for sertifisering av ISMS for en konkret bedrift og gi anbefalinger om veien dit GENERELL KOMPETANSE:Kandidaten kan:- kommunisere med og forstå brukernes behov- involvere de ansatte i endringsprosesser i bedriften og vite hvilke ressurser/kompetanse disse kan bidra med- involvere eksterne konsulenter i endringsprosesser i bedriften og vite hvilke ressurser/kompetanse disse kan bidra med Innhold:Trusselbildet, styringssystemer, rammer for sikkerhetsarbeidet, sikkerhetsstandardene ISO27001 og 27002, gap-analyse, risikoanalyse, sikkerhetspolicy, ulike sikringstiltak, sikkerhetskultur, sikkerhet i informasjonssystemer, veien til sertifisering, måling og evaluering, kontinuerlig forbedringLes mer om faget her Påmeldingsfrist: 25.08.13 / 25.01.14         Velg semester:  Høst 2013    Vår 2014     Fag Informasjonssikkerhetsstyring 4980,-         Semesteravgift og eksamenskostnader kommer i tillegg.    [-]

COURSE OVERVIEW The Certified Information Systems Security Professional (CISSP) is the most globally recognized certification in the cybersecurity market. CISSP validates a cybersecurity professional’s deep technical and managerial knowledge and experience to effectively design, engineer and manage an organization’s overall security posture. Please note an exam voucher is included as part of this course TARGET AUDIENCE Cybersecurity professionals with at least 5 years in the information security field. Member data has shown that amajority of CISSP holders are in middle management and a much smaller proportion are in senior or junior/entry-level positions. Roles include:• Chief Information Officer• Chief Information Security Officer• Chief Technology Officer• Compliance Manager / Officer• Director of Security• Information Architect• Information Manager / Information RiskManager or Consultant• IT Specialist / Director / Manager• Network / System Administrator• Security Administrator• Security Architect / Security Analyst• Security Consultant• Security Manager• Security Systems Engineer / Security EngineerSectorsCISSP is relevant across all sectors and industries, including:• Aerospace• Automotive• Banking, financial services, insurance (BFSI)• Construction• Cybersecurity• Energy• Engineering• Government• Healthcare, IT products, services, consulting• Manufacturing• Pharma• Retail• Telecom COURSE OBJECTIVESAfter completing this course you should be able to: Understand and apply fundamental concepts and methods related to the fields of information technology and security Align overall organizational operational goals with security functions and implementations. Understand how to protect assets of the organization as they go through their lifecycle. Understand the concepts, principles, structures and standards used to design, implement, monitor and secure operating systems, equipment, networks, applications and those controls used to enforce various levels of confidentiality, integrity and availability. Implement system security through the application of security design principles and application of appropriate security control mitigations for vulnerabilities present in common information system types and architectures. Understand the importance of cryptography and the security services it can provide in today’s digital and information age. Understand the impact of physical security elements on information system security and apply secure design principles to evaluate or recommend appropriate physical security protections. Understand the elements that comprise communication and network security coupled with a thorough description of how the communication and network systems function. List the concepts and architecture that define the associated technology and implementation systems and protocols at Open Systems Interconnection (OSI) model layers 1-7. Identify standard terms for applying physical and logical access controls to environments related to their security practice. Appraise various access control models to meet business security requirements. Name primary methods for designing and validating test and audit strategies that support business requirements. Enhance and optimize an organization’s operational function and capacity by applying and utilizing appropriate security controls and countermeasures. Recognize risks to an organization’s operational endeavours and assess specific threats, vulnerabilities and controls. Understand the System Lifecycle (SLC) and the Software Development Lifecycle (SDLC) and how to apply security to it; identify which security control(s) are appropriate for the development environment; and assess the effectiveness of software security. COURSE CONTENT Domain 1: Security and Risk Management Domain 2: Asset Security Domain 3: Security Architecture and Engineering Domain 4: Communication and Network Security Domain 5: Identity and Access Management (IAM) Domain 6: Security Assessment and Testing Domain 7: Security Operations Domain 8: Software Development Security TEST CERTIFICATION Recommended as preparation for the following exam: (ISC)2 Certified Information Systems Security Professional Gaining this accreditation is not just about passing the exam, there are a number of other criteria that need to be met including 5 years of cumulative, paid work experience in two or more of the eight domains of the (ISC)²® CISSP CBK . Full details can be found at https://www.isc2.org/cissp/default.aspx Those without the required experience can take the exam to become an Associate of (ISC)²  while working towards the experience needed for full certification Please note an exam voucher is included as part of this course   [-]

I en digital tidsalder hvor samhandling er essensielt for bedrifters suksess, er det kritisk for ledere å oppdatere sin kompetanse. Dette éndagskurset tilbyr praktisk trening og materiale for videre selvstudium, slik at ledere kan møte dagens databehov effektivt. Kurset fokuserer på tre hovedområder for å styrke deltakernes lederkompetanse innen datahåndtering. Det kombinerer teori og praksis for å maksimere læringen. Kurset avholdes på én arbeidsdag, med en strukturert agenda som dekker følgende temaer: Strategiske IT/IS-planer, inkludert organisatoriske strukturer, lederansvar, kompetansekartlegging, IT/IS-policyer, og en gjennomgang av IS-domener. Dette inkluderer også sikkerhetsaspekter som aktiva, nettverk, identitets- og tilgangsstyring, risikostyring, sikkerhetsvurdering og -testing, sikkerhetsoperasjoner, og sikkerhet i utviklingsfasen. Intern gapanalyse, oppbygging av en effektiv Enterprise Information Security Architecture (EISA), definering av opplæringskrav, tilpassede SETA-programmer, trusselvurdering, håndtering av sårbarheter, og en praktisk tilnærming til leverandørrisiko og sikkerhetsvurdering av digitale nettverk. Utvikling av KPI-dashboards, trusselvurdering, kommunikasjonsstrategier, introduksjon til økonomiske nøkkeltall innen informasjonssikkerhet, samt planlegging for forretningskontinuitet og katastrofegjenoppretting. Målsettingen er at hver deltaker etter kurset skal kunne sette SMART-mål for hvert punkt, hvor SMART representerer Spesifikke, Målbare, Oppnåelige, Relevante og Tidsbestemte mål. Kurset gir deltakerne verktøyene de trenger for å forbedre sitt lederskap i en digitalisert verden. Kursholder har jobbet med informasjonssikkerhet for ledende teknologiselskaper de siste 25 årene, og har hjulpet ledere finne farbare veier i krevende situasjoner. Han er sertifisert kvalitetsrevisor ISO 19011 og har utarbeidet sikkerhetsstyringsrutiner for selskaper som følger både enkle og svært strenge lovkrav. Han har en Ph.D. i Cybersecurity Leadership, en MBA innen Finans, Digital transformasjon, Forretningsstrategi, Kommunikasjon og Markedsføring. Han er sertifisert i Advanced Computer Security fra Stanford University og Cyber Forensics and Counterterrorism fra Harvard University. Han har også CISSP fra ISC2, Certified Data Privacy Solution Engineer fra ISACA, og CCSK (Certificate of Cloud Security Knowledge) fra CSA. I tillegg har han gjennomført NHH sitt styreprogram, som utgjør en relevant bakgrunn for dette kurset. Til daglig jobber han som CISO for et selskap med lokasjoner på 24 steder over hele verden. Selskapet må både sikre trygg drift og utvikle programvare og tjenester som må være i drift 24/7. [-]

ISO/IEC 27005 Lead Risk Manager [-]

ISO/IEC 27701 Foundation [-]

  Studieår: 2013-2014   Gjennomføring: Høst og vår Antall studiepoeng: 5.0 Forutsetninger: Gode IKT-kunnskaper og god kjennskap til drift av Windows server og prosesser i Windows operativsystem. Innleveringer: For å kunne gå opp til eksamen må 8 øvingsoppgaver være godkjent. Nærmere opplysninger gis ved kursstart Personlig veileder: ja Vurderingsform: Netteksamen på egen PC - 5 timer. Hver student skal bruke virtuelle maskiner under eksamen. Ansvarlig: Stein Meisingseth Eksamensdato: 10.12.13 / 13.05.14         Læremål: KUNNSKAPER: Kandidaten:- har innsikt i hvordan et nettverk kan sikres og hvordan man kan unngå at lokale maskiner, servere eller større nettverk kan bli hacket- kjenner til løsninger for å sikre små og store nettverk FERDIGHETER:Kandidaten:- kan forstå hensikten med å legge stor vekt på sikkerhet- skal kunne oppdage og identifisere inntrengere- skal kunne forhindre eksterne angrep- skal kunne forstå faren med interne angrep- skal kunne lage rutiner for gode passordrutiner, autentiseringssystemer og viruskontroll- forstår hvordan sikkerhet fungerer i Windows 7 og Windows 2008 server- bruker Group Policy til å sette tilpasset sikkerhet- skal kunne bruke og å konfigurere de interne brannmurer i Windows GENERELL KOMPETANSE:Kandidaten har:- perspektiv og kompetanse i å velge riktige løsninger for å oppnå maksimal og tilpasset sikkerhet- kompetanse i generelt sikkerhetsarbeid Innhold:Hva menes med sikkerhet, hensikt med sikkerhet, tiltak som kan iverksettes for å oppnå tilsiktet sikkerhet, identifisering av inntrengere, passordsikkerhet, autentiseringssystemer, viruskontroll, sikkerhet i Windows og 2008 servere, bruk av brannmuren til Windows server 2008, sette sikkerhet i Group Policy, brannvegger generelt, forhindre virus og inntrenging, tiltak for å forhindre angrep utenfra, digitale signaturer.Les mer om faget her Påmeldingsfrist: 25.08.13 / 25.01.14         Velg semester:  Høst 2013    Vår 2014     Fag Datasikkerhet 4980,-         Semesteravgift og eksamenskostnader kommer i tillegg.    [-]

ISO/IEC 27001 Introduction [-]

Personvernforordningen / General Data Protection Regulation (GDPR) Vi går gjennom de deler du må ha kompetanse om, og du får fyldig kursmateriale med deg hjem, slik at du enklere kan mester fagområdet etter kurset. Men på ettdagskurs er det ikke dybdegejnnomgang av områder som DPIA, teknologi og prosess rundt GAP planer. Du får alikevel med deg materiale så du kan lese etterpå. Hva er formålet med forordninga og hvordan forordningen er strukturert. Vi går gjennom  tilsynsmyndighet og hvilke innvirkninger den loven har på Norge, EU og andre land.  Du får kompetanse om hovedpunkter i forordningen med de viktige nøkkelkonsepter, kategorier for personlig informasjon og prinsipper for databeskyttelse. Den registrertes rettigheter og hvordan analyser utfordringer og problemer En viktig kompetanse som mange ikke kjenner godt nok er hvilke roller, forpliktelser og behandlingsaktiviteter som må mestres, så vi ser på personvernombudets betegnelser  Konsekvensanalyse av databeskyttelse og personvernombudet Behandlingsaktiviteter og personvernombudet  Kontrollers ansvar Personvernombudet sitt ansvarRegistrering av behandlingsaktiviteterSamarbeid med tilsynsmyndighetHvordan starte program for å etterleve personvernforordningenHvem må forholde seg til personvernforordningenMetoder og tilnærmingForbered program for personvernforordningenHvordan avdekke mangler  og i dentifiser strategiske målLedelsens ansvar og godkjenning [-]

ISO/IEC 27701 Lead Implementer [-]

CCSP: Certified Cloud Security Professional [-]

ISO/IEC 27001 Lead Implementer [-]

COURSE OVERVIEW If you are new to Citrix or if you are planning a move to Citrix Cloud, this course is a necessary step in enabling you with the right training and skills to manage and deploy Citrix Workspace successfully. This foundational administration course covers the aspects of installing, configuring and managing a Citrix Virtual Apps and Desktops 7 environment, how to manage an on-premises Citrix solution and migrate from an on-premises solution to cloud using the Citrix Cloud management plane. This five-day course will teach you how to deploy, install, configure, setup profile management, configure policies, printing and basic security features for on-premises Virtual Apps and Desktop solution building, and then migrating to Citrix Cloud. This course includes the exam voucher. TARGET AUDIENCE Experienced IT Professionals who want to be familiar with Citrix Virtual Apps and Desktops 7 in an on-premises environment and Citrix Cloud. Potential students include administrators or engineers responsible for the end user workspace and overall health and performance of the solution. COURSE OBJECTIVES After completing this course you should be able to: Install, configure, and manage a Citrix Virtual Apps and Desktops 7 site and Cloud connectors Identify the considerations between Citrix Virtual Apps and Desktops on-premises and the Citrix Virtual Apps and Desktops Service Deliver app and desktop resources COURSE CONTENT Architecture Overview Introduction to Citrix Virtual Apps and Desktops Architecture Overview Features Hosting Platform Considerations Citrix Virtual Apps and Desktops Service Connection Flow Process Introduction Deploy the Site Pre-Deployment Considerations Citrix Licensing Setup Delivery Controller Setup Site Setup And Management Redundancy Considerations The Apps and Desktops Images Consider Master Image Creation Methods Master Image Requirements Provision and Deliver App and Desktop Resources Machine Catalogs and Delivery Groups Provisioning Methods and Considerations Machine Creation Services (MCS) Deep Dive MCS Environment Considerations Resource Locations Provide Access to App and Desktop Resources  Consider Workspace Experience versus StoreFront  Workspace Experience User Authentication  Workspace App  Communication Flow Manage the User Experience Methods to Manage the User Experience Common User Experience Settings Published App and Desktop Presentation and Management  Published App Properties Server OS Published App Optimizations Published App Presentation Application Groups Apps and Desktops Presentation Manage Printing for User Sessions Map Printers to the User Session Printer Drivers Print Environment Considerations Citrix Profile Management Introduction and Considerations Configure Citrix Profile Management Manage the Site Delegated Administration Use PowerShell with Citrix Virtual Apps and Desktops Power Management Considerations Citrix Virtual Apps and Desktops Basic Security Considerations Citrix Admin Security Considerations XML Service Security Considerations Secure HDX External Traffic Monitor the Site Citrix Director Introduction Monitor and Interact with User Sessions Published Apps Analysis Monitor the Machines Running the VDA Site Specific Common Monitoring Alerts and Notifications Optimize Citrix Director Monitoring with Citrix ADM Introduction to Supporting and Troubleshooting Citrix Virtual Apps and Desktops Introduction to Supporting a Citrix Virtual Apps and Desktops Site Tools Proactive Administration Common Tasks Migrate To Citrix Cloud Migration Considerations Citrix Cloud Connector Deployment Citrix Virtual Apps and Desktops with an On-Premises Resource Location The Migration Process Citrix Analytics Citrix Analytics Introduction Prepare to Use Citrix Analytics Types of Analytics TEST CERTIFICATION Recommended as preparation for the following exams: CCA-V Certification exam. [-]

COURSE OVERVIEW Learn how to investigate, respond to, and hunt for threats using Microsoft Azure Sentinel, Azure Defender, and Microsoft 365 Defender. In this course you will learn how to mitigate cyberthreats using these technologies. Specifically, you will configure and use Azure Sentinel as well as utilize Kusto Query Language (KQL) to perform detection, analysis, and reporting. The course was designed for people who work in a Security Operations job role and helps learners prepare for the exam SC-200: Microsoft Security Operations Analyst. TARGET AUDIENCE The Microsoft Security Operations Analyst collaborates with organizational stakeholders to secure information technology systems for the organization. Their goal is to reduce organizational risk by rapidly remediating active attacks in the environment, advising on improvements to threat protection practices, and referring violations of organizational policies to appropriate stakeholders. Responsibilities include threat management, monitoring, and response by using a variety of security solutions across their environment. The role primarily investigates, responds to, and hunts for threats using Microsoft Azure Sentinel, Azure Defender, Microsoft 365 Defender, and third-party security products. Since the Security Operations Analyst consumes the operational output of these tools, they are also a critical stakeholder in the configuration and deployment of these technologies. COURSE OBJECTIVES Explain how Microsoft Defender for Endpoint can remediate risks in your environment Create a Microsoft Defender for Endpoint environment Configure Attack Surface Reduction rules on Windows 10 devices Perform actions on a device using Microsoft Defender for Endpoint Investigate domains and IP addresses in Microsoft Defender for Endpoint Investigate user accounts in Microsoft Defender for Endpoint Configure alert settings in Microsoft Defender for Endpoint Explain how the threat landscape is evolving Conduct advanced hunting in Microsoft 365 Defender Manage incidents in Microsoft 365 Defender Explain how Microsoft Defender for Identity can remediate risks in your environment. Investigate DLP alerts in Microsoft Cloud App Security Explain the types of actions you can take on an insider risk management case. Configure auto-provisioning in Azure Defender Remediate alerts in Azure Defender Construct KQL statements Filter searches based on event time, severity, domain, and other relevant data using KQL Extract data from unstructured string fields using KQL Manage an Azure Sentinel workspace Use KQL to access the watchlist in Azure Sentinel Manage threat indicators in Azure Sentinel Explain the Common Event Format and Syslog connector differences in Azure Sentinel Connect Azure Windows Virtual Machines to Azure Sentinel Configure Log Analytics agent to collect Sysmon events Create new analytics rules and queries using the analytics rule wizard Create a playbook to automate an incident response Use queries to hunt for threats Observe threats over time with livestream COURSE CONTENT Module 1: Mitigate threats using Microsoft Defender for Endpoint Implement the Microsoft Defender for Endpoint platform to detect, investigate, and respond to advanced threats. Learn how Microsoft Defender for Endpoint can help your organization stay secure. Learn how to deploy the Microsoft Defender for Endpoint environment, including onboarding devices and configuring security. Learn how to investigate incidents and alerts using Microsoft Defender for Endpoints. Perform advanced hunting and consult with threat experts. You will also learn how to configure automation in Microsoft Defender for Endpoint by managing environmental settings.. Lastly, you will learn about your environment's weaknesses by using Threat and Vulnerability Management in Microsoft Defender for Endpoint. Lessons M1 Protect against threats with Microsoft Defender for Endpoint Deploy the Microsoft Defender for Endpoint environment Implement Windows 10 security enhancements with Microsoft Defender for Endpoint Manage alerts and incidents in Microsoft Defender for Endpoint Perform device investigations in Microsoft Defender for Endpoint Perform actions on a device using Microsoft Defender for Endpoint Perform evidence and entities investigations using Microsoft Defender for Endpoint Configure and manage automation using Microsoft Defender for Endpoint Configure for alerts and detections in Microsoft Defender for Endpoint Utilize Threat and Vulnerability Management in Microsoft Defender for Endpoint Lab M1: Mitigate threats using Microsoft Defender for Endpoint Deploy Microsoft Defender for Endpoint Mitigate Attacks using Defender for Endpoint After completing module 1, students will be able to: Define the capabilities of Microsoft Defender for Endpoint Configure Microsoft Defender for Endpoint environment settings Configure Attack Surface Reduction rules on Windows 10 devices Investigate alerts in Microsoft Defender for Endpoint Describe device forensics information collected by Microsoft Defender for Endpoint Conduct forensics data collection using Microsoft Defender for Endpoint Investigate user accounts in Microsoft Defender for Endpoint Manage automation settings in Microsoft Defender for Endpoint Manage indicators in Microsoft Defender for Endpoint Describe Threat and Vulnerability Management in Microsoft Defender for Endpoint Module 2: Mitigate threats using Microsoft 365 Defender Analyze threat data across domains and rapidly remediate threats with built-in orchestration and automation in Microsoft 365 Defender. Learn about cybersecurity threats and how the new threat protection tools from Microsoft protect your organization’s users, devices, and data. Use the advanced detection and remediation of identity-based threats to protect your Azure Active Directory identities and applications from compromise. Lessons M2 Introduction to threat protection with Microsoft 365 Mitigate incidents using Microsoft 365 Defender Protect your identities with Azure AD Identity Protection Remediate risks with Microsoft Defender for Office 365 Safeguard your environment with Microsoft Defender for Identity Secure your cloud apps and services with Microsoft Cloud App Security Respond to data loss prevention alerts using Microsoft 365 Manage insider risk in Microsoft 365 Lab M2: Mitigate threats using Microsoft 365 Defender Mitigate Attacks with Microsoft 365 Defender After completing module 2, students will be able to: Explain how the threat landscape is evolving. Manage incidents in Microsoft 365 Defender Conduct advanced hunting in Microsoft 365 Defender Describe the investigation and remediation features of Azure Active Directory Identity Protection. Define the capabilities of Microsoft Defender for Endpoint. Explain how Microsoft Defender for Endpoint can remediate risks in your environment. Define the Cloud App Security framework Explain how Cloud Discovery helps you see what's going on in your organization Module 3: Mitigate threats using Azure Defender Use Azure Defender integrated with Azure Security Center, for Azure, hybrid cloud, and on-premises workload protection and security. Learn the purpose of Azure Defender, Azure Defender's relationship to Azure Security Center, and how to enable Azure Defender. You will also learn about the protections and detections provided by Azure Defender for each cloud workload. Learn how you can add Azure Defender capabilities to your hybrid environment. Lessons M3 Plan for cloud workload protections using Azure Defender Explain cloud workload protections in Azure Defender Connect Azure assets to Azure Defender Connect non-Azure resources to Azure Defender Remediate security alerts using Azure Defender Lab M3: Mitigate threats using Azure Defender Deploy Azure Defender Mitigate Attacks with Azure Defender After completing module 3, students will be able to: Describe Azure Defender features Explain Azure Security Center features Explain which workloads are protected by Azure Defender Explain how Azure Defender protections function Configure auto-provisioning in Azure Defender Describe manual provisioning in Azure Defender Connect non-Azure machines to Azure Defender Describe alerts in Azure Defender Remediate alerts in Azure Defender Automate responses in Azure Defender Module 4: Create queries for Azure Sentinel using Kusto Query Language (KQL) Write Kusto Query Language (KQL) statements to query log data to perform detections, analysis, and reporting in Azure Sentinel. This module will focus on the most used operators. The example KQL statements will showcase security related table queries. KQL is the query language used to perform analysis on data to create analytics, workbooks, and perform hunting in Azure Sentinel. Learn how basic KQL statement structure provides the foundation to build more complex statements. Learn how to summarize and visualize data with a KQL statement provides the foundation to build detections in Azure Sentinel. Learn how to use the Kusto Query Language (KQL) to manipulate string data ingested from log sources. Lessons M4 Construct KQL statements for Azure Sentinel Analyze query results using KQL Build multi-table statements using KQL Work with data in Azure Sentinel using Kusto Query Language Lab M4: Create queries for Azure Sentinel using Kusto Query Language (KQL) Construct Basic KQL Statements Analyze query results using KQL Build multi-table statements using KQL Work with string data using KQL statements After completing module 4, students will be able to: Construct KQL statements Search log files for security events using KQL Filter searches based on event time, severity, domain, and other relevant data using KQL Summarize data using KQL statements Render visualizations using KQL statements Extract data from unstructured string fields using KQL Extract data from structured string data using KQL Create Functions using KQL Module 5: Configure your Azure Sentinel environment Get started with Azure Sentinel by properly configuring the Azure Sentinel workspace. Traditional security information and event management (SIEM) systems typically take a long time to set up and configure. They're also not necessarily designed with cloud workloads in mind. Azure Sentinel enables you to start getting valuable security insights from your cloud and on-premises data quickly. This module helps you get started. Learn about the architecture of Azure Sentinel workspaces to ensure you configure your system to meet your organization's security operations requirements. As a Security Operations Analyst, you must understand the tables, fields, and data ingested in your workspace. Learn how to query the most used data tables in Azure Sentinel. Lessons M5 Introduction to Azure Sentinel Create and manage Azure Sentinel workspaces Query logs in Azure Sentinel Use watchlists in Azure Sentinel Utilize threat intelligence in Azure Sentinel Lab M5 : Configure your Azure Sentinel environment Create an Azure Sentinel Workspace Create a Watchlist Create a Threat Indicator After completing module 5, students will be able to: Identify the various components and functionality of Azure Sentinel. Identify use cases where Azure Sentinel would be a good solution. Describe Azure Sentinel workspace architecture Install Azure Sentinel workspace Manage an Azure Sentinel workspace Create a watchlist in Azure Sentinel Use KQL to access the watchlist in Azure Sentinel Manage threat indicators in Azure Sentinel Use KQL to access threat indicators in Azure Sentinel Module 6: Connect logs to Azure Sentinel Connect data at cloud scale across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds to Azure Sentinel. The primary approach to connect log data is using the Azure Sentinel provided data connectors. This module provides an overview of the available data connectors. You will get to learn about the configuration options and data provided by Azure Sentinel connectors for Microsoft 365 Defender. Lessons M6 Connect data to Azure Sentinel using data connectors Connect Microsoft services to Azure Sentinel Connect Microsoft 365 Defender to Azure Sentinel Connect Windows hosts to Azure Sentinel Connect Common Event Format logs to Azure Sentinel Connect syslog data sources to Azure Sentinel Connect threat indicators to Azure Sentinel Lab M6: Connect logs to Azure Sentinel Connect Microsoft services to Azure Sentinel Connect Windows hosts to Azure Sentinel Connect Linux hosts to Azure Sentinel Connect Threat intelligence to Azure Sentinel After completing module 6, students will be able to: Explain the use of data connectors in Azure Sentinel Explain the Common Event Format and Syslog connector differences in Azure Sentinel Connect Microsoft service connectors Explain how connectors auto-create incidents in Azure Sentinel Activate the Microsoft 365 Defender connector in Azure Sentinel Connect Azure Windows Virtual Machines to Azure Sentinel Connect non-Azure Windows hosts to Azure Sentinel Configure Log Analytics agent to collect Sysmon events Explain the Common Event Format connector deployment options in Azure Sentinel Configure the TAXII connector in Azure Sentinel View threat indicators in Azure Sentinel Module 7: Create detections and perform investigations using Azure Sentinel Detect previously uncovered threats and rapidly remediate threats with built-in orchestration and automation in Azure Sentinel. You will learn how to create Azure Sentinel playbooks to respond to security threats. You'll investigate Azure Sentinel incident management, learn about Azure Sentinel events and entities, and discover ways to resolve incidents. You will also learn how to query, visualize, and monitor data in Azure Sentinel. Lessons M7 Threat detection with Azure Sentinel analytics Threat response with Azure Sentinel playbooks Security incident management in Azure Sentinel Use entity behavior analytics in Azure Sentinel Query, visualize, and monitor data in Azure Sentinel Lab M7: Create detections and perform investigations using Azure Sentinel Create Analytical Rules Model Attacks to Define Rule Logic Mitigate Attacks using Azure Sentinel Create Workbooks in Azure Sentinel After completing module 7, students will be able to: Explain the importance of Azure Sentinel Analytics. Create rules from templates. Manage rules with modifications. Explain Azure Sentinel SOAR capabilities. Create a playbook to automate an incident response. Investigate and manage incident resolution. Explain User and Entity Behavior Analytics in Azure Sentinel Explore entities in Azure Sentinel Visualize security data using Azure Sentinel Workbooks. Module 8: Perform threat hunting in Azure Sentinel In this module, you'll learn to proactively identify threat behaviors by using Azure Sentinel queries. You'll also learn to use bookmarks and livestream to hunt threats. You will also learn how to use notebooks in Azure Sentinel for advanced hunting. Lessons M8 Threat hunting with Azure Sentinel Hunt for threats using notebooks in Azure Sentinel Lab M8 : Threat hunting in Azure Sentinel Threat Hunting in Azure Sentinel Threat Hunting using Notebooks After completing this module, students will be able to: Describe threat hunting concepts for use with Azure Sentinel Define a threat hunting hypothesis for use in Azure Sentinel Use queries to hunt for threats. Observe threats over time with livestream. Explore API libraries for advanced threat hunting in Azure Sentinel Create and use notebooks in Azure Sentinel [-]