Implement activity and event collection in Microsoft Sentinel - Part 1

Effective SIEM implementation starts with establishing the right workspace architecture, configuring security content, and ensuring that relevant security data is continuously ingested into the platform.

This session brings these capabilities together through three Microsoft Learn modules:

1. Create and manage Microsoft Sentinel workspaces
2. Manage content in Microsoft Sentinel
3. Connect Microsoft services to Microsoft Sentinel

Participants will gain a practical understanding of how these capabilities work together to build a functional security monitoring environment.

What You Will Learn

By the end of the session, participants should be able to:

• Understand the core architecture of Microsoft Sentinel
• Create and configure a Sentinel-enabled Log Analytics workspace
• Manage Sentinel security content through the Content hub
• Understand analytics rules, workbooks, hunting queries, and solutions
• Configure Microsoft Sentinel data connectors
• Connect Microsoft security services to Sentinel
• Understand the importance of centralized security telemetry
• Build a foundation for security monitoring, threat detection, hunting, and investigation

Who Should Attend?

This session is ideal for:

• Security Operations Center (SOC) Analysts
• Security Engineers
• Cloud Security Engineers
• Cloud & Security Architects
• Azure Administrators
• Threat Hunters
• DevSecOps Engineers
• Incident Responders
• SIEM Engineers
• Cybersecurity Professionals
• Professionals preparing for Microsoft Sentinel/security certifications
• IT professionals transitioning into Cloud & AI Security

Learn. Connect. Govern. Secure the Cloud.