Microsoft Sentinel Essential Training
Query security data with KQL, switch on Microsoft's built-in detections and triage your first incidents in Microsoft Sentinel with a repeatable checklist.
- Level 2 of 4
- Prerequisite: Foundation
- Live online: max 8-10 hours
- Corporate: 2 days
- Self-paced: 1-year LMS
- Curriculum updated 1 November 2026
Free demo class · Free 10-15 min fit call · Miss the batch? Join next month's · Pay by UPI, cards, net banking or PayPal
About Microsoft Sentinel Essential Training
Microsoft Sentinel is Microsoft's cloud-native SIEM and SOAR. It collects security data from Microsoft, multicloud and on-premises sources into a Log Analytics workspace, detects threats with analytics rules, groups alerts into incidents and automates response, all from the Microsoft Defender portal.
Essential covers Days 1-2: everything in Foundation, then reading security tables, KQL essentials, built-in content from Content hub, a starter analytic rule, the alert-to-incident lifecycle, guided first-line triage, workbooks and entry-level troubleshooting.
Training is hands-on: every day ends with lab evidence you keep, and a progression gate checks that you are ready for the next level. The course teaches the Defender portal experience, the one Microsoft is moving every customer to.
What you will be able to do after Essential
Read security tables
Understand tables, columns, timestamps and lookback windows, and tell no data from no matching records.
Write KQL essentials
Use where, project, summarize and bin to filter, count and chart security events over time.
Use built-in content
Navigate Content hub and tell solutions, detection templates, hunting queries and workbooks apart.
Turn on a first detection
Activate a starter analytic rule from a template and test that it fires on a harmless event.
Triage an incident
Review entities, related alerts and the timeline, then record a disposition and escalate correctly.
Fix the common problems
Diagnose empty queries, mismatched time filters, missing rule prerequisites and rules that never trigger.
Private Microsoft Sentinel training for your security team
DevOpsSchool runs Microsoft Sentinel Essential Training as a private, day-wise batch: 2 days covering Days 1-2. The agenda is aligned to your tenant, data sources and SOC processes.
- 2 days, day by day (Days 1-2), online or at your office
- A ready, paid lab environment provided by DevOpsSchool, so nobody waits on access
- Examples adapted to your connectors, detections and escalation process
- Progression gates with lab evidence for every participant
- Led by Rajesh Kumar: 200+ corporate trainings delivered
Teams we have trained
Teams trained in Splunk and DevSecOps at Wells Fargo, AstraZeneca, Citrix and John Deere, among 90+ companies on our client list.
Corporate batches are scheduled on demand. Tell us your team size and preferred dates and we reply within 1 hour.
Request a corporate quoteWhere Essential sits in the Microsoft Sentinel path
Each level adds new days to the previous ones. Corporate days are cumulative; the self-paced plan includes all four levels.
- Level 1Foundation1 day corporateSOC context, architecture and workspace setup
- Level 2Essential2 days corporateKQL, built-in detections and incident triageYou are here
- Level 3Intermediate3 days corporateIngestion, correlation, enrichment and tuning
- Level 4Advanced5 days corporateASIM, hunting, SOAR and enterprise scale
Choose how you learn
The same agenda in three formats. Pick the one that fits your schedule and goals.
| Live online | Corporate | Self-paced | |
|---|---|---|---|
| Format | Instructor-led online sessions | Private batch for your team, online or onsite | Recorded video lessons in the LMS |
| Duration | Max 8 to 10 hours | 2 days (Days 1-2) | 1 year of LMS access |
| Schedule | Weekday batch on the 1st, weekend batch on the first Saturday of every month | On demand, on your dates | Start any day |
| Labs | Your own Azure free trial or local setup, set up with the trainer | Ready lab environment provided | Guided lab videos |
| Support | Live Q&A, WhatsApp, recordings for a year | Trainer and team Q&A throughout | LMS and email support |
| Best for | Individuals who want guidance and feedback | Security teams adopting Sentinel together | Busy schedules and self-starters |
1st of every month
Starts on the 1st of every month. Max 10 learners, so every lab gets reviewed.
first Saturday of the month
Starts on the first Saturday of every month, for working professionals. Max 10 learners.
On demand
Private sessions at a time that suits you. Ask us for availability.
Why Essential-level Sentinel skills matter
Security teams receive more alerts than they can investigate, from tools that do not talk to each other. A SIEM such as Microsoft Sentinel brings that telemetry together so analysts can detect, investigate and respond in one place.
Organisations that run Microsoft 365, Azure or Microsoft Defender increasingly operate their SOC from Sentinel in the Defender portal, which makes the people who can deploy, query, tune and automate it central to the security team.
Use basic KQL, operationalize built-in detection content, and complete a guided alert-to-incident investigation.
An analyst triages a suspicious administrative or identity-related event using collected evidence and an approved decision checklist.
Question this level answersWhy turn ingested events into meaningful, explainable detections and triage decisions?
What you are expected to learn in Essential
- Day 1: Understand where Sentinel fits in security operations, explain its architecture, and establish a working lab environment.
- Day 2: Use basic KQL, operationalize built-in detection content, and complete a guided alert-to-incident investigation.
- Essential progression gate: Learners can explain the end-to-end architecture, confirm ingestion, write basic KQL, deploy a tested template-based detection, and complete a guided incident investigation. Meeting this gate qualifies them for the Intermediate level.
What you need before you start
- Foundation (Day 1) completed, or a working Sentinel workspace with a connected data source
- A laptop with a current browser
- An Azure free trial or Azure subscription where you can create a resource group and Log Analytics workspace (the trainer shows you how)
- Access to the Microsoft Defender portal with your account
Is Essential the right level for you?
- SOC L1 analysts who triage alerts and incidents
- Security and cloud engineers who completed Foundation or already run a Sentinel workspace
- Analysts who need KQL to answer day-to-day security questions
- Teams switching on Microsoft's built-in detection content for the first time
New to SIEM and Microsoft Sentinel? Start with Foundation instead.
Essential agenda: Days 1-2
Microsoft Sentinel Essential Training covers Days 1-2: 23 topics and 6 practical exercises. The new day is open below; earlier days are included and can be expanded. Corporate batches run day by day; the live online course covers the same topics in up to 8 to 10 hours.
Day 1 · Foundation (included)Microsoft Sentinel Essentials, SOC Context, Architecture, and Initial Deployment12 topics · 3 labs
Day outcome: Understand where Sentinel fits in security operations, explain its architecture, and establish a working lab environment.
| ID | Topic | Coverage |
|---|---|---|
| F01 | The security operations problem | Security visibility gaps, alert fatigue, SOC mission, and lifecycle of a security event. |
| F02 | Fundamental security terminology | Telemetry, log, event, indicator, detection, alert, incident, case, false positive, and response action. |
| F03 | What Microsoft Sentinel provides | Cloud-native SIEM capabilities, unified security operations experience, key benefits, and fundamental limitations. |
| F04 | People and responsibilities | SOC L1/L2/L3 analysts, threat hunters, security engineers, cloud administrators, and service owners; basic ownership boundaries. |
| F05 | Where Sentinel fits and when to adopt it | Microsoft/Azure, multicloud, hybrid, and on-premises contexts; common organizational use cases. |
| F06 | Comparison with alternative approaches | SIEM versus endpoint-only monitoring, EDR/XDR, log management, and traditional SIEM; complementary rather than mutually exclusive tools. |
| F07 | Foundational platform architecture | Data sources → connectors → ingestion/Log Analytics → analytics → incidents → investigation and response; Defender portal interface. |
| F08 | Azure resource dependencies | Microsoft Entra tenant, subscription, resource group, Log Analytics workspace, region, and workspace association. |
| F09 | Prerequisites and deployment planning | Lab scope, account requirements, region selection, permissions, sample data, safe test practices, and awareness of ingestion costs. |
| F10 | Baseline access permissions | Least privilege concepts; basic Azure and Microsoft Sentinel roles; why owner and analyst access differ. |
| F11 | Initial workspace setup | Create or select a Log Analytics workspace, enable Sentinel, connect it to the Microsoft Defender portal, and confirm navigation. |
| F12 | First data connection | Activate one instructor-approved, straightforward Microsoft data source (for example Azure Activity, subject to access), observe connection status, and verify sample events arrive. |
Practical exercises
- Sketch the foundational Sentinel architecture and identify the responsibility of each component.
- Provision or access a dedicated training workspace, enable Microsoft Sentinel, and open the Defender portal experience.
- Connect an approved starter data source and record evidence of incoming events; use instructor-provided synthetic telemetry when a licensed source is unavailable.
You leave with: Architecture sketch, working Sentinel workspace, documented access model, and proof of first successful data ingestion.
Day 2 · Essential (new at this level)Log Exploration, Basic Detection, and First-Line Incident Handling11 topics · 3 labs
Day outcome: Use basic KQL, operationalize built-in detection content, and complete a guided alert-to-incident investigation.
| ID | Topic | Coverage |
|---|---|---|
| F13 | Understanding ingested security records | Tables, columns, event timestamps, event identifiers, data types, and lookback windows. |
| F14 | KQL essentials | KQL pipeline model; where, project, take, sort, count, summarize, and bin; basic filters and aggregations. |
| F15 | Basic log validation | Identify relevant events, check timestamps, distinguish no data from no matching records, and save simple reusable queries. |
| F16 | Built-in security content | Navigate Content hub; distinguish solutions, detection templates, hunting content, and workbook templates at a user level. |
| F17 | Activate a starter analytic rule | Create a rule from a suitable template, understand its prerequisite data, choose basic settings, and test expected alert output. |
| F18 | Detection-to-incident fundamentals | Alert versus incident, severity, status, ownership, and the basic incident lifecycle. |
| F19 | Guided first-line triage | Review incident overview, mapped entities, related alerts, chronology, and available evidence. |
| F20 | Basic disposition and escalation | Differentiate benign activity, expected test data, suspicious activity, and confirmed issues; record evidence and hand off. |
| F21 | Consume an out-of-box workbook | Open an existing workbook, interpret charts/filters, and use its visualization for a simple SOC question. |
| F22 | Entry-level SOC operating procedure | Apply a standard checklist for investigating and documenting a new incident consistently. |
| F23 | Entry-level troubleshooting | Diagnose empty query output, mismatched time filters, missing rule prerequisites, rule-not-triggered situations, and missing incident visibility. |
Practical exercises
- Run a starter query pack over the approved lab data to identify significant events and summarize activity over time.
- Enable a prevalidated detection template against a supported data source or instructor-seeded telemetry, then generate a harmless test event.
- Review the resulting alert/incident, document evidence and disposition, and interpret a built-in workbook relevant to that data.
You leave with: Basic KQL query pack, enabled starter detection, annotated test incident, and first-line triage record.
Essential progression gate: Learners can explain the end-to-end architecture, confirm ingestion, write basic KQL, deploy a tested template-based detection, and complete a guided incident investigation. Meeting this gate qualifies them for the Intermediate level.
One course, three ways to take it
INR is the reference price; your local currency is shown where it can be detected.
- Next batch on the 1st (weekday) or first Saturday (weekend)
- Max 10 learners per batch
- Guided labs and live Q&A
- Recordings in your LMS for a year
- All four Microsoft Sentinel levels included
- Access to 20+ other courses and 50+ tools
- Learn at your own pace, any day
- 2 days, day-wise (Days 1-2)
- Ready lab environment provided
- Agenda aligned to your tenant
- Can't attend your batch? Move to next month's batch.
- Every live session is recorded and stays in your LMS for a year.
- Free demo class before you pay.
- Pay by UPI, credit and debit cards, net banking or PayPal
- Refund policy
How you learn, and how your skills are checked
How sessions run
Instructor-led explanations, demonstrations, guided labs, assessment, and case studies, in the Microsoft Defender portal.
- Explain the concept, then demonstrate it in the Microsoft Defender portal
- You repeat it in a guided lab and keep the evidence
- A real-world case ties each day together
- Practice questions and mock exams aligned to the official SC-200 objectives
Assessment checkpoints
Skills are checked with checklists and observable lab evidence, not attendance alone. If you miss a prerequisite, a supervised remediation attempt is allowed.
| Checkpoint | Evidence | Next step |
|---|---|---|
| Essential gate (end of Day 2) | Setup and ingestion evidence, basic KQL, starter alert, incident triage | Pass to enter entering Day 3. |
6 labs, each with evidence you keep
Labs build on each other: every lab produces evidence you keep, and later days reuse earlier lab artifacts.
Run a starter query pack over the approved lab data to identify significant events and summarize activity over time.
Enable a prevalidated detection template against a supported data source or instructor-seeded telemetry, then generate a harmless test event.
Review the resulting alert/incident, document evidence and disposition, and interpret a built-in workbook relevant to that data.
Included from earlier levels3 labs from earlier days
- Day 1, lab 1: Sketch the foundational Sentinel architecture and identify the responsibility of each component.
- Day 1, lab 2: Provision or access a dedicated training workspace, enable Microsoft Sentinel, and open the Defender portal experience.
- Day 1, lab 3: Connect an approved starter data source and record evidence of incoming events; use instructor-provided synthetic telemetry when a licensed source is unavailable.
Individuals set up their own lab on an Azure free trial or locally, and the trainer shows you how, step by step. Corporate batches get a ready lab environment. Azure ingestion and Logic Apps costs may apply beyond the free allowances.
Rajesh Kumar
Principal Architect, trainer and mentor in DevOps, SRE, DevSecOps and platform engineering, with 20 years across 8+ software MNCs, including Staff DevOps/SRE Engineer for a leading Japanese mobile-payment platform and Principal DevOps Architect and Manager in Europe. He leads this course and reviews its curriculum (last reviewed 1 November 2026).
Earn a verifiable Microsoft Sentinel certificate
Complete the labs and meet the Essential checkpoint to receive a DevOpsSchool certificate of completion. Each certificate has a unique ID that employers can check in the DevOpsSchool certificate registry.
Preparing for Microsoft SC-200? Together, the four Microsoft Sentinel levels follow the Sentinel parts of the official SC-200 (Microsoft Security Operations Analyst) exam objectives, and mock exams are included. DevOpsSchool is an independent training provider and is not affiliated with Microsoft.
Verify a certificate
Real reviews, linked to where they were published
“Rajesh is very good trainer. Rajesh was able to resolve our queries and question effectively. We really liked the hands-on examples covered during this training program.”
“Very well organized training, helped a lot to understand the AWS concept and detailed related to various tools. Very helpful”
Quoted exactly as published on the DevOpsSchool testimonials page, from learners in Rajesh Kumar's live trainings across courses.
DevOpsSchool training compared with learning alone
Microsoft Learn's free documentation is excellent, and this course links to it throughout. What training adds is structure, guided labs, feedback and accountability.
| DevOpsSchool Microsoft Sentinel training | Learning alone from docs and videos | |
|---|---|---|
| Learning path | Four levels with a day-wise agenda and progression gates | You choose topics and order yourself |
| Help when you are stuck | Trainer answers in live sessions and on WhatsApp | Forums and search results |
| Labs | Guided labs, with help setting up your own Azure lab | Set up and debug alone |
| Missed a session | Recordings for a year, or move to next month's batch | Not applicable |
| Proof of skills | Verifiable certificate of completion | None |
| Exam practice | Mock exams aligned to the SC-200 objectives | Find your own |
Questions before you enrol
Do I need to complete the earlier levels first?
Essential builds on Day 1 (Foundation). New to SIEM and Microsoft Sentinel? Start with Foundation instead. See Microsoft Sentinel Foundation Training.
How long is the course?
Live online: up to 8 to 10 hours of instructor-led sessions. Corporate: 2 days, day by day (Days 1-2). Self-paced: one year of LMS access to all four levels.
When does the next batch start?
Weekday batches start on the 1st of every month and weekend batches on the first Saturday of every month. Each batch has at most 10 learners. One-to-one and corporate sessions are scheduled on demand.
What do I need for the labs?
Set up your own lab on an Azure free trial or locally, and the trainer shows you how, step by step. You need a Log Analytics workspace and access to the Microsoft Defender portal; Azure ingestion and Logic Apps costs may apply beyond the free allowances. Corporate batches get a ready lab environment.
What if I miss a live session?
Every live session is recorded and stays in your LMS for a year. If you cannot attend your batch, you can move to next month's batch.
Can I try it before I pay?
Yes. Join a free demo class, or book a free 10-15 minute call with an advisor or the trainer to check the course fits you. Payments follow our refund policy.
Does this prepare me for the SC-200 exam?
Together, the four Microsoft Sentinel levels follow the Sentinel parts of the official SC-200 (Microsoft Security Operations Analyst) exam objectives, and mock exams are included. DevOpsSchool is an independent training provider and is not affiliated with Microsoft.
How can I pay?
UPI, credit and debit cards, net banking or PayPal. Prices are in INR, and your local currency is shown for reference.
What does self-paced access include?
One year of complete LMS access, all four Microsoft Sentinel levels, plus 20+ other courses and 50+ tools.
Is the course up to date?
Yes. It teaches Microsoft Sentinel in the Microsoft Defender portal, which Microsoft has made the standard experience; Microsoft supports the Azure-portal experience only until 31 March 2027. The curriculum was last updated on 1 November 2026.
Talk to a person before you decide
We reply within 1 hour on WhatsApp and email. Free 10-15 minute call with an advisor or the trainer to check the course fits you.
Try it before you pay
Free demo class before you pay. Free 10-15 minute call with an advisor or the trainer to check the course fits you.
Book a free demo classRead more before or after the course
Official Microsoft documentation used in this level
Inside the course materials
Start Microsoft Sentinel Essential Training
Weekday batch starts 1st of every month; weekend batch first Saturday of the month. Batches are capped at 10 learners so every lab gets reviewed.
Not ready yet? Ask for a free demo class or a free 10-15 minute call using the form.