{"id":1258,"date":"2026-11-01T06:34:34","date_gmt":"2026-11-01T06:34:34","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/?p=1258"},"modified":"2026-11-01T07:07:53","modified_gmt":"2026-11-01T07:07:53","slug":"microsoft-sentinel-essentials-one-complete-end-to-end-hands-on-lab-part-2","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/microsoft-sentinel-essentials-one-complete-end-to-end-hands-on-lab-part-2\/","title":{"rendered":"Microsoft Sentinel Essentials: One Complete End-to-End Hands-On Lab – Part – 2"},"content":{"rendered":"\n

Module 1: Fundamentals \/ Essentials \/ Foundations | Day 1 and Day 2<\/h2>\n\n\n\n
\n

Edition:<\/strong> 1 November 2026
Format:<\/strong> Two-day, instructor-led, day-wise<\/strong> practical manual; no hourly timetable
Audience:<\/strong> New SOC analysts, security engineers, Azure administrators, DevOps\/SRE engineers, technical trainers
Primary product experience:<\/strong> Microsoft Sentinel in the Microsoft Defender portal<\/strong> (https:\/\/security.microsoft.com<\/code>)
Azure provisioning:<\/strong> Azure portal (https:\/\/portal.azure.com<\/code>)
Scope:<\/strong> Exactly the Foundations curriculum, topic IDs F01\u2013F23<\/strong>. Intermediate correlation, DCR\/AMA\/CEF, custom workbooks, advanced hunting, SOAR playbooks, and enterprise deployment are left to Days 3\u20135.
Evidence standard:<\/strong> Every hands-on lab has prerequisites, actions, observable pass\/fail checks, troubleshooting, and a learner deliverable.
Source basis:<\/strong> User-provided Microsoft_Sentinel_Module_1_Foundations_2_Days(3).md<\/code>, cross-checked against the official Microsoft documentation listed in References<\/a>.<\/p>\n<\/blockquote>\n\n\n\n

Important validation and safety statement<\/h2>\n\n\n\n

This manual has been checked against the Microsoft Learn procedures and current documented UI paths as of 1 November 2026. It has not<\/em> been executed inside your Azure subscription or Microsoft Entra tenant.<\/strong> Actual portal labels, regional availability, tenant policy, licensing, role assignment, data volume, and alert-correlation behavior must be verified using the explicit PASS gates<\/strong> below. Never mark an environment-specific step PASS<\/strong> merely because the command or page is documented.<\/p>\n\n\n\n

We distinguish four different kinds of proof throughout:<\/p>\n\n\n\n

    \n
  • DOC-VERIFIED:<\/strong>\u00a0The documented approach, prerequisite, or product behavior was checked against a linked Microsoft Learn page.<\/li>\n\n\n\n
  • LAB-PASS:<\/strong>\u00a0Your learner actually performed the step, captured the required evidence, and met the observable acceptance criterion.<\/li>\n\n\n\n
  • SIMULATED:<\/strong>\u00a0KQL examples use a local\u00a0datatable<\/code>; they demonstrate query syntax and reasoning but\u00a0do not<\/strong>\u00a0ingest data, generate a real Sentinel alert, or create an incident.<\/li>\n\n\n\n
  • BLOCKED:<\/strong>\u00a0An unavoidable permission, license, provisioning, policy, or data-source dependency prevents the live step. Record the blocker, use the approved fallback, and do\u00a0not<\/strong>\u00a0claim a live pass.<\/li>\n<\/ul>\n\n\n\n

    Non-negotiable guardrails:<\/strong> Use a dedicated approved training subscription or isolated test resource group. Obtain the owner\/security team’s written authorization before creating Azure Policy assignments, diagnostic settings, connectors, Sentinel rules, or incident workflow changes. Do not connect production identities, copy confidential logs, disable actual defenses, create false malicious events, or configure disruptive automated response. In particular, do not<\/strong> grant Owner to every learner to make the exercises easier. No exercises require passwords, tokens, API keys, or real attack execution.<\/p>\n\n\n\n

    \n\n\n\n

    1. How to use this complete manual<\/h1>\n\n\n\n

    1.1 End-to-end outcome<\/h2>\n\n\n\n

    After Day 1<\/strong>, the learner can explain how security telemetry reaches Sentinel, deploy or access a correctly scoped workspace, navigate Sentinel through the Defender portal, and prove that an approved Azure Activity event arrived. After Day 2<\/strong>, they can examine records and timestamps, use beginner KQL, install and inspect built-in content, enable a supported scheduled rule, investigate a controlled alert\/incident, interpret a workbook, and complete a structured first-line SOC report.<\/p>\n\n\n\n

    The same<\/em> fictional organization and activity flow are used across both days so the learner develops a consistent mental model rather than jumping between unrelated demos.<\/p>\n\n\n\n

    1.2 Course structure and lab navigation<\/h2>\n\n\n\n
    Day<\/th>Lab ID<\/th>Activity<\/th>Key topic IDs<\/th>Primary evidence<\/th><\/tr><\/thead>
    1<\/td>D1-L01<\/td>SOC event-to-incident tabletop and 5W1H<\/td>F01\u2013F06<\/td>5W1H\/SOC roles worksheet<\/td><\/tr>
    1<\/td>D1-L02<\/td>Draw and defend the Sentinel architecture<\/td>F07\u2013F08<\/td>Architecture diagram with boundaries<\/td><\/tr>
    1<\/td>D1-L03<\/td>Tenant, subscription, permissions, and cost preflight<\/td>F08\u2013F10<\/td>Approved environment readiness record<\/td><\/tr>
    1<\/td>D1-L04<\/td>Create a dedicated Log Analytics workspace<\/td>F09, F11<\/td>Workspace resource proof<\/td><\/tr>
    1<\/td>D1-L05<\/td>Enable Sentinel and confirm the Defender portal<\/td>F11<\/td>Workspace and Defender proof<\/td><\/tr>
    1<\/td>D1-L06<\/td>Install the Azure Activity solution<\/td>F12; foundations for F16<\/td>Solution install evidence<\/td><\/tr>
    1<\/td>D1-L07<\/td>Connect Azure Activity using the approved method<\/td>F12<\/td>Export\/connector configuration<\/td><\/tr>
    1<\/td>D1-L08<\/td>Generate safe telemetry and confirm ingestion<\/td>F12<\/td>Source and destination event match<\/td><\/tr>
    2<\/td>D2-L01<\/td>Explore real log records and table fields<\/td>F13, F15<\/td>Record worksheet<\/td><\/tr>
    2<\/td>D2-L02<\/td>KQL fundamentals, filtering, counting, and timelines<\/td>F14\u2013F15<\/td>Executed query pack<\/td><\/tr>
    2<\/td>D2-L03<\/td>Offline synthetic KQL safety net<\/td>F14<\/td>Marked simulated results<\/td><\/tr>
    2<\/td>D2-L04<\/td>Content hub and starter analytics-rule template<\/td>F16\u2013F17<\/td>Rule prerequisites and active rule<\/td><\/tr>
    2<\/td>D2-L05<\/td>Verify the actual alert path using a controlled lab rule<\/td>F17\u2013F18<\/td>Rule \u2192 alert \u2192 incident evidence<\/td><\/tr>
    2<\/td>D2-L06<\/td>Triage, classify, and escalate the lab incident<\/td>F18\u2013F20, F22<\/td>Complete SOC incident record<\/td><\/tr>
    2<\/td>D2-L07<\/td>Interpret a built-in workbook<\/td>F21<\/td>Answered visualization questions<\/td><\/tr>
    2<\/td>D2-L08<\/td>Troubleshooting challenge and operational checklist<\/td>F22\u2013F23<\/td>Root-cause worksheet<\/td><\/tr>
    2<\/td>D2-L09<\/td>Foundations capstone and entry check for Day 3<\/td>F01\u2013F23<\/td>Graded evidence folder<\/td><\/tr>
    Both<\/td>END-L01<\/td>Safe cleanup, cost review, handoff<\/td>F09, F22\u2013F23<\/td>Signed cleanup record<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Content note:<\/strong> D2-L05 is a controlled demonstration fallback<\/em>, not a new intermediate-level custom-detection engineering module. Its purpose is to show that alerts and incidents actually work if a generic solution template does not match your harmless test event. Complex detection logic, tuning and correlation remain in Day 3.<\/p>\n\n\n\n

    1.3 5W1H learning contract<\/h2>\n\n\n\n
    Lens<\/th>Day 1 learner must answer<\/th>Day 2 learner must answer<\/th><\/tr><\/thead>
    What<\/strong><\/td>What are a SIEM, SOAR, XDR, event, alert, incident, workspace?<\/td>What are KQL, analytics templates, cases\/incidents, workbooks?<\/td><\/tr>
    Why<\/strong><\/td>Why centralize audit telemetry and maintain SOC ownership?<\/td>Why query and verify raw evidence before alerting or escalation?<\/td><\/tr>
    Who<\/strong><\/td>Who deploys, administers, reads, triages, and approves changes?<\/td>Who owns a rule, handles an alert, and closes a case?<\/td><\/tr>
    When<\/strong><\/td>When do we onboard a source or use a SIEM instead of a dashboard?<\/td>When do we query, alert, escalate, or close?<\/td><\/tr>
    Where<\/strong><\/td>Where do subscription logs, Log Analytics, and Defender navigation live?<\/td>Where do rule templates, records, alerts, incidents, and workbooks live?<\/td><\/tr>
    How<\/strong><\/td>How does an Azure Activity event reach the workspace?<\/td>How do where<\/code> \u2192 detection threshold \u2192 alert \u2192 incident \u2192 disposition work?<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    1.4 Learning environment patterns \u2014 select one<\/em> before class<\/h2>\n\n\n\n
    Pattern<\/th>Requirements<\/th>Appropriate use<\/th>Evidence claim<\/th><\/tr><\/thead>
    A. Full live lab<\/strong> (preferred)<\/td>Approved Azure subscription; live Sentinel workspace; Azure Activity export; authorized instructor\/learners<\/td>All provisioning, ingestion, and alert\/incident labs<\/td>End-to-end LAB-PASS<\/strong> if gates all pass<\/td><\/tr>
    B. Shared instructor-managed lab<\/strong><\/td>One instructor-owned workspace and solution; least-privilege learner access; instructor executes privileged actions<\/td>Organizations unable to grant create\/policy privileges to students<\/td>Learners can pass queries\/triage; infrastructure setup may be observed<\/strong><\/td><\/tr>
    C. Offline KQL and evidence simulation<\/strong><\/td>A query-capable Kusto\/Log Analytics environment supporting datatable<\/code> or instructor-approved example output<\/td>No subscription, access, or connector permission<\/td>Only syntax and analysis stages are SIMULATED<\/strong>; no claim of live Sentinel operations<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Strong recommendation:<\/strong> For a real instructor qualification, use Pattern A or B; a completely offline lab cannot satisfy the hands-on deployment\/ingestion\/incident progression gate.<\/p>\n\n\n\n

    \n\n\n\n

    2. Instructor preparation \u2014 do this before learners begin<\/h1>\n\n\n\n

    2.1 The fictional case: Aster Retail<\/h2>\n\n\n\n

    Aster Retail has an Azure subscription hosting internal applications. The security team wants an auditable trail of Azure control-plane changes. The lab creates or modifies only harmless, preapproved Azure training resources<\/strong>. Every learner receives a unique resource prefix so that a simulated incident can be identified without confusing it with another student’s work.<\/p>\n\n\n\n

    Sample names \u2014 replace before use:<\/strong><\/p>\n\n\n\n

    Item<\/th>Example<\/th>Rule<\/th><\/tr><\/thead>
    Tenant<\/td><TRAINING-TENANT><\/code><\/td>Record the actual tenant selected in the portal<\/td><\/tr>
    Subscription<\/td><TRAINING-SUBSCRIPTION-ID><\/code><\/td>Never assume the default Azure CLI or portal subscription is correct<\/td><\/tr>
    Resource group<\/td>rg-sentinel-foundations-lab01<\/code><\/td>Instructor-created, clearly tagged, no production resources<\/td><\/tr>
    Log Analytics workspace<\/td>law-sentinel-foundations-lab01<\/code><\/td>Must meet workspace name\/region restrictions<\/td><\/tr>
    Activity signal group<\/td>rg-sentinel-signal-lab01<\/code><\/td>Separate<\/em> small RG used only to create benign activity events<\/td><\/tr>
    Demo analytics rule<\/td>LAB01 - Approved Azure Activity Test<\/code><\/td>Must be disabled\/deleted at teardown<\/td><\/tr>
    Instructor<\/td><INSTRUCTOR-UPN><\/code><\/td>Never put a personal email into published lab screenshots<\/td><\/tr>
    Evidence path<\/td>Day01\/<\/code>, Day02\/<\/code>, Assessment\/<\/code>, Cleanup\/<\/code><\/td>Local or institution-approved storage only<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Naming hygiene:<\/strong> Do not blindly reuse the same names when more than one learner shares the subscription; assign a unique short suffix (such as lab01<\/code>, lab02<\/code>) and confirm name availability. For rule queries that contain a sample name, the learner must replace it with their actual unique name.<\/p>\n\n\n\n

    2.2 Prerequisites matrix: exact operational separation<\/h2>\n\n\n\n
    Persona<\/th>Access to request<\/th>Scope<\/th>Used for<\/th>Verification<\/th><\/tr><\/thead>
    Instructor \/ provisioner<\/strong><\/td>Subscription Contributor<\/strong> or equivalent for Sentinel enablement; permissions to create RG\/workspace<\/td>Approved training subscription<\/td>D1-L04\/05<\/td>Successful deployment and Sentinel addition<\/td><\/tr>
    Instructor \/ onboarding approver<\/strong><\/td>Appropriate Microsoft Entra administrator role and unconditional subscription Owner<\/strong>, or supported alternative User Access Administrator + Sentinel Contributor<\/strong>, per Defender onboarding documentation<\/td>Tenant + specified subscription<\/td>Manual Defender portal connection when required<\/strong><\/td>Workspace visible in Defender<\/td><\/tr>
    Policy approver<\/strong><\/td>Owner at Azure Policy assignment scope<\/strong>, per the Azure Activity policy-driven connector guidance<\/td>Training subscription\/scope<\/td>D1-L07 Policy route<\/td>Policy assignment exists and is effective<\/td><\/tr>
    Security content engineer<\/strong><\/td>Microsoft Sentinel Contributor<\/strong>, preferably scoped to Sentinel RG<\/td>Sentinel workspace RG<\/td>Content hub install \/ analytics rule creation<\/td>Can install solution and save rule<\/td><\/tr>
    SOC analyst \/ learner<\/strong><\/td>Microsoft Sentinel Responder<\/strong> for incident modification; Reader<\/strong> only for read-only log review<\/td>Sentinel RG\/workspace as permitted<\/td>KQL, incident investigation<\/td>Can view records and update assigned lab incident<\/td><\/tr>
    Workbook viewer<\/strong><\/td>Workbook Reader or appropriate equivalent; creation\/editing requires appropriate Workbook Contributor privileges as documented<\/td>Workbook\/Sentinel RG<\/td>D2-L07<\/td>Opens installed workbook<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Do not confuse:<\/strong> Azure resource roles, Microsoft Entra admin roles, and Microsoft Defender unified RBAC permissions are different security systems. Preview incident cases<\/strong> can additionally require Defender unified RBAC Security Data Read<\/code> \/ Security Data Manage<\/code>. Only grant an entitlement after the instructor or Azure administrator has verified the exact task at the intended scope. See [R02], [R03], [R07], [R13].<\/p>\n\n\n\n

    Instructor readiness checklist (mandatory)<\/h3>\n\n\n\n
      \n
    • [ ] Written permission to use the subscription and enable Sentinel obtained.<\/li>\n\n\n\n
    • [ ] Tenant and subscription IDs recorded; no cross-tenant confusion.<\/li>\n\n\n\n
    • [ ] Training region approved for organizational location\/residency policy.<\/li>\n\n\n\n
    • [ ] Unique RG\/workspace\/signal RG names assigned.<\/li>\n\n\n\n
    • [ ] Cloud costs and quotas approved; budget owner identified.<\/li>\n\n\n\n
    • [ ] Provisioner, policy approver, engineer, and analyst roles confirmed.<\/li>\n\n\n\n
    • [ ] Defender portal onboarding permissions confirmed, if manual onboarding is needed.<\/li>\n\n\n\n
    • [ ] Existing Azure Activity diagnostic settings\/policy assignments checked to avoid duplicate export.<\/li>\n\n\n\n
    • [ ] Existing Sentinel workspaces and data connector instances inventoried to avoid interfering with them.<\/li>\n\n\n\n
    • [ ] A backup learning path is approved: instructor workspace or synthetic KQL + sample evidence.<\/li>\n\n\n\n
    • [ ] Learners can reach\u00a0portal.azure.com<\/code>\u00a0and\u00a0security.microsoft.com<\/code>\u00a0through approved browser\/network access.<\/li>\n\n\n\n
    • [ ] A clean incident\/test naming convention and cleanup owner assigned.<\/li>\n\n\n\n
    • [ ] End-of-course evidence folder prepared, with controlled access and retention.<\/li>\n<\/ul>\n\n\n\n

      PASS gate PRE-1:<\/strong> Instructor signs the checklist and writes READY<\/code> \/ BLOCKED<\/code> beside each dependency; do not let students begin Azure Policy assignment without approval.<\/p>\n\n\n\n

      2.3 Cost and lifecycle planning (do not assume \u201cfree\u201d)<\/h2>\n\n\n\n
        \n
      1. Review Microsoft Sentinel billing in [R04]. Microsoft documents a\u00a031-day trial for up to the first 10 GB\/day of Analytics-tier ingestion<\/strong>, subject to conditions including a per-tenant workspace limit; do not assume the trial applies to a previously enabled workspace or to all ancillary services.<\/li>\n\n\n\n
      2. Microsoft separately documents that\u00a0Azure Activity log ingestion<\/strong>\u00a0to a Log Analytics workspace is not charged for ingestion; retention beyond the default included duration can incur charges.\u00a0Do not generalize this exception to other telemetry.<\/strong>\u00a0[R06]<\/li>\n\n\n\n
      3. Review workspace data-retention configuration and organizational policy. Microsoft’s Sentinel quickstart recommends checking\/raising legacy 30-day retention to 90 days when needed for full Sentinel features. Do not change retention in a shared workspace without approval. [R01]<\/li>\n\n\n\n
      4. In Azure portal, open\u00a0Cost Management + Billing<\/strong>\u00a0(or the delegated subscription’s\u00a0Cost Management<\/strong>\u00a0view), inspect subscription budgets and cost alerts, and record the approved cost ceiling. A budget is\u00a0not<\/strong>\u00a0an automatic hard spending cap.<\/li>\n\n\n\n
      5. Do not create paid infrastructure merely to generate events: training RG creation and tagging are enough for the Azure Activity teaching scenario.<\/li>\n\n\n\n
      6. At the end of the class, disable\/delete temporary rule(s), remove the synthetic signal group, and review which Sentinel workspace\/connector\/configuration must be retained or removed.<\/li>\n<\/ol>\n\n\n\n

        Recommended cost ledger fields:<\/strong> UTC date | Subscription | RG | Workspace | New Azure resource | Data source | Approval | Retention | Expected charge type | Cleanup owner | Actual cost reviewed<\/code>.<\/p>\n\n\n\n

        2.4 Recording actual results<\/h2>\n\n\n\n

        Use this same concise form for every<\/strong> lab:<\/p>\n\n\n\n

        Lab ID:                 D1-LXX \/ D2-LXX\nLearner \/ group:        __________________\nUTC start \/ end:        __________________\nTenant \/ subscription:  __________________ (redact in shared materials)\nWorkspace \/ region:     __________________\nActions completed:      __________________\nObserved result:        __________________\nEvidence filename(s):   __________________\nStatus:                 LAB-PASS \/ SIMULATED \/ BLOCKED \/ NEEDS-RETRY\nError \/ diagnostic:     __________________\nReviewer signature:     __________________\n<\/code><\/pre>\n\n\n\n
        Screenshots:<\/strong> Include the browser page title and the relevant row\/data fields; remove secret identifiers, tokens, other users’ data, and unrelated production resources. Redaction must not hide the exact signal or configuration that proves the acceptance criterion.<\/p>\n\n\n\n
        \n\n\n\n
        DAY 1 \u2014 Fundamentals, Architecture, Setup, and First Data<\/h1>\n\n\n\n
        Day 1 goal:<\/strong> Explain the platform with 5W1H, demonstrate understanding of its architecture and security roles, then provide actual evidence that benign Azure administration telemetry is reaching Sentinel.<\/p>\n\n\n\n
        D1-L01 \u2014 SOC fundamentals, responsibilities, and the 5W1H tabletop<\/h2>\n\n\n\n
        Syllabus:<\/strong> F01, F02, F03, F04, F05, F06.
        Type:<\/strong> Tabletop; no Azure permissions needed.
        Deliverable:<\/strong> Day01\/D1-L01-SOC-Worksheet.md<\/code> (learner-authored).<\/p>\n\n\n\n
        Concepts the learner needs before<\/em> clicking anything<\/h3>\n\n\n\n
          \n
        • Security event:<\/strong>\u00a0An observed action (for example, creating an Azure resource group).<\/li>\n\n\n\n
        • Telemetry\/log:<\/strong>\u00a0Recorded event data describing actor, resource, time, action, status, and source.<\/li>\n\n\n\n
        • SIEM:<\/strong>\u00a0Security information\/event management \u2014 collects, queries, correlates, detects, and supports investigation of security data.<\/li>\n\n\n\n
        • SOAR:<\/strong>\u00a0Security orchestration, automation and response \u2014 coordinates predefined investigative\/response actions, often involving workflows and approvals.<\/li>\n\n\n\n
        • EDR\/XDR:<\/strong>\u00a0Endpoint detection\/response and extended detection\/response; complementary to SIEM, not interchangeable with a raw-log datastore.<\/li>\n\n\n\n
        • Detection\/analytic rule:<\/strong>\u00a0Logic that tests records for an interesting condition.<\/li>\n\n\n\n
        • Alert:<\/strong>\u00a0A detection result indicating something requires attention. An alert is\u00a0not<\/strong>\u00a0proof of a compromise.<\/li>\n\n\n\n
        • Incident:<\/strong>\u00a0An investigation container grouping one or more relevant alerts and evidence; a security conclusion requires analyst assessment.<\/li>\n\n\n\n
        • False positive \/ expected test activity:<\/strong>\u00a0An alert that does not correspond to the harmful activity the rule is intended to find; document the exact disposition used.<\/li>\n\n\n\n
        • Response:<\/strong>\u00a0Authorized steps to document, contain, recover, and follow up; Day 1\u20132 permits only documentation and harmless incident administration.<\/li>\n<\/ul>\n\n\n\n
          Guided steps<\/h3>\n\n\n\n
            \n
          1. Write a\u00a0single sentence<\/strong>\u00a0defining the business purpose of the SOC. Example: \u201cDetect, verify, prioritize, investigate, and coordinate response to important security events.\u201d<\/li>\n\n\n\n
          2. Write a six-line answer for\u00a0What \/ Why \/ Who \/ When \/ Where \/ How<\/strong>\u00a0for Microsoft Sentinel using the terms above.<\/li>\n\n\n\n
          3. Your instructor describes this scenario: \u201cA new Azure resource group appears at 10:25 UTC. The creator was a known administrator.\u201d Decide whether this alone is a\u00a0log<\/em>,\u00a0alert<\/em>,\u00a0incident<\/em>, or\u00a0confirmed threat<\/em>. Explain why the event by itself is\u00a0not<\/strong>\u00a0evidence of malicious activity.<\/li>\n\n\n\n
          4. Write a simple escalation chain:\u00a0Platform admin \u2192 SOC L1 \u2192 SOC L2\/Incident commander \u2192 Service owner<\/code>, and assign a typical responsibility to each role.<\/li>\n\n\n\n
          5. Compare these options in a short table: Azure Monitor Logs without Sentinel, Sentinel SIEM, an EDR product, a vendor-operated traditional SIEM, and a spreadsheet or ticket queue.<\/li>\n\n\n\n
          6. List\u00a0two advantages<\/strong>\u00a0(for example, centralized analytics and integrated cloud collection) and\u00a0two limitations<\/strong>\u00a0(for example, data\/retention costs and dependency on data quality plus analyst response processes).<\/li>\n\n\n\n
          7. Have another learner challenge your definition of \u201cincident\u201d and your decision to escalate. Correct any assumption that \u201cevery admin action is malicious.\u201d<\/li>\n<\/ol>\n\n\n\n
            Expected answer check<\/h3>\n\n\n\n
            Question<\/th>Passing response<\/th><\/tr><\/thead>
            Why not alert on every Azure change?<\/td>That creates noise; baseline\/context and intended behavior matter.<\/td><\/tr>
            Who should install connectors?<\/td>Authorized engineer\/administrator, not a reader-only analyst.<\/td><\/tr>
            What does Sentinel add to raw Log Analytics?<\/td>Security content, detection\/incident workflows and SOC experiences.<\/td><\/tr>
            Where is today’s primary UI?<\/td>Microsoft Defender portal; Azure still provisions the workspace.<\/td><\/tr>
            What happens after an alert?<\/td>Investigate evidence, choose disposition, document and escalate when justified.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
            PASS gate D1-01:<\/strong> All six 5W1H prompts addressed, comparison completed, roles assigned, and event\/alert\/incident correctly distinguished. Common mistake:<\/strong> Treating XDR, SIEM, SOAR, incident ticketing, and Log Analytics as identical products.<\/p>\n\n\n\n
            D1-L02 \u2014 Draw the core Sentinel architecture<\/h2>\n\n\n\n
            Syllabus:<\/strong> F07, F08. Type:<\/strong> Architecture exercise. Deliverable:<\/strong> Day01\/D1-L02-Architecture.md<\/code> or a diagram image made by the learner.<\/p>\n\n\n\n
            Reference architecture \u2014 teach the arrows, not just boxes<\/h3>\n\n\n\n
            Azure subscriptions \/ and other approved sourcesConnectors and \/ diagnostic exportLog Analytics workspace \/ AzureActivity tableSentinel detection content \/ Analytics rulesSecurity alertsIncident investigation \/ in Microsoft DefenderKQL hunting and \/ workbooksAnalyst disposition \/ and escalation<\/pre>\n\n\n\n
            Clarification:<\/strong> This is a logical<\/strong> view. Actual Microsoft components may share platform services; it is not a network diagram showing independently deployed VMs. Security data in separate Sentinel workspaces is not automatically one merged table.<\/p>\n\n\n\n
            Guided steps<\/h3>\n\n\n\n
              \n
            1. Draw all seven logical elements, including a boundary around the\u00a0Azure subscription<\/strong>, a boundary around the\u00a0Microsoft Entra tenant<\/strong>, and a boundary around the\u00a0Log Analytics workspace<\/strong>.<\/li>\n\n\n\n
            2. Identify the source for the teaching case:\u00a0Azure Activity (subscription control-plane activity)<\/em>, not VM guest logs or Azure resource data-plane logs.<\/li>\n\n\n\n
            3. Label the actual destination table\u00a0AzureActivity<\/code><\/strong>\u00a0and the time field\u00a0TimeGenerated<\/code><\/strong>.<\/li>\n\n\n\n
            4. Label the configuration UI\u00a0Azure portal<\/strong>, security operations UI\u00a0Defender portal<\/strong>, and the data store\u00a0Log Analytics workspace<\/strong>.<\/li>\n\n\n\n
            5. Put a lock\/role icon beside the\u00a0policy export<\/strong>,\u00a0rule authoring<\/strong>, and\u00a0incident editing<\/strong>\u00a0arrows; each has different required permissions.<\/li>\n\n\n\n
            6. Trace one event:\u00a0create\/tag lab resource \u2192 Azure Activity log \u2192 configured diagnostic export \u2192 workspace AzureActivity \u2192 KQL \u2192 optional scheduled rule \u2192 alert \u2192 incident<\/code>.<\/li>\n\n\n\n
            7. Explain what happens if the connector is configured but the source has produced\u00a0zero<\/strong>\u00a0matching events; then explain what happens if an analytics rule query returns\u00a0zero<\/strong>\u00a0rows.<\/li>\n\n\n\n
            8. Have the instructor hide one arrow. Learner identifies which downstream capability will fail and what evidence to check first.<\/li>\n<\/ol>\n\n\n\n
              PASS gate D1-02:<\/strong> Diagram contains source, connector, workspace, table, detection, alerts, incident, analyst, portals, and access boundary. Learner can identify three common points of failure: no export<\/strong>, wrong workspace<\/strong>, rule has no matches<\/strong>.<\/p>\n\n\n\n
              D1-L03 \u2014 Identify the actual tenant, subscription, region, access, and constraints<\/h2>\n\n\n\n
              Syllabus:<\/strong> F08\u2013F10. Type:<\/strong> Azure portal preflight. Prerequisite:<\/strong> Instructor-approved account, subscription access.
              Deliverable:<\/strong> Day01\/D1-L03-Environment-Readiness.md<\/code>.<\/p>\n\n\n\n
              Step-by-step<\/h3>\n\n\n\n
                \n
              1. Open\u00a0https:\/\/portal.azure.com<\/code>\u00a0using the approved training account.<\/li>\n\n\n\n
              2. Check the\u00a0current directory \/ tenant<\/strong>\u00a0in the account selector. If multiple directories are visible, explicitly switch to the instructor-approved one. Record\u00a0tenant display name<\/strong>\u00a0and\u00a0tenant ID<\/strong>\u00a0in private evidence.<\/li>\n\n\n\n
              3. In Azure portal search, type\u00a0Subscriptions<\/strong>\u00a0and open the approved training subscription; copy the\u00a0subscription name\/ID<\/strong>\u00a0into the private readiness form.<\/li>\n\n\n\n
              4. Open\u00a0Subscriptions \u2192 [training subscription] \u2192 Access control (IAM) \u2192 View my access<\/strong>\u00a0(or the equivalent available access view). Record what this account can actually do.\u00a0Seeing a subscription does not mean you can create resources or grant roles.<\/strong><\/li>\n\n\n\n
              5. Check the proposed region’s policy, residency requirements, and availability before creating the workspace. Record region and justification.\u00a0Do not move an existing Sentinel workspace between subscriptions\/RGs as a lab task<\/strong>; Microsoft documents this as unsupported for a Sentinel-enabled workspace. [R01]<\/li>\n\n\n\n
              6. Under the same subscription, review the existing\u00a0Resource groups<\/strong>\u00a0list; verify no resources will be changed by name collision.<\/li>\n\n\n\n
              7. Check if a workspace is already supplied by the instructor. If yes, record its name, RG, region, and permissions; do\u00a0not<\/strong>\u00a0create a second one unless approved.<\/li>\n\n\n\n
              8. Ask the instructor\/provisioner to demonstrate that they can create resources and approve Policy\/Defender onboarding where required. Do not request a standing subscription Owner grant for learners.<\/li>\n\n\n\n
              9. Open the subscription’s\u00a0Cost Management<\/strong>\u00a0page. Record budget owner, threshold and who will watch costs. Document that a budget alert is informational, not a spending stop.<\/li>\n\n\n\n
              10. Verify browsers can access both Microsoft portals; if the Defender portal opens but Sentinel is absent, record that as an\u00a0onboarding\/permission state<\/em>, not as proof that Sentinel is broken.<\/li>\n\n\n\n
              11. Confirm the\u00a0unique suffix<\/strong>\u00a0to be used for lab resources and test rules; do not begin provisioning until instructor sign-off.<\/li>\n<\/ol>\n\n\n\n
                Preflight evidence record<\/h3>\n\n\n\n
                Training directory\/tenant:      __________________\nTraining subscription:          __________________\nApproved Azure region:          __________________\nSentinel resource group:        __________________\nWorkspace (existing or new):    __________________\nSignal resource group:          __________________\nWorkspace creation approval:    Yes \/ No\nAzure Policy export approver:   __________________\nContent Hub\/rule editor:        __________________\nAnalyst\/incident editor:        __________________\nExpected cost policy:          __________________\nDefender portal ready:         Yes \/ No \/ Not yet\n<\/code><\/pre>\n\n\n\n
                PASS gate D1-03:<\/strong> The actual<\/strong> tenant, subscription, workspace\/RG plan, region, required role owners, cost owner, and clean name prefix are recorded. STOP<\/strong> if either environment or permission scope is uncertain.<\/p>\n\n\n\n
                D1-L04 \u2014 Create a Log Analytics workspace, or validate the instructor’s workspace<\/h2>\n\n\n\n
                Syllabus:<\/strong> F09, F11. Type:<\/strong> Live provisioning. Authorization:<\/strong> Approved provisioner. DOC-VERIFIED:<\/strong> [R01], [R02].<\/p>\n\n\n\n
                Branch A \u2014 new isolated workspace (preferred for a provisioning class)<\/h3>\n\n\n\n
                  \n
                1. In Azure portal, search\u00a0Microsoft Sentinel<\/strong>.<\/li>\n\n\n\n
                2. Select\u00a0Create<\/strong>. If a suitable workspace does not exist, select\u00a0Create a new workspace<\/strong>. The provisioning UI may lead into the Log Analytics workspace creation experience.<\/li>\n\n\n\n
                3. Select the approved\u00a0subscription<\/strong>.<\/li>\n\n\n\n
                4. Under\u00a0Resource group<\/strong>, create or choose the preapproved lab RG, e.g.\u00a0rg-sentinel-foundations-lab01<\/code>.<\/li>\n\n\n\n
                5. Enter a unique\u00a0Log Analytics workspace name<\/strong>, e.g.\u00a0law-sentinel-foundations-lab01<\/code>.<\/li>\n\n\n\n
                6. Choose the instructor-approved\u00a0Azure region<\/strong>; verify it matches the lab plan and residency requirements.<\/li>\n\n\n\n
                7. Select\u00a0Review + Create<\/strong>, review subscription, RG, name, region and any pricing\/retention settings, then\u00a0Create<\/strong>.<\/li>\n\n\n\n
                8. Wait for deployment success, and open\u00a0Log Analytics workspaces \u2192 [workspace] \u2192 Overview<\/strong>.<\/li>\n\n\n\n
                9. Record the\u00a0workspace name, region, RG, subscription<\/strong>. Take screenshot\u00a0D1-L04-Workspace-Overview.png<\/code>.<\/li>\n\n\n\n
                10. Check the workspace’s data retention settings with the instructor. If legacy defaults conflict with the intended Sentinel training, obtain approval and configure an appropriate retention period following the current Microsoft instructions.\u00a0Do not automatically change enterprise retention policy.<\/strong><\/li>\n<\/ol>\n\n\n\n
                  Branch B \u2014 supplied workspace (shared lab)<\/h3>\n\n\n\n
                    \n
                  1. Open\u00a0Log Analytics workspaces<\/strong>\u00a0and select the provided workspace.<\/li>\n\n\n\n
                  2. Verify name, RG, region and subscription match the instructor sheet.<\/li>\n\n\n\n
                  3. Verify read\/write rights according to the action the learner will perform; if read-only, provisioning is\u00a0observed<\/strong>\u00a0and later labs use the already configured source.<\/li>\n\n\n\n
                  4. Record that the workspace was\u00a0pre-existing<\/strong>\u00a0and whether Sentinel is already enabled.<\/li>\n<\/ol>\n\n\n\n
                    Validation checklist<\/h3>\n\n\n\n
                      \n
                    • [ ] Workspace resource exists and is in the\u00a0intended<\/em>\u00a0subscription\/RG.<\/li>\n\n\n\n
                    • [ ] Region matches approved plan.<\/li>\n\n\n\n
                    • [ ] Provisioner can view the workspace overview without deployment errors.<\/li>\n\n\n\n
                    • [ ] No collision with production workspace; no unintended existing configuration modified.<\/li>\n\n\n\n
                    • [ ] Retention decisions reviewed; no unapproved changes.<\/li>\n<\/ul>\n\n\n\n
                      PASS gate D1-04:<\/strong> Workspace successfully provisioned or an approved existing workspace identified and verified. Error branches:<\/strong> \u201cNot authorized\u201d \u2192 role\/scope admin; \u201cregion not supported\u201d \u2192 use approved alternate; deployment denied by policy \u2192 show denial details to policy admin; workspace not found \u2192 wrong subscription or directory.<\/p>\n\n\n\n
                      D1-L05 \u2014 Enable Microsoft Sentinel and verify Microsoft Defender access<\/h2>\n\n\n\n
                      Syllabus:<\/strong> F11. Type:<\/strong> Live onboarding. DOC-VERIFIED:<\/strong> [R01], [R03].<\/p>\n\n\n\n
                      Step A \u2014 Add Sentinel to the workspace<\/h3>\n\n\n\n
                        \n
                      1. In Azure portal, search and open\u00a0Microsoft Sentinel<\/strong>.<\/li>\n\n\n\n
                      2. Select\u00a0Create<\/strong>\u00a0(or the option to add a workspace).<\/li>\n\n\n\n
                      3. Find the workspace from D1-L04. If it does not appear, verify\u00a0subscription, resource group, supported workspace type, and current permissions<\/em>\u00a0before retrying.<\/li>\n\n\n\n
                      4. Select the correct workspace and choose\u00a0Add<\/strong>.<\/li>\n\n\n\n
                      5. Confirm the onboarding operation has completed, then check that the workspace is displayed as Sentinel-enabled. Capture\u00a0D1-L05-Sentinel-Enabled.png<\/code>.<\/li>\n\n\n\n
                      6. If the workspace was already enabled,\u00a0record existing state<\/strong>\u00a0instead of trying to re-enable it.<\/li>\n<\/ol>\n\n\n\n
                        Step B \u2014 Confirm the Defender portal (standard experience)<\/h3>\n\n\n\n
                          \n
                        1. Go to\u00a0https:\/\/security.microsoft.com<\/code>\u00a0with the\u00a0same intended tenant<\/em>.<\/li>\n\n\n\n
                        2. On a newly onboarded workspace, check whether Sentinel already appears in the left navigation. Microsoft documents that many new workspaces are\u00a0automatically connected<\/strong>\u00a0to Defender. [R03]<\/li>\n\n\n\n
                        3. In the Defender navigation, open\u00a0System \u2192 Settings \u2192 Microsoft Sentinel \u2192 Workspaces<\/strong>\u00a0(navigation wording may show Settings directly in some layouts).<\/li>\n\n\n\n
                        4. Confirm the expected workspace is listed, verify whether it is the\u00a0primary workspace<\/strong>, and capture\u00a0D1-L05-Defender-Workspace.png<\/code>.<\/li>\n\n\n\n
                        5. If\u00a0not<\/strong>\u00a0connected, stop and request an authorized onboarding administrator. An authorized admin can open\u00a0System \u2192 Settings \u2192 Microsoft Sentinel \u2192 Connect a workspace<\/strong>, select the workspace, choose the primary workspace, review changes, and select\u00a0Connect<\/strong>. This requires the documented combination of Entra\/Azure permissions,\u00a0not<\/em>\u00a0simply Sentinel Reader. [R03]<\/li>\n\n\n\n
                        6. Reopen the Defender portal after provisioning\/connection. Allow for initial tenant provisioning delay; refresh after the admin confirms successful connection.<\/li>\n\n\n\n
                        7. Expand\u00a0Microsoft Sentinel<\/strong>\u00a0and identify\u00a0Configuration<\/strong>,\u00a0Content management<\/strong>, and\u00a0Threat management<\/strong>\u00a0menu groups. Open each without changing anything. In some views, the\u00a0Advanced hunting<\/strong>\u00a0query editor is opened through the connector’s\u00a0Go to log analytics<\/strong>\u00a0shortcut.<\/li>\n\n\n\n
                        8. Explain why a Microsoft Defender XDR\/E5 license is\u00a0not required solely to access Sentinel in the Defender portal<\/strong>, but access to additional Defender XDR data and features depends on separate licensing\/entitlements. [R03]<\/li>\n<\/ol>\n\n\n\n
                          Troubleshooting and gate<\/h3>\n\n\n\n
                          Symptom<\/th>First test<\/th>Next action<\/th><\/tr><\/thead>
                          Workspace missing from Sentinel Add list<\/td>Correct tenant\/subscription\/workspace<\/td>Verify eligibility and provisioner permissions<\/td><\/tr>
                          Sentinel enabled, invisible in Defender<\/td>Check Workspaces<\/strong> under Sentinel settings<\/td>Auto-provisioning delay, then authorized manual connect<\/td><\/tr>
                          Learner sees portal but cannot view incidents\/logs<\/td>Check effective Sentinel\/Defender roles<\/td>Correct specific role scope<\/em> and RBAC as needed<\/td><\/tr>
                          Cannot manually connect<\/td>Check Entra admin role and<\/strong> subscription authorization<\/td>Escalate to onboarding administrator; no blanket Owner grant<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                          PASS gate D1-05:<\/strong> Learner shows a correctly Sentinel-enabled workspace and<\/strong> its association in the Defender portal. If onboarding is instructor-performed, explicitly mark the provisioning portion \u201cobserved\u201d and verify learner read access separately.<\/p>\n\n\n\n
                          D1-L06 \u2014 Install the Azure Activity<\/em> solution from Content hub<\/h2>\n\n\n\n
                          Syllabus:<\/strong> F12 (introduces Day 2 F16). Type:<\/strong> Guided content deployment. Role:<\/strong> Sentinel Contributor. DOC-VERIFIED:<\/strong> [R01], [R08].<\/p>\n\n\n\n
                          Steps<\/h3>\n\n\n\n
                            \n
                          1. In Defender portal, expand\u00a0Microsoft Sentinel \u2192 Content management \u2192 Content hub<\/strong>.<\/li>\n\n\n\n
                          2. Enter\u00a0Azure Activity<\/strong>\u00a0in the search box and run the search.<\/li>\n\n\n\n
                          3. Select the\u00a0Azure Activity<\/strong>\u00a0solution; read its publisher\/provider, description, version\/support information and included types of content.<\/li>\n\n\n\n
                          4. Check whether the solution shows\u00a0Installed<\/strong>,\u00a0Not installed<\/strong>, or an available\u00a0Update<\/strong>. Do not blindly update shared content.<\/li>\n\n\n\n
                          5. If not installed and approved, select\u00a0Install<\/strong>\u00a0(or\u00a0View details \u2192 Create \/ Update<\/strong>, depending on the current Content hub flow).<\/li>\n\n\n\n
                          6. Select the\u00a0approved subscription, RG, and Sentinel workspace<\/strong>\u00a0when the content deployment wizard requires them; confirm the destination is not a different workspace.<\/li>\n\n\n\n
                          7. Review content items, select\u00a0Create\/Install<\/strong>, and wait for a success status.<\/li>\n\n\n\n
                          8. Return to\u00a0Content hub<\/strong>\u00a0and confirm the item reports installed; record its name and version in\u00a0D1-L06-Content-Record.md<\/code>.<\/li>\n\n\n\n
                          9. For learning, identify the difference among\u00a0Solution<\/strong>,\u00a0Data connector<\/strong>,\u00a0Analytics rule template<\/strong>, and\u00a0Workbook template<\/strong>.\u00a0Installing a solution does not itself start all its connectors or schedule all its rules.<\/strong><\/li>\n<\/ol>\n\n\n\n
                            PASS gate D1-06:<\/strong> Azure Activity solution installed in the correct workspace; learner explains why additional connector configuration is required.<\/p>\n\n\n\n
                            Failure paths<\/h3>\n\n\n\n
                              \n
                            • Install disabled:<\/strong>\u00a0inspect Microsoft Sentinel Contributor permission on the appropriate RG.<\/li>\n\n\n\n
                            • Solution not found:<\/strong>\u00a0clear Content hub filters or refine search; check region\/tenant content access.<\/li>\n\n\n\n
                            • Deployment failure:<\/strong>\u00a0open deployment details, record failure code and resource provider\/permission issue; do not guess.<\/li>\n\n\n\n
                            • A similar solution is already installed:<\/strong>\u00a0document and reuse; do not create a duplicate.<\/li>\n<\/ul>\n\n\n\n
                              D1-L07 \u2014 Configure the Azure Activity connector safely<\/h2>\n\n\n\n
                              Syllabus:<\/strong> F12. Type:<\/strong> Approved subscription-level diagnostic export. DOC-VERIFIED:<\/strong> [R01], [R06], [R09].<\/p>\n\n\n\n
                              \n
                              Scope alert:<\/strong> Azure Activity is a subscription\/management control-plane log<\/strong>, not VM Syslog. The typical connector uses the Azure Monitor diagnostic-settings pipeline; the Sentinel connector walkthrough provides an Azure Policy assignment wizard<\/strong>. The policy-based route has a higher permission bar than simply reading Sentinel. Do this only in the preapproved training subscription. Check existing exports first to avoid duplicate data flows.<\/p>\n<\/blockquote>\n\n\n\n
                              Step A \u2014 identify the data source and current state<\/h3>\n\n\n\n
                                \n
                              1. In Defender portal, open\u00a0Microsoft Sentinel \u2192 Configuration \u2192 Data connectors<\/strong>.<\/li>\n\n\n\n
                              2. Search\u00a0Azure Activity<\/strong>, select the connector, and choose\u00a0Open connector page<\/strong>.<\/li>\n\n\n\n
                              3. Read its\u00a0Prerequisites<\/strong>,\u00a0Data types<\/strong>,\u00a0Instructions<\/strong>, and current\u00a0Status<\/strong>. Record whether it is\u00a0Connected<\/code>,\u00a0Not connected<\/code>, or not yet reporting.<\/li>\n\n\n\n
                              4. In Azure portal, check whether the training subscription already exports Activity logs to the intended workspace. Typical route:\u00a0Monitor \u2192 Activity log \u2192 Export Activity Logs<\/strong>; inspect existing diagnostic settings. Alternatively inspect the approved Azure Policy assignment for Activity Log forwarding.<\/li>\n\n\n\n
                              5. If an existing export sends the correct required categories to the\u00a0correct<\/strong>\u00a0workspace,\u00a0reuse and verify<\/strong>, rather than adding another export blindly.<\/li>\n\n\n\n
                              6. If the environment uses the\u00a0legacy<\/strong>\u00a0Activity Log collection method, follow the Microsoft’s documented migration\/disable guidance with the environment owner before enabling a new pipeline. Do not unilaterally disconnect business-critical collection. [R09]<\/li>\n<\/ol>\n\n\n\n
                                Step B \u2014 preferred Microsoft Sentinel connector route (Azure Policy wizard)<\/h3>\n\n\n\n
                                Perform only with an authorized policy assignment owner.<\/strong><\/p>\n\n\n\n
                                  \n
                                1. On the\u00a0Azure Activity<\/strong>\u00a0connector page, choose\u00a0Launch Azure Policy Assignment Wizard<\/strong>.<\/li>\n\n\n\n
                                2. Set assignment\u00a0Scope<\/strong>\u00a0to the instructor-approved subscription containing the benign lab activity. Avoid an entire management group or production subscription.<\/li>\n\n\n\n
                                3. Review the policy identity, exclusions, effects, and any needed remediation\/permissions that the actual wizard shows; involve the policy owner if those prompts appear.<\/li>\n\n\n\n
                                4. Open\u00a0Parameters<\/strong>; set\u00a0Primary Log Analytics workspace<\/strong>\u00a0to the exact workspace from D1-L04.<\/li>\n\n\n\n
                                5. If a non-default policy assignment name is requested, choose a recognizable lab-specific name. Record it and its scope for cleanup.<\/li>\n\n\n\n
                                6. Review assignment details; confirm\u00a0subscription, scope, destination workspace, effect, and approving owner<\/em>.<\/li>\n\n\n\n
                                7. Select\u00a0Review + create \u2192 Create<\/strong>\u00a0only after approval.<\/li>\n\n\n\n
                                8. In\u00a0Azure Policy \u2192 Assignments<\/strong>, locate the new assignment. Record scope, identity\/remediation state, and compliance\/provisioning outcome. Initial policy evaluation\/diagnostic flow can take time.<\/li>\n\n\n\n
                                9. Return to the connector and review status, but do not treat a\u00a0Connected<\/code>\u00a0badge alone as proof that a particular event arrived.<\/li>\n<\/ol>\n\n\n\n
                                  Step C \u2014 approved direct diagnostic-setting alternative<\/h3>\n\n\n\n
                                  Use only if approved by the instructor\/cloud administrator<\/strong> and the standard policy route cannot be used or is not appropriate; do not<\/strong> configure both routes for the same source\/destination without a reason.<\/p>\n\n\n\n
                                    \n
                                  1. In Azure portal, open\u00a0Monitor \u2192 Activity log \u2192 Export Activity Logs<\/strong>.<\/li>\n\n\n\n
                                  2. Select the\u00a0training subscription<\/strong>\u00a0and choose\u00a0Add diagnostic setting<\/strong>.<\/li>\n\n\n\n
                                  3. Give it a descriptive name, e.g.\u00a0diag-sentinel-activity-lab01<\/code>.<\/li>\n\n\n\n
                                  4. Select the\u00a0Administrative<\/strong>\u00a0Activity Log category at a minimum for the group-change exercise; add other categories only when approved by policy and training requirements.<\/li>\n\n\n\n
                                  5. Under destination details, choose\u00a0Send to Log Analytics workspace<\/strong>.<\/li>\n\n\n\n
                                  6. Select the approved\u00a0subscription and the Sentinel-enabled Log Analytics workspace<\/strong>.<\/li>\n\n\n\n
                                  7. Review\u00a0scope, log categories, destination workspace<\/strong>, then\u00a0Save<\/strong>. Record the exact diagnostic setting name and owner for teardown.<\/li>\n\n\n\n
                                  8. Return to the training subscription’s\u00a0Activity log<\/strong>, confirm there are recent administrative events, then use D1-L08 to verify they also reach\u00a0AzureActivity<\/code>\u00a0in the destination workspace.<\/li>\n<\/ol>\n\n\n\n
                                    Important:<\/strong> Direct diagnostic configuration and policy-managed settings are two documented mechanisms with different administrative routes. The approved approach is determined by the instructor\/environment owner, not by convenience. [R06], [R09]<\/p>\n\n\n\n
                                    PASS gate D1-07<\/h3>\n\n\n\n
                                      \n
                                    • [ ] Documented connector method and approver.<\/li>\n\n\n\n
                                    • [ ] Approved source subscription\/scope.<\/li>\n\n\n\n
                                    • [ ] Correct destination Log Analytics workspace.<\/li>\n\n\n\n
                                    • [ ] Export\/policy config exists with no accidental duplicate export.<\/li>\n\n\n\n
                                    • [ ] No production resources or unrelated subscriptions changed.<\/li>\n\n\n\n
                                    • [ ] Named cleanup owner and configuration ID recorded.<\/li>\n<\/ul>\n\n\n\n
                                      Status distinction:<\/strong> This passes configuration<\/strong>. The separate D1-L08 telemetry proof is mandatory for ingestion<\/strong>.<\/p>\n\n\n\n
                                      D1-L08 \u2014 Generate harmless activity and prove first data ingestion<\/h2>\n\n\n\n
                                      Syllabus:<\/strong> F12. Type:<\/strong> Live controlled activity. DOC-VERIFIED:<\/strong> Azure Activity logs, destination table and official quickstart [R01], [R06], [R10].<\/p>\n\n\n\n
                                      Why this lab is necessary<\/h3>\n\n\n\n
                                      A configured connector<\/strong> and a working rule template<\/strong> are not the same as telemetry arriving in a particular workspace. Conversely, a rule being enabled<\/strong> does not mean it has found an event or created an alert. We verify each distinct boundary.<\/p>\n\n\n\n
                                      Step A \u2014 create an approved, non-disruptive Azure change<\/h3>\n\n\n\n
                                        \n
                                      1. Wait for the instructor to confirm the diagnostic export is active or no provisioning blockers remain.<\/li>\n\n\n\n
                                      2. In Azure portal, open\u00a0Resource groups \u2192 Create<\/strong>.<\/li>\n\n\n\n
                                      3. Select the\u00a0training subscription<\/strong>; enter the unique activity group name, e.g.\u00a0rg-sentinel-signal-lab01<\/code>.<\/li>\n\n\n\n
                                      4. Choose the approved region and add tags such as\u00a0purpose=sentinel-foundations-lab<\/code>,\u00a0owner=training<\/code>, and\u00a0cleanup=required<\/code>\u00a0if the portal requests tags or after creation.<\/li>\n\n\n\n
                                      5. Select\u00a0Review + create \u2192 Create<\/strong>. Only create this empty RG; do not deploy a VM, firewall, storage account, or additional paid service.<\/li>\n\n\n\n
                                      6. Open the new signal RG, go to\u00a0Tags<\/strong>, add or update\u00a0exercise=D1-L08<\/code>, and\u00a0Save<\/strong>. This creates another harmless resource-management operation.<\/li>\n\n\n\n
                                      7. Open\u00a0Monitor \u2192 Activity log<\/strong>\u00a0in Azure portal. Set scope\/subscription\/time window to include your changes; filter the resource group or resource ID, if available. Record the observed operation name, status, timestamp\u00a0in UTC<\/strong>, and resource ID. This is the\u00a0source-side<\/strong>\u00a0proof.<\/li>\n\n\n\n
                                      8. Note the actual event’s\u00a0ResourceGroup<\/strong>\u00a0value might be blank or differ for subscription\/RG-level operations; use\u00a0ResourceId<\/strong>\u00a0as a cross-check rather than demanding a populated\u00a0ResourceGroup<\/code>\u00a0field.<\/li>\n<\/ol>\n\n\n\n
                                        Step B \u2014 query the Sentinel-enabled destination<\/h3>\n\n\n\n
                                          \n
                                        1. In Defender portal, select\u00a0Microsoft Sentinel \u2192 Configuration \u2192 Data connectors \u2192 Azure Activity \u2192 Open connector page<\/strong>.<\/li>\n\n\n\n
                                        2. Review connector status, then select\u00a0Go to log analytics<\/strong>\u00a0(the official quickstart may open the\u00a0Advanced hunting<\/strong>\u00a0editor). You can instead open the approved Log Analytics workspace’s\u00a0Logs<\/strong>\u00a0experience if your tenant supports that route.<\/li>\n\n\n\n
                                        3. If the editor presents a table\/workspace scope selector, confirm the\u00a0intended Sentinel workspace<\/strong>. Do not assume default scope.<\/li>\n\n\n\n
                                        4. Start with the shortest possible query:<\/li>\n<\/ol>\n\n\n\n
                                          AzureActivity\n| where TimeGenerated >= ago(24h)\n| take 20\n<\/code><\/pre>\n\n\n\n
                                            \n
                                          1. Select\u00a0Run<\/strong>. If rows are returned, inspect\u00a0TimeGenerated<\/strong>,\u00a0CategoryValue<\/strong>,\u00a0OperationNameValue<\/strong>,\u00a0ActivityStatusValue<\/strong>,\u00a0ResourceId<\/strong>,\u00a0ResourceGroup<\/strong>,\u00a0CorrelationId<\/strong>, and\u00a0Caller<\/strong>\u00a0where populated.<\/li>\n\n\n\n
                                          2. Narrow to the unique signal RG by replacing the sample string:<\/li>\n<\/ol>\n\n\n\n
                                            let signalGroup = \"rg-sentinel-signal-lab01\";\nAzureActivity\n| where TimeGenerated >= ago(24h)\n| where ResourceId contains signalGroup or ResourceGroup contains signalGroup\n| project TimeGenerated, CategoryValue, OperationNameValue,\n          ActivityStatusValue, ResourceGroup, ResourceId,\n          Caller, CorrelationId\n| sort by TimeGenerated desc\n<\/code><\/pre>\n\n\n\n
                                              \n
                                            1. Compare one record with the earlier\u00a0source-side Activity log<\/strong>: resource ID, operation, timestamp, status, and (when present) CorrelationId. Timestamps may differ slightly between event occurrence and ingestion availability; do not require exact arrival instant.<\/li>\n\n\n\n
                                            2. Save query text in the evidence folder and capture\u00a0D1-L08-Sentinel-AzureActivity-Result.png<\/code>.<\/li>\n\n\n\n
                                            3. If the result contains no rows, continue the diagnostic ladder below;\u00a0never fabricate a screenshot or claim the connector worked.<\/strong><\/li>\n<\/ol>\n\n\n\n
                                              Diagnostic ladder: source \u2192 export \u2192 destination \u2192 query<\/strong><\/h3>\n\n\n\n
                                                \n
                                              1. Source:<\/strong>\u00a0Does Azure portal\u00a0Activity log<\/strong>\u00a0display the actual benign RG action? If no, check subscription\/time filters and whether the operation succeeded.<\/li>\n\n\n\n
                                              2. Export:<\/strong>\u00a0Is the diagnostic setting\/policy assigned to the correct\u00a0subscription<\/em>\u00a0and correct\u00a0workspace<\/em>? Check deployment, policy compliance\/remediation and existing settings.<\/li>\n\n\n\n
                                              3. Delay:<\/strong>\u00a0Microsoft notes that diagnostic-export initiation can take on the order of\u00a0tens of minutes<\/strong>\u00a0(their troubleshooting guide cites around 30 minutes in a common export scenario). Wait within the instructor’s authorized lab window and recheck; never promise instantaneous arrival. [R11]<\/li>\n\n\n\n
                                              4. Destination:<\/strong>\u00a0Run an unfiltered\u00a0AzureActivity | where TimeGenerated >= ago(48h) | count<\/code>\u00a0against the\u00a0correct<\/em>\u00a0workspace. If there are no records, investigate pipeline setup before fine-tuning KQL.<\/li>\n\n\n\n
                                              5. Filter:<\/strong>\u00a0Remove\u00a0ResourceGroup<\/code>\u00a0filtering; use\u00a0ResourceId<\/code>, broaden time, compare casing and source event structure. Microsoft documents case differences across Activity Log fields; prefer case-insensitive operators. [R06]<\/li>\n\n\n\n
                                              6. Rights:<\/strong>\u00a0A query access error is not the same as no telemetry; verify workspace read\/query privileges.<\/li>\n<\/ol>\n\n\n\n
                                                PASS gate D1-08<\/h3>\n\n\n\n
                                                At minimum:<\/strong> Show an actual Azure portal Activity log event and<\/strong> corresponding AzureActivity record in the intended Log Analytics workspace, or record a genuine BLOCKED<\/strong> outcome with the first failing boundary. Preserve source evidence, destination query, recorded UTC timestamps and sample resource identifier<\/em>. This ends Day 1’s technical progression gate.<\/p>\n\n\n\n
                                                Day 1 completion check<\/h3>\n\n\n\n
                                                  \n
                                                • [ ] D1-L01 5W1H + SOC roles + alternatives.<\/li>\n\n\n\n
                                                • [ ] D1-L02 architecture explanation.<\/li>\n\n\n\n
                                                • [ ] D1-L03 safe tenant\/subscription\/RBAC\/cost preflight.<\/li>\n\n\n\n
                                                • [ ] D1-L04 workspace proof.<\/li>\n\n\n\n
                                                • [ ] D1-L05 Sentinel\/Defender proof.<\/li>\n\n\n\n
                                                • [ ] D1-L06 Azure Activity solution proof.<\/li>\n\n\n\n
                                                • [ ] D1-L07 authorized export proof.<\/li>\n\n\n\n
                                                • [ ] D1-L08 matching source and ingested record, or clearly documented blocker.<\/li>\n<\/ul>\n\n\n\n
                                                  \n\n\n\n
                                                  DAY 2 \u2014 Log Analysis, Detection, Incidents, Workbooks, and Assessment<\/h1>\n\n\n\n
                                                  Day 2 entry requirements:<\/strong> Learner has completed Day 1’s conceptual exercises and can access a Sentinel-enabled workspace. The instructor has produced or approved a real AzureActivity<\/code> event<\/strong> for the live branch. If not, start with D2-L03’s simulated KQL branch and record any live tasks as BLOCKED<\/strong> until the source is repaired.<\/p>\n\n\n\n
                                                  D2-L01 \u2014 Inspect real security records and explain the schema<\/h2>\n\n\n\n
                                                  Syllabus:<\/strong> F13, F15. Type:<\/strong> Live read-only log analysis.
                                                  Prerequisites:<\/strong> D1-L08, permission to query the intended workspace.
                                                  Deliverable:<\/strong> Day02\/D2-L01-Record-Worksheet.md<\/code>. Reference:<\/strong> [R10].<\/p>\n\n\n\n
                                                  Guided steps<\/h3>\n\n\n\n
                                                    \n
                                                  1. Open Defender portal and navigate to the\u00a0Azure Activity connector<\/strong>, then select\u00a0Go to log analytics<\/strong>, or go to the workspace’s\u00a0Logs<\/strong>\u00a0editor as approved by the instructor.<\/li>\n\n\n\n
                                                  2. Confirm tenant, workspace\/data scope, and time window. Use\u00a0Last 24 hours<\/strong>\u00a0first, then broaden if your approved signal is older.<\/li>\n\n\n\n
                                                  3. Run:<\/li>\n<\/ol>\n\n\n\n
                                                    AzureActivity\n| where TimeGenerated >= ago(24h)\n| sort by TimeGenerated desc\n| take 20\n<\/code><\/pre>\n\n\n\n
                                                      \n
                                                    1. Open one record and inspect every column available. Compare the actual schema with the reference fields in [R10]. Do not assume that all optional values are populated.<\/li>\n\n\n\n
                                                    2. For one\u00a0known lab action<\/strong>, note the following:<\/li>\n<\/ol>\n\n\n\n
                                                      Question<\/th>Field to inspect<\/th>Learner finding<\/th><\/tr><\/thead>
                                                      When did it occur?<\/td>TimeGenerated<\/code> (UTC)<\/td>__________<\/td><\/tr>
                                                      Which operation occurred?<\/td>OperationNameValue<\/code><\/td>__________<\/td><\/tr>
                                                      Was it successful?<\/td>ActivityStatusValue<\/code><\/td>__________<\/td><\/tr>
                                                      Which resource was affected?<\/td>ResourceId<\/code><\/td>__________<\/td><\/tr>
                                                      Which subscription?<\/td>SubscriptionId<\/code><\/td>__________<\/td><\/tr>
                                                      Which resource group?<\/td>ResourceGroup<\/code> (may be empty for scope-level operations)<\/td>__________<\/td><\/tr>
                                                      Who made the request?<\/td>Caller<\/code> (may be UPN\/service principal identifier\/GUID)<\/td>__________<\/td><\/tr>
                                                      Which related operation group?<\/td>CorrelationId<\/code><\/td>__________<\/td><\/tr>
                                                      Which category?<\/td>CategoryValue<\/code><\/td>__________<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                        \n
                                                      1. Compare\u00a0TimeGenerated<\/strong>\u00a0to\u00a0EventSubmissionTimestamp<\/strong>\u00a0when the latter is populated. Explain event occurrence versus availability\/submission;\u00a0do not<\/strong>\u00a0treat these as guaranteed-identical timestamps.<\/li>\n\n\n\n
                                                      2. Explain the difference between an\u00a0empty field<\/strong>, a\u00a0missing field<\/strong>,\u00a0zero records<\/strong>, a\u00a0failed query<\/strong>, and a\u00a0valid query with no matching events<\/strong>.<\/li>\n\n\n\n
                                                      3. Open the raw Azure portal\u00a0Activity log<\/strong>\u00a0for the same test resource and look for corroborating evidence. Compare one non-secret identifier and the timeline.<\/li>\n\n\n\n
                                                      4. Capture query results with the table headers visible.<\/li>\n<\/ol>\n\n\n\n
                                                        PASS gate D2-01:<\/strong> Learner correctly identifies one real action, its timestamp, actor or actor identifier, resource, result, and scope. They can explain why a blank ResourceGroup<\/code> field does not necessarily mean the record is invalid.<\/p>\n\n\n\n
                                                        D2-L02 \u2014 Complete KQL essentials laboratory (real data)<\/h2>\n\n\n\n
                                                        Syllabus:<\/strong> F14\u2013F15. Type:<\/strong> Live KQL. Outcome:<\/strong> Independently operate where<\/code>, project<\/code>, take<\/code>, sort<\/code>, count<\/code>, summarize<\/code>, and bin<\/code>. Reference:<\/strong> [R12], [R10].<\/p>\n\n\n\n
                                                        \n
                                                        Execution rule:<\/strong> Run queries one at a time<\/strong>. First make sure the appropriate source workspace is in scope. Queries operate on your training records: exact row counts and actor names will vary and are not<\/em> prescribed answer values.<\/p>\n<\/blockquote>\n\n\n\n
                                                        Exercise K01 \u2014 Prove the table can be queried<\/h3>\n\n\n\n
                                                        AzureActivity\n| take 10\n<\/code><\/pre>\n\n\n\n
                                                        Observe:<\/strong> A sample of records, provided the table exists and contains data in the selected time range. Check:<\/strong> Results are not a substitute for recording the workspace\/time filter.<\/p>\n\n\n\n
                                                        Exercise K02 \u2014 Count events in a 24-hour lookback<\/h3>\n\n\n\n
                                                        AzureActivity\n| where TimeGenerated >= ago(24h)\n| count\n<\/code><\/pre>\n\n\n\n
                                                        Observe:<\/strong> One numerical row. A count of zero is a valid query result and requires source\/time investigation, not a syntax correction.<\/p>\n\n\n\n
                                                        Exercise K03 \u2014 Project only investigation-relevant fields<\/h3>\n\n\n\n
                                                        AzureActivity\n| where TimeGenerated >= ago(24h)\n| project TimeGenerated, Caller, OperationNameValue,\n          ActivityStatusValue, ResourceId\n| take 30\n<\/code><\/pre>\n\n\n\n
                                                        Observe:<\/strong> Five columns (some values may be blank); explain why project<\/code> improves readability.<\/p>\n\n\n\n
                                                        Exercise K04 \u2014 Sort latest changes first<\/h3>\n\n\n\n
                                                        AzureActivity\n| where TimeGenerated >= ago(24h)\n| project TimeGenerated, OperationNameValue, ResourceId\n| sort by TimeGenerated desc\n| take 20\n<\/code><\/pre>\n\n\n\n
                                                        Observe:<\/strong> Descending UTC event times; most recent first.<\/p>\n\n\n\n
                                                        Exercise K05 \u2014 Administrative events only<\/h3>\n\n\n\n
                                                        AzureActivity\n| where TimeGenerated >= ago(24h)\n| where CategoryValue =~ \"Administrative\"\n| project TimeGenerated, CategoryValue, OperationNameValue,\n          ActivityStatusValue\n| sort by TimeGenerated desc\n<\/code><\/pre>\n\n\n\n
                                                        Observe:<\/strong> Only matching category values. =~<\/code> means case-insensitive equality for strings.<\/p>\n\n\n\n
                                                        Exercise K06 \u2014 Filter specifically to your safe lab resource<\/h3>\n\n\n\n
                                                        let signalGroup = \"rg-sentinel-signal-lab01\";  \/\/ Replace with your actual name.\nAzureActivity\n| where TimeGenerated >= ago(48h)\n| where ResourceId contains signalGroup or ResourceGroup contains signalGroup\n| project TimeGenerated, OperationNameValue, ActivityStatusValue,\n          ResourceGroup, ResourceId, CorrelationId\n| sort by TimeGenerated desc\n<\/code><\/pre>\n\n\n\n
                                                        Observe:<\/strong> Records related to the unique lab RG. If empty:<\/strong> inspect the broad unfiltered table query first; the RG name could differ, the signal could be older, or the connector could be misconfigured.<\/p>\n\n\n\n
                                                        Exercise K07 \u2014 Number of events per operation<\/h3>\n\n\n\n
                                                        AzureActivity\n| where TimeGenerated >= ago(24h)\n| summarize Events = count() by OperationNameValue\n| sort by Events desc\n<\/code><\/pre>\n\n\n\n
                                                        Observe:<\/strong> One row per distinct operation and a count. Explain the difference between events<\/em> and unique operations<\/em>.<\/p>\n\n\n\n
                                                        Exercise K08 \u2014 Number of operations by status<\/h3>\n\n\n\n
                                                        AzureActivity\n| where TimeGenerated >= ago(24h)\n| summarize Events = count() by ActivityStatusValue\n| sort by Events desc\n<\/code><\/pre>\n\n\n\n
                                                        Observe:<\/strong> A status distribution; discuss why an operation can generate records in different states and why you should not label all failures as attacks.<\/p>\n\n\n\n
                                                        Exercise K09 \u2014 Visualize basic activity over time<\/h3>\n\n\n\n
                                                        AzureActivity\n| where TimeGenerated >= ago(24h)\n| summarize Events = count() by bin(TimeGenerated, 1h)\n| sort by TimeGenerated asc\n<\/code><\/pre>\n\n\n\n
                                                        Observe:<\/strong> Time-bucketed records. In a Logs editor that offers a chart view, choose an appropriate line\/column visualization. If the chart isn’t available in the current editor, the returned table is still valid evidence.<\/p>\n\n\n\n
                                                        Exercise K10 \u2014 Summarize unique actors (if present)<\/h3>\n\n\n\n
                                                        AzureActivity\n| where TimeGenerated >= ago(24h)\n| where isnotempty(Caller)\n| summarize Events = count() by Caller\n| sort by Events desc\n| take 20\n<\/code><\/pre>\n\n\n\n
                                                        Observe:<\/strong> Top identified callers. Be cautious: a Caller<\/code> may be a GUID or service principal, not necessarily a human username.<\/p>\n\n\n\n
                                                        Exercise K11 \u2014 Find recent failed administrative operations<\/h3>\n\n\n\n
                                                        AzureActivity\n| where TimeGenerated >= ago(48h)\n| where CategoryValue =~ \"Administrative\"\n| where ActivityStatusValue =~ \"Failed\"\n| project TimeGenerated, OperationNameValue, Caller,\n          ResourceId, ActivitySubstatusValue\n| sort by TimeGenerated desc\n<\/code><\/pre>\n\n\n\n
                                                        Observe:<\/strong> A valid empty result is acceptable. Do not invent failed operations. Discuss least-privilege and operational causes versus threats.<\/p>\n\n\n\n
                                                        Exercise K12 \u2014 Build a concise daily SOC summary<\/h3>\n\n\n\n
                                                        AzureActivity\n| where TimeGenerated >= ago(7d)\n| summarize Events = count(),\n            LastObserved = max(TimeGenerated)\n  by CategoryValue\n| sort by Events desc\n<\/code><\/pre>\n\n\n\n
                                                        Observe:<\/strong> A compact category-level view; no table joins or advanced functions required.<\/p>\n\n\n\n
                                                        Troubleshooting experiment (mandatory)<\/h3>\n\n\n\n
                                                          \n
                                                        1. Change the K02 window from\u00a0ago(24h)<\/code>\u00a0to\u00a0ago(5m)<\/code>\u00a0and compare counts.<\/li>\n\n\n\n
                                                        2. Change K06’s\u00a0signalGroup<\/code>\u00a0to a deliberately wrong lab name. Observe\u00a0zero results<\/strong>.<\/li>\n\n\n\n
                                                        3. Restore the right name and a sufficiently broad time range. Confirm that records return.<\/li>\n\n\n\n
                                                        4. Explain in plain English why\u00a0the first empty result<\/em>\u00a0is\u00a0not<\/strong>\u00a0an ingestion failure.<\/li>\n\n\n\n
                                                        5. Save your best five queries as plain\u00a0.kql<\/code>\u00a0or\u00a0.txt<\/code>\u00a0files, along with the observed record counts and UTC execution times.<\/li>\n<\/ol>\n\n\n\n
                                                          PASS gate D2-02:<\/strong> Learner executes K02, K03, K05, K07 and K09 successfully, explains the pipeline table | filter | project\/summarize | sort<\/code>, and diagnoses the intentionally empty KQL filter. Extra credit:<\/strong> all K01\u2013K12.<\/p>\n\n\n\n
                                                          D2-L03 \u2014 Synthetic KQL laboratory (when no real data is permitted)<\/h2>\n\n\n\n
                                                          Syllabus:<\/strong> F14. Type:<\/strong> SIMULATED only<\/strong>, not a replacement for ingestion\/incident pass gates.<\/p>\n\n\n\n
                                                          Exercise S01 \u2014 Seed fictional table rows in the query engine<\/h3>\n\n\n\n
                                                          Paste the complete query below into an environment that supports Kusto datatable<\/code>:<\/p>\n\n\n\n
                                                          \/\/ SIMULATION: Rows exist only during this query; nothing is ingested.\ndatatable(Actor:string, Action:string, Result:string)\n[\n    \"admin1@aster.example\", \"CreateResourceGroup\", \"Succeeded\",\n    \"admin2@aster.example\", \"UpdateTags\", \"Succeeded\",\n    \"admin3@aster.example\", \"DeleteResourceGroup\", \"Failed\",\n    \"admin1@aster.example\", \"UpdateTags\", \"Succeeded\"\n]\n| extend TimeGenerated = ago(5m)\n| project TimeGenerated, Actor, Action, Result\n<\/code><\/pre>\n\n\n\n
                                                          Expected:<\/strong> Four fictional rows; all timestamps are relative to the query run. They represent no real Azure operation<\/strong>, cannot be queried in AzureActivity<\/code>, and cannot by themselves produce a genuine Sentinel analytic-rule alert.<\/p>\n\n\n\n
                                                          Exercise S02 \u2014 Summarize the same fictional events<\/h3>\n\n\n\n
                                                          let LabEvents = datatable(Actor:string, Action:string, Result:string)\n[\n    \"admin1@aster.example\", \"CreateResourceGroup\", \"Succeeded\",\n    \"admin2@aster.example\", \"UpdateTags\", \"Succeeded\",\n    \"admin3@aster.example\", \"DeleteResourceGroup\", \"Failed\",\n    \"admin1@aster.example\", \"UpdateTags\", \"Succeeded\"\n];\nLabEvents\n| where Result =~ \"Succeeded\"\n| summarize Events = count() by Actor\n| sort by Events desc\n<\/code><\/pre>\n\n\n\n
                                                          Expected:<\/strong> admin1@aster.example<\/code> \u2192 2 and admin2@aster.example<\/code> \u2192 1. The failed record is excluded. Do not<\/strong> import fictional @aster.example<\/code> accounts into a real watchlist, Entra ID or production workspace.<\/p>\n\n\n\n
                                                          Exercise S03 \u2014 Brief written interpretation<\/h3>\n\n\n\n
                                                            \n
                                                          1. Why did the count decrease from four total records to three successful ones?<\/li>\n\n\n\n
                                                          2. Why is this exercise\u00a0not<\/strong>\u00a0proof that a data connector works?<\/li>\n\n\n\n
                                                          3. What missing evidence would be required before recording the Day 1 ingestion gate as PASS?<\/li>\n\n\n\n
                                                          4. Why must you not call these fictional records a confirmed security incident?<\/li>\n<\/ol>\n\n\n\n
                                                            SIMULATED gate D2-03:<\/strong> Learner gets expected S02 counts and labels the output as SIMULATED \u2014 NO AZURE INGESTION, NO INCIDENT<\/code>.<\/p>\n\n\n\n
                                                            D2-L04 \u2014 Explore built-in content and deploy a starter rule template<\/h2>\n\n\n\n
                                                            Syllabus:<\/strong> F16, F17. Type:<\/strong> Live content\/rule exercise. Prerequisites:<\/strong> Azure Activity solution installed; Sentinel Contributor at required scope; inspect source data. DOC-VERIFIED:<\/strong> [R01], [R08], [R14].<\/p>\n\n\n\n
                                                            First: understand installed content versus active detection<\/h3>\n\n\n\n
                                                            Object<\/th>What exists after installation?<\/th>What must you still do?<\/th><\/tr><\/thead>
                                                            Content Hub solution<\/strong><\/td>Package of content definitions<\/td>Review requirements and configure included components<\/td><\/tr>
                                                            Data connector<\/strong><\/td>Integration instructions\/connector instance<\/td>Authorize export\/connection and verify telemetry<\/td><\/tr>
                                                            Analytics rule template<\/strong><\/td>Reusable starting query\/settings<\/td>Create and enable an active rule, with available data sources<\/td><\/tr>
                                                            Active scheduled rule<\/strong><\/td>Scheduled analytic evaluation<\/td>Wait for matching data and execution; verify alert\/incident<\/td><\/tr>
                                                            Workbook template<\/strong><\/td>Reusable dashboard definition<\/td>Satisfy data-source prerequisites and open or save it<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                            Step A \u2014 locate a Microsoft-documented starter example<\/h3>\n\n\n\n
                                                              \n
                                                            1. In Defender portal, expand\u00a0Microsoft Sentinel \u2192 Content management \u2192 Content hub<\/strong>.<\/li>\n\n\n\n
                                                            2. Locate the installed\u00a0Azure Activity<\/strong>\u00a0solution. Expand it and inspect the available detection content.<\/li>\n\n\n\n
                                                            3. Find\u00a0Suspicious Resource deployment<\/strong>, which is named in the official onboarding quickstart as an example rule template. [R01]<\/li>\n\n\n\n
                                                            4. Verify this rule’s\u00a0required data sources<\/strong>\u00a0are available. The Defender\u00a0Analytics \u2192 Rule templates<\/strong>\u00a0view also shows prerequisite availability; if it reports missing data, investigate before enabling.<\/li>\n\n\n\n
                                                            5. Read the rule’s\u00a0name, description, KQL, scheduling window, result threshold, and severity<\/em>. Ask:\u00a0What exact activity would match this rule?<\/strong><\/li>\n\n\n\n
                                                            6. Explain why the lab’s harmless\u00a0UpdateTags<\/code>\u00a0action might\u00a0not<\/em>\u00a0match a suspicious resource-deployment template.\u00a0Do not promise that enabling it will create a test incident.<\/strong><\/li>\n<\/ol>\n\n\n\n
                                                              Step B \u2014 create the rule from its template (only in isolated lab)<\/h3>\n\n\n\n
                                                                \n
                                                              1. Open\u00a0Microsoft Sentinel \u2192 Configuration \u2192 Analytics<\/strong>.<\/li>\n\n\n\n
                                                              2. Select the\u00a0Rule templates<\/strong>\u00a0tab, filter to\u00a0Scheduled<\/strong>\u00a0if useful.<\/li>\n\n\n\n
                                                              3. Find the intended template (for example\u00a0Suspicious Resource deployment<\/strong>) and inspect source compatibility.<\/li>\n\n\n\n
                                                              4. Select\u00a0Create rule<\/strong>. If disabled, stop and record the exact missing prerequisite; do not blindly install unrelated connectors or licenses.<\/li>\n\n\n\n
                                                              5. The wizard loads the template defaults. On\u00a0General<\/strong>, set the enabled state appropriate to your instructor’s safe lab; leave the severity and query intact unless specifically approved.<\/li>\n\n\n\n
                                                              6. On\u00a0Set rule logic<\/strong>, verify query syntax, workspace tables, scheduling,\u00a0Results simulation<\/strong>\u00a0(if available), and match conditions. A simulated result graph is not an actual alert.<\/li>\n\n\n\n
                                                              7. On\u00a0Incident settings<\/strong>, confirm\u00a0Create incidents from alerts triggered by this analytics rule<\/strong>\u00a0remains enabled when the intent is end-to-end detection. Defender’s incident correlation may later group alerts differently than a simple \u201cone alert equals one incident\u201d assumption. [R15]<\/li>\n\n\n\n
                                                              8. On\u00a0Automated responses<\/strong>, do\u00a0not<\/strong>\u00a0add playbooks, disruptive actions, or incident-wide automation for this foundation exercise.<\/li>\n\n\n\n
                                                              9. Select\u00a0Review and create<\/strong>; confirm\u00a0Validation passed<\/strong>, then\u00a0Create<\/strong>.<\/li>\n\n\n\n
                                                              10. Return to\u00a0Analytics \u2192 Active rules<\/strong>. Find the new active rule, record name, status, source template, run interval\/lookback, and creator.<\/li>\n<\/ol>\n\n\n\n
                                                                Step C \u2014 check and document actual behavior<\/h3>\n\n\n\n
                                                                  \n
                                                                1. Check\u00a0Microsoft Sentinel \u2192 Configuration \u2192 Analytics \u2192 Active rules<\/strong>\u00a0to verify the rule exists and is enabled.<\/li>\n\n\n\n
                                                                2. Search the appropriate\u00a0Incidents & alerts<\/strong>\u00a0queue for activity associated with that rule over the allowed lab window.<\/li>\n\n\n\n
                                                                3. If\u00a0zero alerts<\/strong>\u00a0appear, explain whether the template query returned no matching events, is waiting for its scheduled run, has source prerequisites missing, or generated an alert correlated into an existing incident.<\/li>\n\n\n\n
                                                                4. Save a copy or screenshot of the\u00a0rule query and the observed results<\/strong>. Record\u00a0ACTIVE RULE = YES<\/code>\u00a0separately from\u00a0ACTUAL ALERT OBSERVED = YES\/NO<\/code>.<\/li>\n\n\n\n
                                                                5. Keep the template only if required by the next step; otherwise disable the lab instance at the end of the exercise to avoid background monitoring in a shared workspace.<\/li>\n<\/ol>\n\n\n\n
                                                                  PASS gate D2-04:<\/strong> Learner demonstrates the template’s existence, prerequisites, configured active scheduled rule, and validation status<\/strong>. An incident is not<\/strong> assumed. If this template cannot be created due to tenant content\/source restrictions, document the blocker and move to D2-L05 with instructor approval.<\/p>\n\n\n\n
                                                                  D2-L05 \u2014 Prove event \u2192 rule \u2192 alert \u2192 incident using an approved controlled rule<\/h2>\n\n\n\n
                                                                  Syllabus:<\/strong> F17\u2013F18. Type:<\/strong> Fallback end-to-end demonstration only if needed<\/strong>. Prerequisites:<\/strong> Actual AzureActivity<\/code> records, approved instructor, Sentinel Contributor. DOC-VERIFIED:<\/strong> [R15].<\/p>\n\n\n\n
                                                                  \n
                                                                  Security intent:<\/strong> This short-lived beginner rule detects your uniquely named training resource group<\/strong>, not suspicious enterprise behavior. It deliberately has low severity and is disabled\/deleted after use. It is not a production security detection<\/strong> and is not an invitation to develop attack simulation playbooks.<\/p>\n<\/blockquote>\n\n\n\n
                                                                  Phase 1 \u2014 prove the query can find only your approved lab activity<\/em><\/h3>\n\n\n\n
                                                                    \n
                                                                  1. Have the instructor confirm the signal RG name is unique, under the training subscription, and safely modifiable.<\/li>\n\n\n\n
                                                                  2. From Azure portal, add or update a benign\u00a0tag<\/strong>\u00a0on\u00a0rg-sentinel-signal-lab01<\/code>\u00a0(for example\u00a0exercise=D2-L05<\/code>). This refreshes a legitimate, low-risk Azure Activity record.<\/li>\n\n\n\n
                                                                  3. Check source\u00a0Activity log<\/strong>\u00a0to confirm the tag\/update action exists. If the tag change produces no relevant AzureActivity record yet, wait for export and verify the destination first.<\/li>\n\n\n\n
                                                                  4. Run this KQL in the\u00a0real Sentinel workspace<\/strong>, replacing both placeholders. Do not run with placeholders left intact:<\/li>\n<\/ol>\n\n\n\n
                                                                    let labRG = \"rg-sentinel-signal-lab01\"; \/\/ Replace with actual signal RG.\nlet labSubscription = \"00000000-0000-0000-0000-000000000000\"; \/\/ Replace.\nAzureActivity\n| where TimeGenerated >= ago(2h)\n| where SubscriptionId =~ labSubscription\n| where CategoryValue =~ \"Administrative\"\n| where ResourceId contains labRG or ResourceGroup contains labRG\n| project TimeGenerated, Caller, ResourceId, ResourceGroup,\n          OperationNameValue, ActivityStatusValue, CorrelationId\n| sort by TimeGenerated desc\n<\/code><\/pre>\n\n\n\n
                                                                      \n
                                                                    1. Confirm at least\u00a0one row<\/strong>, matching your approved subscription\/RG. If\u00a0zero<\/strong>\u00a0rows, stop and repair source\/connector\/time filters first. A rule that can never match cannot prove alert generation.<\/li>\n\n\n\n
                                                                    2. Save the query as\u00a0D2-L05-Lab-Rule-Query.kql<\/code>\u00a0and evidence of at least one real matched row.<\/li>\n<\/ol>\n\n\n\n
                                                                      Phase 2 \u2014 create the temporary scheduled rule<\/h3>\n\n\n\n
                                                                        \n
                                                                      1. In the Defender portal open\u00a0Microsoft Sentinel \u2192 Configuration \u2192 Analytics \u2192 + Create \u2192 Scheduled query rule<\/strong>.<\/li>\n\n\n\n
                                                                      2. Enter\u00a0Name<\/strong>:\u00a0LAB01 - Approved Azure Activity Test<\/code>\u00a0(use your unique ID). Add a description such as\u00a0TRAINING ONLY. Detects approved tag or group changes on lab RG; disable after assessment.<\/code><\/li>\n\n\n\n
                                                                      3. Set\u00a0Severity = Low<\/strong>\u00a0or\u00a0Informational<\/strong>\u00a0as the instructor approves. Leave threat-technique mapping unset if the activity does not truthfully represent a MITRE ATT&CK technique.<\/li>\n\n\n\n
                                                                      4. Set\u00a0Status = Enabled<\/strong>\u00a0and start automatically, unless the instructor wants the learner to enable it only after a final review.<\/li>\n\n\n\n
                                                                      5. In\u00a0Set rule logic<\/strong>, paste the\u00a0tested<\/strong>\u00a0KQL. Retain\u00a0TimeGenerated<\/code>\u00a0in its output; Microsoft’s scheduled-rule documentation specifically requires it for lookback evaluation. [R15]<\/li>\n\n\n\n
                                                                      6. Under\u00a0Query scheduling<\/strong>, use\u00a0Run query every = 5 minutes<\/strong>\u00a0and\u00a0Lookup data from the last = 2 hours<\/strong>, a valid documented interval\/lookback pair. These values are a practical\u00a0lab configuration<\/strong>, not a recommended production default.<\/li>\n\n\n\n
                                                                      7. Under\u00a0Alert threshold<\/strong>, choose\u00a0Number of query results is greater than 0<\/strong>, so a real matching row can produce an alert.<\/li>\n\n\n\n
                                                                      8. Under\u00a0Event grouping<\/strong>, choose\u00a0Group all events into a single alert<\/strong>\u00a0for the initial demonstration.<\/li>\n\n\n\n
                                                                      9. Under the option for\u00a0stopping the query after an alert is generated<\/strong>, enable a finite suppression period (for example\u00a01 hour<\/strong>)\u00a0if supported<\/strong>; this limits a flood of repeated classroom alerts. If that option is unavailable, disable the rule promptly after first alert evidence, and monitor for duplicates.<\/li>\n\n\n\n
                                                                      10. Select\u00a0Test with current data \/ Results simulation<\/strong>\u00a0when present.\u00a0Expected:<\/strong>\u00a0A matching period is indicated if the recent test event fits the scheduling settings; this is still\u00a0not<\/strong>\u00a0a production alert.<\/li>\n\n\n\n
                                                                      11. Under\u00a0Incident settings<\/strong>, leave\u00a0Create incidents from alerts<\/strong>\u00a0enabled. Microsoft documents that Defender XDR processes incident creation\/correlation for onboarded workspaces, even if the rule was authored in Sentinel. [R15]<\/li>\n\n\n\n
                                                                      12. Under\u00a0Automated responses<\/strong>, choose\u00a0none<\/strong>. Do not add notifications to real business teams or remediation actions.<\/li>\n\n\n\n
                                                                      13. Review the complete configuration, check\u00a0Validation passed<\/strong>, and select\u00a0Create<\/strong>.<\/li>\n\n\n\n
                                                                      14. Return to\u00a0Active rules<\/strong>\u00a0and verify the temporary rule is enabled and query\/scope match the approved lab.<\/li>\n<\/ol>\n\n\n\n
                                                                        Phase 3 \u2014 verify the real output (do not stop at a saved rule)<\/h3>\n\n\n\n
                                                                          \n
                                                                        1. In Defender portal open\u00a0Investigation & response \u2192 Incidents & alerts \u2192 Alerts<\/strong>\u00a0(navigation may be reorganized in the current unified interface).<\/li>\n\n\n\n
                                                                        2. Filter by a recent time range and the\u00a0lab rule name<\/strong>. Allow enough time for scheduled execution, ingestion, and Defender correlation; there is no guarantee of an instant alert.<\/li>\n\n\n\n
                                                                        3. Record\u00a0Alert name\/ID<\/strong>,\u00a0rule name<\/strong>,\u00a0created time<\/strong>,\u00a0severity<\/strong>,\u00a0resource or evidence<\/strong>, and\u00a0source<\/strong>. Screenshot\u00a0D2-L05-Alert.png<\/code>.<\/li>\n\n\n\n
                                                                        4. Next open\u00a0Incidents & alerts \u2192 Incidents<\/strong>, or\u00a0Cases \u2192 Incident<\/strong>\u00a0if your Defender tenant uses the incident-cases preview. Locate the incident containing the alert.<\/li>\n\n\n\n
                                                                        5. Record\u00a0Incident\/case ID<\/strong>,\u00a0status<\/strong>,\u00a0related alert count<\/strong>,\u00a0associated activity time<\/strong>, and\u00a0owner<\/strong>\u00a0if set. Screenshot\u00a0D2-L05-Incident.png<\/code>.<\/li>\n\n\n\n
                                                                        6. Compare the alert evidence back to the\u00a0AzureActivity<\/strong>\u00a0event (same subscription\/resource\/operation\/approximate time).<\/li>\n\n\n\n
                                                                        7. If an alert appears\u00a0but no new incident row<\/strong>, check if it was\u00a0correlated into an existing incident<\/strong>, the incident-creation setting, permission\/filter scope, and Defender processing before concluding \u201cbroken\u201d. The documented Defender engine may group alerts differently than the scheduled rule’s initial settings. [R15]<\/li>\n\n\n\n
                                                                        8. After obtaining evidence,\u00a0disable the temporary rule immediately<\/strong>\u00a0or have the instructor disable it; verify the disabled state. Keep the incident\/case available for D2-L06 and delete the rule during final cleanup.<\/li>\n<\/ol>\n\n\n\n
                                                                          PASS gate D2-05 \u2014 must have the complete evidence chain<\/h3>\n\n\n\n
                                                                          Boundary<\/th>Evidence<\/th>Actual result<\/th><\/tr><\/thead>
                                                                          Approved Azure event<\/td>Source Activity log \/ signal RG change<\/td>PASS \/ BLOCKED<\/td><\/tr>
                                                                          Ingested destination record<\/td>AzureActivity<\/code> query result in intended workspace<\/td>PASS \/ BLOCKED<\/td><\/tr>
                                                                          Query matches data<\/td>D2-L05-Lab-Rule-Query.kql<\/code> returns \u22651 row<\/td>PASS \/ BLOCKED<\/td><\/tr>
                                                                          Active rule<\/td>Rule saved, then enabled\/runs<\/td>PASS \/ BLOCKED<\/td><\/tr>
                                                                          Actual alert<\/td>Alert ID from the controlled rule<\/td>PASS \/ BLOCKED<\/td><\/tr>
                                                                          Actual incident\/case<\/td>Incident ID containing the alert<\/td>PASS \/ BLOCKED<\/td><\/tr>
                                                                          Noise prevention<\/td>Lab rule disabled\/suppressed after test<\/td>PASS \/ BLOCKED<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                                          Critical:<\/strong> A SIMULATED<\/code> KQL result or a \u201ctest with current data\u201d preview does not<\/strong> satisfy the actual-alert or actual-incident gates. If the portal hasn’t produced the real alert\/incident, mark those steps BLOCKED<\/strong> and document the cause\/last observed boundary.<\/p>\n\n\n\n
                                                                          D2-L06 \u2014 First-line SOC triage: classify, document, escalate<\/h2>\n\n\n\n
                                                                          Syllabus:<\/strong> F18, F19, F20, F22. Type:<\/strong> Real training alert incident; learner may be Responder or instructor-managed. DOC-VERIFIED:<\/strong> [R13], [R16], [R17].<\/p>\n\n\n\n
                                                                          Part A \u2014 identify which incident UI your tenant actually uses<\/h3>\n\n\n\n
                                                                          Path A: Current documented standard\/legacy Defender incident queue<\/strong><\/p>\n\n\n\n
                                                                            \n
                                                                          1. Open\u00a0Investigation & response \u2192 Incidents & alerts \u2192 Incidents<\/strong>\u00a0in Defender portal.<\/li>\n\n\n\n
                                                                          2. Filter for the approved lab rule, the appropriate workspace\/source, and recent creation time.<\/li>\n\n\n\n
                                                                          3. Open the incident and look for the\u00a0Summary\/overview<\/strong>,\u00a0Alerts<\/strong>,\u00a0Evidence\/entities<\/strong>,\u00a0Activity\/Comments<\/strong>, and any available\u00a0attack story<\/strong>\u00a0or timeline.<\/li>\n\n\n\n
                                                                          4. Use\u00a0Manage incident<\/strong>\u00a0or the management pane to set a training owner, appropriate status, and notes (if the learner has permission).<\/li>\n<\/ol>\n\n\n\n
                                                                            Path B: Newer incident-cases preview (where enabled)<\/strong><\/p>\n\n\n\n
                                                                              \n
                                                                            1. Open\u00a0Cases \u2192 Incident<\/strong>\u00a0in Defender portal.<\/li>\n\n\n\n
                                                                            2. Select the incident case and check\u00a0Summary<\/strong>,\u00a0Attack graph<\/strong>, and\u00a0Artifacts \u2192 Alerts \/ Assets \/ Evidence \/ Activities<\/strong>\u00a0as available.<\/li>\n\n\n\n
                                                                            3. To manage case fields, select the\u00a0three-dot menu \u2192 Manage case<\/strong>\u00a0(or the available\u00a0Manage case<\/strong>\u00a0control).<\/li>\n\n\n\n
                                                                            4. Verify the learner has appropriate\u00a0Defender unified RBAC Security Data Read<\/strong>\u00a0to view or\u00a0Security Data Manage<\/strong>\u00a0to update case information. [R16], [R17]<\/li>\n<\/ol>\n\n\n\n
                                                                              Important:<\/strong> As of this edition, Microsoft identifies incident cases as a preview<\/strong> and maintains a legacy incident experience. Do not treat an unavailable preview menu as a learner failure; use the supported incident interface actually provisioned. [R16]<\/p>\n\n\n\n
                                                                              Part B \u2014 perform the evidence-based triage<\/h3>\n\n\n\n
                                                                                \n
                                                                              1. Record incident or case\u00a0ID<\/strong>,\u00a0creation time<\/strong>,\u00a0severity<\/strong>,\u00a0status<\/strong>,\u00a0owner<\/strong>,\u00a0associated alerts<\/strong>, and\u00a0detection source<\/strong>.<\/li>\n\n\n\n
                                                                              2. Read the\u00a0alert’s detection description<\/strong>\u00a0before taking action. Ask: \u201cWhat condition did the analytic rule actually test?\u201d<\/li>\n\n\n\n
                                                                              3. Inspect the known\u00a0ResourceId<\/strong>,\u00a0OperationNameValue<\/strong>,\u00a0ActivityStatusValue<\/strong>,\u00a0Caller<\/strong>, and\u00a0TimeGenerated<\/strong>. If the alert view omits fields, use a saved workspace query from D2-L05.<\/li>\n\n\n\n
                                                                              4. Confirm that the resource belongs to the\u00a0preapproved lab subscription and lab signal group<\/strong>.<\/li>\n\n\n\n
                                                                              5. Compare the timestamps: known trainee action, source Activity log record,\u00a0AzureActivity<\/code>\u00a0record, alert, and incident. Account for processing delays.<\/li>\n\n\n\n
                                                                              6. Review available entity or evidence panes, but\u00a0do not invent user, IP, device, or UEBA signals<\/strong>\u00a0if they are not present or licensed in the tenant.<\/li>\n\n\n\n
                                                                              7. Test\u00a0two alternate hypotheses<\/strong>: (H1) expected lab action correctly detected; (H2) activity outside the lab or unapproved scope. State what source evidence would distinguish them.<\/li>\n\n\n\n
                                                                              8. Decide\u00a0risk level and disposition<\/strong>\u00a0based on evidence; do not mark the activity malicious merely because an alert exists.<\/li>\n\n\n\n
                                                                              9. In a writable lab case, set an approved status such as\u00a0In progress<\/strong>\u00a0while analyzing. Assign to yourself or the instructor as permitted.<\/li>\n\n\n\n
                                                                              10. Add a short evidence-based comment:\u00a0TRAINING EVENT \u2014 lab rule [name] matched approved RG [name], action [operation], UTC [time]; no disruptive response taken.<\/code><\/li>\n\n\n\n
                                                                              11. Resolve\/close the training case using the\u00a0actual classification\/determination choices supported in your portal<\/strong>. For an authorized test that behaved as designed, an\u00a0expected activity\/security testing<\/strong>\u00a0outcome (where offered) is generally more faithful than \u201cmalicious attack\u201d. Discuss options with the instructor if different portal choices are available.<\/li>\n\n\n\n
                                                                              12. Note where a case update and related incident\/alert status are or are not synchronized; avoid assuming that\u00a0closing the case automatically closes each underlying alert<\/strong>\u00a0in every preview flow. [R17]<\/li>\n\n\n\n
                                                                              13. Save the incident record, its query evidence, and the final disposition in the evidence folder.<\/li>\n<\/ol>\n\n\n\n
                                                                                Incident report template \u2014 fill this completely<\/h3>\n\n\n\n
                                                                                # Aster Retail \u2014 Approved Training Incident\n\n- Exercise: D2-L06\n- Incident\/case ID:\n- Analytics rule name \/ ID:\n- Azure training subscription \/ resource identifier:\n- Initial alert UTC time:\n- Relevant event UTC time:\n- Severity \/ status \/ assigned owner:\n- Alert(s) associated:\n- Evidence examined (query filenames, fields, screenshots):\n- Observed action and actor identifier:\n- Why this looked interesting to a detection rule:\n- Alternate benign explanation:\n- Conclusion (evidence-based, avoid unsupported claims):\n- Classification \/ determination selected in portal:\n- Actions performed (training-only; no remediation):\n- Escalation required? To whom and why?:\n- Follow-up \/ rule improvement suggestion:\n- Final status \/ reviewer \/ UTC timestamp:\n<\/code><\/pre>\n\n\n\n
                                                                                Escalation decision matrix<\/h3>\n\n\n\n
                                                                                Situation<\/th>Learner action<\/th>Who reviews?<\/th><\/tr><\/thead>
                                                                                Approved signal group and action match planned lab<\/td>Document and close as expected security testing<\/td>Instructor \/ SOC lead<\/td><\/tr>
                                                                                Different subscription, unexpected account, or non-lab target<\/td>Stop remediation<\/strong>; preserve facts, escalate for verification<\/td>Instructor + authorized SOC lead<\/td><\/tr>
                                                                                Query missing evidence or timestamps inconsistent<\/td>Leave investigation open; collect source\/destination proof<\/td>SOC L2 or connector owner<\/td><\/tr>
                                                                                Scope\/permissions preventing incident updates<\/td>Do not elevate yourself; request authorized owner<\/td>Admin \/ incident manager<\/td><\/tr>
                                                                                Actual signs of account misuse outside the exercise<\/td>Follow real security incident policy, not<\/strong> training steps<\/td>Organization’s real security team<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                                                PASS gate D2-06:<\/strong> Incident record is complete, evidence directly supports the conclusion, appropriate status\/owner\/disposition are recorded, and the learner can explain at least one alternative hypothesis. If a learner cannot change status because of role boundaries, the instructor performs the action and records OBSERVED (role restricted)<\/code>; do not make unsupported changes.<\/p>\n\n\n\n
                                                                                D2-L07 \u2014 Read and interpret a built-in Microsoft Sentinel workbook<\/h2>\n\n\n\n
                                                                                Syllabus:<\/strong> F21. Type:<\/strong> Consume existing visualizations; not an advanced custom-workbook lesson. DOC-VERIFIED:<\/strong> [R18].<\/p>\n\n\n\n
                                                                                Prerequisites<\/h3>\n\n\n\n
                                                                                  \n
                                                                                • A workbook template installed through\u00a0Content hub<\/strong>, or an\u00a0instructor-provided saved workbook<\/strong>\u00a0with a data source supported by your lab.<\/li>\n\n\n\n
                                                                                • Sufficient workbook read permission; access to the specific Log Analytics workspace table used by the workbook.<\/li>\n\n\n\n
                                                                                • A plan for\u00a0empty visualizations<\/em>: not all template workbooks accept\u00a0AzureActivity<\/code>; some require other connectors. Do\u00a0not<\/strong>\u00a0assume the installed Azure Activity solution provides a usable workbook for every environment.<\/li>\n<\/ul>\n\n\n\n
                                                                                  Guided steps<\/h3>\n\n\n\n
                                                                                    \n
                                                                                  1. In Defender portal expand\u00a0Microsoft Sentinel \u2192 Threat management \u2192 Workbooks<\/strong>.<\/li>\n\n\n\n
                                                                                  2. Select\u00a0Templates<\/strong>\u00a0to view installed workbook templates.<\/li>\n\n\n\n
                                                                                  3. Open a workbook whose\u00a0required data types<\/strong>\u00a0are actually present in the training workspace. If none qualifies, use an instructor-provided saved workbook and record that source. Do not install unrelated enterprise connectors solely to populate a dashboard.<\/li>\n\n\n\n
                                                                                  4. Read its description, named data dependencies, workspaces and purpose before opening it.<\/li>\n\n\n\n
                                                                                  5. If the instructor has authorized saving an instance, select\u00a0Save<\/strong>, choose the\u00a0training subscription\/RG<\/strong>\u00a0location, then\u00a0View saved workbook<\/strong>. Otherwise open the instructor-provided workbook read-only.<\/li>\n\n\n\n
                                                                                  6. Locate and record the\u00a0time-range filter<\/strong>. Compare a narrow range and a wider range, keeping the same source scope.<\/li>\n\n\n\n
                                                                                  7. Locate the chart\/table most relevant to the lab (for example, administrative operations by time or status if available).<\/li>\n\n\n\n
                                                                                  8. Identify\u00a0one chart axis<\/strong>,\u00a0one filter<\/strong>,\u00a0one number<\/strong>, and\u00a0one actionable SOC question<\/strong>\u00a0answered by the visualization.<\/li>\n\n\n\n
                                                                                  9. If the view is empty, inspect whether the required tables exist and time filters include matching data. A working template with no source data is not a platform failure.<\/li>\n\n\n\n
                                                                                  10. If the Defender portal displays a feature that requires\u00a0Open in Azure<\/strong>, follow the permitted view workflow only; do not switch the\u00a0core course experience<\/em>\u00a0to the legacy Azure Sentinel interface. [R18]<\/li>\n\n\n\n
                                                                                  11. Save or screenshot the supported visualization, with time range and workspace displayed. File:\u00a0D2-L07-Workbook-Interpretation.png<\/code>.<\/li>\n<\/ol>\n\n\n\n
                                                                                    Interpretation questions \u2014 learner writes answers<\/h3>\n\n\n\n
                                                                                      \n
                                                                                    1. What population of records and what time range are shown?<\/li>\n\n\n\n
                                                                                    2. Does the chart show\u00a0events, unique users\/resources, alerts, or incidents<\/strong>? Explain.<\/li>\n\n\n\n
                                                                                    3. What could make a chart show zero events even when ingestion works?<\/li>\n\n\n\n
                                                                                    4. What follow-up KQL query would you run if the chart shows a sudden spike?<\/li>\n\n\n\n
                                                                                    5. Can a dashboard alone prove that a resource action was malicious? Why not?<\/li>\n<\/ol>\n\n\n\n
                                                                                      PASS gate D2-07:<\/strong> Workbook of a compatible type was opened; learner accurately interprets one visual, its scope and filters, and states one query-driven investigative follow-up. If no compatible workbook exists, record BLOCKED \u2014 missing supported template\/source<\/code> rather than inventing workbook data.<\/p>\n\n\n\n
                                                                                      D2-L08 \u2014 Entry-level SOC operational SOP and guided troubleshooting<\/h2>\n\n\n\n
                                                                                      Syllabus:<\/strong> F22\u2013F23. Type:<\/strong> Diagnostic workshop. Deliverable:<\/strong> Day02\/D2-L08-Troubleshooting-Worksheet.md<\/code>.<\/p>\n\n\n\n
                                                                                      Reusable L1 SOC checklist (start with observation, never remediation)<\/h3>\n\n\n\n
                                                                                        \n
                                                                                      1. Confirm the\u00a0incident ID<\/strong>, created UTC time, source detection, severity and current owner.<\/li>\n\n\n\n
                                                                                      2. Validate the detection has a\u00a0real triggering alert<\/strong>, not merely an enabled rule.<\/li>\n\n\n\n
                                                                                      3. Check\u00a0workspace\/source<\/strong>\u00a0and that query time range includes the signal.<\/li>\n\n\n\n
                                                                                      4. Verify\u00a0event details<\/strong>, relevant entities, and any linked alerts.<\/li>\n\n\n\n
                                                                                      5. Check whether the incident represents\u00a0planned training, expected activity, a false alarm, or possible real threat<\/strong>.<\/li>\n\n\n\n
                                                                                      6. Identify the\u00a0one next question<\/strong>\u00a0that would most reduce uncertainty, plus the KQL\/source needed to answer it.<\/li>\n\n\n\n
                                                                                      7. Add factual case notes and a secure evidence link, avoiding secrets or unrelated PII.<\/li>\n\n\n\n
                                                                                      8. Escalate to the correct role or close only within allowed permissions and documented process.<\/li>\n\n\n\n
                                                                                      9. Review whether the rule\/template data prerequisites and signal quality are sufficient.<\/li>\n\n\n\n
                                                                                      10. Confirm lab rule suppression\/disablement at the end of the exercise.<\/li>\n<\/ol>\n\n\n\n
                                                                                        Troubleshooting Challenge T01 \u2014 Table error \/ missing data<\/h3>\n\n\n\n
                                                                                          \n
                                                                                        • Instructor injects:<\/strong>\u00a0Learner queries\u00a0AzureActivity<\/code>\u00a0in a workspace with no Activity export, or selects the wrong workspace.<\/li>\n\n\n\n
                                                                                        • Symptoms:<\/strong>\u00a0Table may be missing, query returns zero rows, or access is denied.<\/li>\n\n\n\n
                                                                                        • Student action:<\/strong>\u00a0Confirm tenant\/workspace scope \u2192 inspect broad table query \u2192 inspect Azure Activity export and source \u2192 distinguish missing table \/ no data \/ no permission.<\/li>\n\n\n\n
                                                                                        • Evidence:<\/strong>\u00a0Screenshot\/command showing the\u00a0first point<\/em>\u00a0where expected state fails.<\/li>\n<\/ul>\n\n\n\n
                                                                                          Troubleshooting Challenge T02 \u2014 Overly narrow time filter<\/h3>\n\n\n\n
                                                                                            \n
                                                                                          • Instructor injects:<\/strong>\u00a0Recent event exists, but query uses\u00a0ago(1m)<\/code>\u00a0or UI filter excludes it.<\/li>\n\n\n\n
                                                                                          • Student action:<\/strong>\u00a0Compare source UTC time \u2192 expand query window \u2192 remove conflicting filters \u2192 rerun.<\/li>\n\n\n\n
                                                                                          • Correct finding:<\/strong>\u00a0Query was valid; lookback did not cover available telemetry.<\/li>\n<\/ul>\n\n\n\n
                                                                                            Troubleshooting Challenge T03 \u2014 Analytic rule enabled, no alert<\/h3>\n\n\n\n
                                                                                              \n
                                                                                            • Instructor injects:<\/strong>\u00a0Template is active, but its KQL has no matching rows for a benign tag update.<\/li>\n\n\n\n
                                                                                            • Student action:<\/strong>\u00a0Verify required source tables \u2192 run rule KQL with current source \u2192 inspect schedule\/threshold \u2192 explain mismatch; if approved, use controlled D2-L05 fallback.<\/li>\n\n\n\n
                                                                                            • Correct finding:<\/strong>\u00a0\u201cEnabled\u201d is not equal to \u201ctriggered\u201d.<\/li>\n<\/ul>\n\n\n\n
                                                                                              Troubleshooting Challenge T04 \u2014 Alert present, incident not found<\/h3>\n\n\n\n
                                                                                                \n
                                                                                              • Instructor injects:<\/strong>\u00a0Alert visible, but the analyst’s time filter\/workspace selection differs; or Defender correlates into an existing incident.<\/li>\n\n\n\n
                                                                                              • Student action:<\/strong>\u00a0Find alert ID and linked incident; examine rule incident settings; search both current\u00a0Incidents<\/strong>\u00a0and\u00a0Cases \u2192 Incident<\/strong>\u00a0if applicable; check permission and creation delay.<\/li>\n\n\n\n
                                                                                              • Correct finding:<\/strong>\u00a0Confirm whether correlation, UI scope or timing explains the missing\u00a0new<\/em>\u00a0row.<\/li>\n<\/ul>\n\n\n\n
                                                                                                Troubleshooting Challenge T05 \u2014 Workbook has no charts<\/h3>\n\n\n\n
                                                                                                  \n
                                                                                                • Instructor injects:<\/strong>\u00a0Selected workbook depends on a table absent in the training workspace.<\/li>\n\n\n\n
                                                                                                • Student action:<\/strong>\u00a0Check\u00a0Required data types<\/code>\u00a0and actual workspace tables; switch to a supported template \/ provided workbook.<\/li>\n\n\n\n
                                                                                                • Correct finding:<\/strong>\u00a0Lack of required data is different from workbook corruption.<\/li>\n<\/ul>\n\n\n\n
                                                                                                  Troubleshooting Challenge T06 \u2014 Unauthorized action blocked<\/h3>\n\n\n\n
                                                                                                    \n
                                                                                                  • Instructor injects:<\/strong>\u00a0Reader tries to install a solution or edit an incident.<\/li>\n\n\n\n
                                                                                                  • Student action:<\/strong>\u00a0Identify the actual task \u2192 map it to a role and scope \u2192 request the minimum authorized grant or instructor action.<\/li>\n\n\n\n
                                                                                                  • Correct finding:<\/strong>\u00a0Reader can inspect some resources but not create rules or manage incidents.<\/li>\n<\/ul>\n\n\n\n
                                                                                                    General diagnostic decision tree<\/h3>\n\n\n\n
                                                                                                    NoYesNoYesNoYesNoYesNoYesNoYesExpected result absentSource event exists?Check Azure Activity scope, action, UTC filterExport configured to right workspace?Check Policy\/diagnostic destination and approvalAzureActivity query returns signal?Check delay, permissions, workspace, table, KQL filtersRule query returns matches?Check template prerequisites, window, predicatesActual alert created?Check enabled state, schedule, threshold, suppressionIncident\/case contains alert?Check correlation, incident settings, portal filtersReview evidence, document, classify, close\/escalate<\/pre>\n\n\n\n
                                                                                                    PASS gate D2-08:<\/strong> Each learner correctly diagnoses four distinct failure classes<\/strong> from source, export, KQL, rule, incident or workbook, and identifies a non-disruptive next step. Correctly stopping and escalating<\/strong> is acceptable when privileges or environment controls block action.<\/p>\n\n\n\n
                                                                                                    D2-L09 \u2014 Final Foundations capstone: from a change to a documented incident<\/h2>\n\n\n\n
                                                                                                    Syllabus:<\/strong> Entire Foundations range F01\u2013F23. Type:<\/strong> Supervised applied assessment. No hourly schedule<\/strong>.
                                                                                                    Prerequisites:<\/strong> Day 1 architecture\/readiness evidence, at least one relevant source signal, query permissions, and instructor-approved detection. Deliverable:<\/strong> Assessment\/<Learner-ID>-Foundations-Capstone.md<\/code> plus evidence.<\/p>\n\n\n\n
                                                                                                    Practical scenario<\/h3>\n\n\n\n
                                                                                                    The training cloud administrator announces an approved change in the unique Aster Retail signal RG<\/strong>. Your task is to prove the change occurred, determine whether Sentinel observed it, ensure an authorized rule evaluated relevant data, and record the resulting incident according to the SOC checklist. The activity is expected security testing<\/strong>, not an attack.<\/p>\n\n\n\n
                                                                                                    Assessment execution steps<\/h3>\n\n\n\n
                                                                                                      \n
                                                                                                    1. Write\u00a0What, Why, Who, When, Where, How<\/strong>\u00a0for this event-to-incident exercise in no more than six short lines.<\/li>\n\n\n\n
                                                                                                    2. Submit or point to the\u00a0architecture diagram<\/strong>; identify the exact data source, connector method, Sentinel workspace and Defender experience.<\/li>\n\n\n\n
                                                                                                    3. Show the approved subscription, workspace, and\u00a0least privilege<\/strong>\u00a0separation; do not expose private account details in exported evidence.<\/li>\n\n\n\n
                                                                                                    4. Capture the Azure portal\u00a0source Activity log<\/strong>\u00a0evidence for the instructor’s designated benign change.<\/li>\n\n\n\n
                                                                                                    5. Write and execute a KQL query identifying the same action in\u00a0AzureActivity<\/code>, with at least one scope filter and a sensible time range.<\/li>\n\n\n\n
                                                                                                    6. Write a KQL summary grouped by\u00a0operation or status<\/strong>\u00a0and explain what its rows represent.<\/li>\n\n\n\n
                                                                                                    7. Show the enabled\u00a0starter template rule<\/strong>\u00a0and explain its source prerequisites and why it might or might not fire for this action.<\/li>\n\n\n\n
                                                                                                    8. If necessary and expressly approved, demonstrate\u00a0D2-L05’s limited lab rule<\/strong>. Show real rule, real matching query, actual alert, and incident\/case ID. Disable lab rule as soon as this evidence is captured.<\/li>\n\n\n\n
                                                                                                    9. Investigate the incident: identify owner, severity, linked alert, relevant resource, timeline, and evidence; describe at least one\u00a0alternative benign explanation<\/strong>.<\/li>\n\n\n\n
                                                                                                    10. Record the correct disposition:\u00a0approved security testing\/expected lab event<\/strong>. Choose available portal classification\/determination values faithfully; do not misclassify harmless activity as a real compromise.<\/li>\n\n\n\n
                                                                                                    11. Open a compatible\u00a0built-in workbook<\/strong>\u00a0and explain its scope, time filter, and one chart or table.<\/li>\n\n\n\n
                                                                                                    12. Diagnose one injected\u00a0negative test<\/strong>: wrong workspace, wrong filter, missing prerequisite, no alert, or insufficient role.<\/li>\n\n\n\n
                                                                                                    13. Submit the completed report and\u00a0cleanup acknowledgment<\/strong>. Instructor evaluates the\u00a0actual evidence<\/strong>, not simply attendance.<\/li>\n<\/ol>\n\n\n\n
                                                                                                      Objective assessment rubric \u2014 100 points<\/h3>\n\n\n\n
                                                                                                      Criterion<\/th>Points<\/th>Observable pass evidence<\/th><\/tr><\/thead>
                                                                                                      5W1H, SOC roles, SIEM\/XDR comparisons, architecture<\/td>15<\/td>Correct definitions and arrows; ownership boundaries<\/td><\/tr>
                                                                                                      Tenant\/role\/cost readiness and safe workspace\/Sentinel onboarding<\/td>15<\/td>Correct workspace, region, RG and Defender association; approvals<\/td><\/tr>
                                                                                                      Authorized Azure Activity source\/export\/ingestion<\/td>20<\/td>Match between real source event and AzureActivity<\/code> record<\/td><\/tr>
                                                                                                      Basic KQL and data interpretation<\/td>20<\/td>Correct where<\/code>\/project<\/code>\/sort<\/code>\/summarize<\/code>\/bin<\/code>, timestamps, counts<\/td><\/tr>
                                                                                                      Template content and real detection validation<\/td>10<\/td>Installed solution, active template, prerequisite explanation; real alert if available<\/td><\/tr>
                                                                                                      Incident triage and case record<\/td>10<\/td>Alert\/incident link, facts, hypotheses, correct disposition<\/td><\/tr>
                                                                                                      Workbook interpretation<\/td>5<\/td>Actual relevant visualization and filter explanation<\/td><\/tr>
                                                                                                      Troubleshooting, safe actions, cleanup<\/td>5<\/td>Diagnoses root cause, disables lab rule, records owner<\/td><\/tr>
                                                                                                      TOTAL<\/strong><\/td>100<\/strong><\/td><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                                                                      Suggested academic threshold:<\/strong> 80\/100<\/strong>, plus<\/em> mandatory critical-skill gates below. This passing score is a training recommendation<\/strong>, not a Microsoft certification policy.<\/p>\n\n\n\n
                                                                                                      Mandatory critical-skill gates<\/h3>\n\n\n\n
                                                                                                        \n
                                                                                                      • G1 \u2014 Access & safe scope:<\/strong>\u00a0Learner knows which subscription\/workspace is in use and respects role\/approval limits.<\/li>\n\n\n\n
                                                                                                      • G2 \u2014 Genuine ingestion (or instructor-attested shared environment):<\/strong>\u00a0A real Azure Activity event is linked to a real\u00a0AzureActivity<\/code>\u00a0workspace record. Offline\u00a0datatable<\/code>\u00a0cannot replace this.<\/li>\n\n\n\n
                                                                                                      • G3 \u2014 Query competency:<\/strong>\u00a0Learner independently executes the required KQL operators and can explain empty results.<\/li>\n\n\n\n
                                                                                                      • G4 \u2014 Detection\/incident workflow:<\/strong>\u00a0Either a real lab alert and related incident are demonstrated, or an\u00a0explicit, signed environment blocker<\/strong>\u00a0is documented and a controlled supervised remediation\/retest is scheduled.<\/li>\n\n\n\n
                                                                                                      • G5 \u2014 Investigation discipline:<\/strong>\u00a0Correct evidence-based disposition and no unauthorized remediation.<\/li>\n<\/ul>\n\n\n\n
                                                                                                        Decision:<\/strong> PASS \/ PASS-WITH-APPROVED-OBSERVED-SETUP \/ REMEDIATION-REQUIRED \/ BLOCKED-BY-ENVIRONMENT<\/code>. Do not<\/strong> issue an unconditional live-lab PASS when the connector, alert, or incident has never been observed. Learners should remediate and reattempt missed mandatory gates before being marked fully eligible for Day 3 Intermediate<\/strong>.<\/p>\n\n\n\n
                                                                                                        Instructor answer key \u2014 check outcomes, not fixed row counts<\/h3>\n\n\n\n
                                                                                                          \n
                                                                                                        1. Workspaces:<\/strong>\u00a0Azure Log Analytics workspace holds relevant tables; Sentinel is enabled on that workspace; Defender provides the primary operations experience.<\/li>\n\n\n\n
                                                                                                        2. Source:<\/strong>\u00a0Azure Activity tracks Azure control-plane actions; the approved diagnostic pipeline sends events to the intended workspace.<\/li>\n\n\n\n
                                                                                                        3. Query:<\/strong>\u00a0Count may vary. A correct query returns a matching\u00a0ResourceId<\/code>\u00a0or\u00a0ResourceGroup<\/code>, reasonable UTC time, and action\/status fields.<\/li>\n\n\n\n
                                                                                                        4. Template:<\/strong>\u00a0An installed template is not yet an active rule, and an active rule is not proof an alert fired.<\/li>\n\n\n\n
                                                                                                        5. Testing:<\/strong>\u00a0A scheduled-rule result preview is\u00a0not<\/strong>\u00a0an actual alert. A real alert carries a record\/ID and appears in the Alerts queue.<\/li>\n\n\n\n
                                                                                                        6. Incident:<\/strong>\u00a0Defender may correlate multiple alerts into an incident; a missing\u00a0new<\/strong>\u00a0row is not proof that no incident exists.<\/li>\n\n\n\n
                                                                                                        7. Disposition:<\/strong>\u00a0This scenario is preapproved lab activity, so justify an expected\/security-testing classification where available.<\/li>\n\n\n\n
                                                                                                        8. Workbook:<\/strong>\u00a0A workbook visual reflects data source\/time filters; it does not independently establish maliciousness.<\/li>\n\n\n\n
                                                                                                        9. Permissions:<\/strong>\u00a0Least privilege and scoped elevation through instructor\/admin, not blanket Owner access.<\/li>\n\n\n\n
                                                                                                        10. Cleanup:<\/strong>\u00a0Rule is disabled\/deleted, signal RG is removed when approved, data connector\/policy and workspace lifecycle are recorded.<\/li>\n<\/ol>\n\n\n\n
                                                                                                          \n\n\n\n
                                                                                                          3. Safe lab closure \u2014 END-L01<\/h1>\n\n\n\n
                                                                                                          Purpose:<\/strong> Ensure the exercise does not leave alert storms, orphaned billable telemetry, unwanted Azure Policy assignments, unused workspaces or sensitive evidence. Only the instructor\/cloud owner performs deletion or offboarding.<\/strong> [R19], [R20], [R21].<\/p>\n\n\n\n
                                                                                                          Step 1 \u2014 stop active classroom detection<\/h2>\n\n\n\n
                                                                                                            \n
                                                                                                          1. In Defender portal open\u00a0Microsoft Sentinel \u2192 Configuration \u2192 Analytics \u2192 Active rules<\/strong>.<\/li>\n\n\n\n
                                                                                                          2. Filter by the exact lab ID\/name, such as\u00a0LAB01 - Approved Azure Activity Test<\/code>.<\/li>\n\n\n\n
                                                                                                          3. Confirm the exact rule belongs to your training workspace and was created for the class.<\/li>\n\n\n\n
                                                                                                          4. Disable<\/strong>\u00a0it and verify its status. If authorized and the retention policy allows,\u00a0delete<\/strong>\u00a0the temporary lab rule; capture the deletion confirmation.<\/li>\n\n\n\n
                                                                                                          5. Review the rule created from\u00a0Suspicious Resource deployment<\/strong>. If it was installed only for this class and is not used by anyone else, disable\/remove it as the instructor approves; do not touch a shared enterprise active rule.<\/li>\n\n\n\n
                                                                                                          6. Search for unexpected additional training rules and confirm none remain enabled. Record that the last query-run\/alert test is complete.<\/li>\n<\/ol>\n\n\n\n
                                                                                                            Step 2 \u2014 close the training incident properly<\/h2>\n\n\n\n
                                                                                                              \n
                                                                                                            1. Open the relevant\u00a0Incidents<\/strong>\u00a0queue or\u00a0Cases \u2192 Incident<\/strong>\u00a0view for the tenant.<\/li>\n\n\n\n
                                                                                                            2. Confirm the lab event disposition and the case\/incident closure status.<\/li>\n\n\n\n
                                                                                                            3. Leave a last comment containing the training rule ID and the statement\u00a0TRAINING ONLY; no production remediation authorized<\/code>.<\/li>\n\n\n\n
                                                                                                            4. Record incident\/case IDs for assessment, but follow the institution’s retention and redaction rules for exported evidence.<\/li>\n\n\n\n
                                                                                                            5. Never bulk-close unrelated incidents in a shared tenant.<\/li>\n<\/ol>\n\n\n\n
                                                                                                              Step 3 \u2014 clean up the benign signal resource group<\/h2>\n\n\n\n
                                                                                                                \n
                                                                                                              1. In Azure portal open\u00a0Resource groups \u2192 [your unique signal group]<\/strong>.<\/li>\n\n\n\n
                                                                                                              2. Review\u00a0all contained resources<\/strong>. It should be empty or contain only instructor-approved disposable lab resources.<\/li>\n\n\n\n
                                                                                                              3. If it contains anything unexpected,\u00a0STOP<\/strong>\u00a0and ask the subscription owner; do not delete.<\/li>\n\n\n\n
                                                                                                              4. If verified empty\/disposable, use\u00a0Delete resource group<\/strong>, type the exact name when prompted, and confirm only under the authorized cleanup plan.<\/li>\n\n\n\n
                                                                                                              5. Confirm the group is absent from the active RG list and record cleanup evidence. Note that its prior Azure Activity events may remain in logs for the configured retention period.<\/li>\n<\/ol>\n\n\n\n
                                                                                                                Step 4 \u2014 remove lab-created export \/ Policy only when exclusive to the lab<\/em><\/h2>\n\n\n\n
                                                                                                                  \n
                                                                                                                1. Use the instructor’s\u00a0configuration inventory<\/strong>\u00a0from D1-L07: export method, diagnostic setting name or policy assignment, scope, destination, owner and creation time.<\/li>\n\n\n\n
                                                                                                                2. If using a unique lab-only diagnostic setting, ask the subscription owner to remove that setting in\u00a0Monitor \u2192 Activity log \u2192 Export Activity Logs<\/strong>\u00a0after checking that no other process relies on it.<\/li>\n\n\n\n
                                                                                                                3. If using a unique lab-only Azure Policy assignment, ask the policy owner to verify the assignment and any created diagnostic settings\/remediation resources before removing them.\u00a0Removing a policy assignment may not automatically remove every diagnostic setting it created.<\/strong>\u00a0Verify the final state separately.<\/li>\n\n\n\n
                                                                                                                4. If the export predates the class, is shared, or is enterprise-mandated,\u00a0leave it in place<\/strong>\u00a0and document \u201cpre-existing; retained by owner.\u201d<\/li>\n\n\n\n
                                                                                                                5. Recheck that the affected subscription is not unintentionally exporting duplicate data to the training workspace.<\/li>\n<\/ol>\n\n\n\n
                                                                                                                  Step 5 \u2014 decide what happens to Sentinel and the Log Analytics workspace<\/h2>\n\n\n\n
                                                                                                                    \n
                                                                                                                  1. In the instructor inventory, mark workspace as\u00a0keep for the five-day program<\/strong>,\u00a0keep for later approved reuse<\/strong>, or\u00a0dispose<\/strong>.<\/li>\n\n\n\n
                                                                                                                  2. If Days 3\u20135 will reuse the workspace,\u00a0do not delete or offboard it<\/strong>\u00a0simply because Day 2 ended.<\/li>\n\n\n\n
                                                                                                                  3. If the workspace is dedicated to the class and must be removed, review the documented\u00a0Remove Microsoft Sentinel<\/strong>\u00a0process and implications\u00a0before<\/em>\u00a0doing so. Removing Sentinel may delete Sentinel-specific data connector configurations and tables and can take time; it is not the same operation as deleting a resource group. [R19], [R20]<\/li>\n\n\n\n
                                                                                                                  4. If deleting an unneeded Log Analytics workspace, the owner must understand its\u00a0soft-delete\/recovery<\/strong>\u00a0behavior and downstream effects. Microsoft documents a soft-delete recovery window and potential permanent loss of linked solution configurations. Never force permanent deletion as part of a learner exercise. [R21]<\/li>\n\n\n\n
                                                                                                                  5. Confirm with the cost owner that no new lab-only connector\/workspace resource is left without documented ownership and billing review.<\/li>\n<\/ol>\n\n\n\n
                                                                                                                    Step 6 \u2014 submit final signed cleanup record<\/h2>\n\n\n\n
                                                                                                                    Instructor:                             __________________\nSubscription \/ tenant reviewed:         __________________\nTraining alert rule disabled\/deleted:   Yes \/ No \/ Retained by owner\nTemplate rule disabled\/deleted:         Yes \/ No \/ Pre-existing\nTraining incident disposition complete: Yes \/ No\nSignal RG deleted or retained:          __________________\nActivity export retained\/removed:       __________________\nPolicy assignment retained\/removed:     __________________\nSentinel workspace retained\/removed:    __________________\nCost owner informed:                    Yes \/ No\nEvidence archived under policy:        __________________\nCleanup UTC timestamp:                 __________________\nReviewer approval:                     __________________\n<\/code><\/pre>\n\n\n\n
                                                                                                                    PASS gate END-01:<\/strong> Nothing lab-only remains enabled without a named owner. STOP<\/strong> on any ambiguity about deleting a shared RG, policy assignment, workspace, data connector or incident.<\/p>\n\n\n\n
                                                                                                                    \n\n\n\n
                                                                                                                    4. Extended troubleshooting reference \u2014 symptom \u2192 check \u2192 safe resolution<\/h1>\n\n\n\n
                                                                                                                    This table is designed for live<\/em> classroom diagnosis. Error text, portal wording, and feature availability depend on tenant configuration. Always capture the actual error message.<\/strong><\/p>\n\n\n\n
                                                                                                                    #<\/th>Symptom<\/th>Most useful verification<\/th>Safe next step \/ expected diagnosis<\/th><\/tr><\/thead>
                                                                                                                    1<\/td>Wrong Azure directory or tenant<\/td>Account selector + subscription tenant<\/td>Switch to authorized tenant; repeat access check<\/td><\/tr>
                                                                                                                    2<\/td>Subscription invisible<\/td>Subscriptions page \/ current directory<\/td>Ask identity admin for scoped access; no account guessing<\/td><\/tr>
                                                                                                                    3<\/td>RG\/workspace create button disabled<\/td>IAM at resource<\/em> scope, Azure Policy denial<\/td>Contact provisioner\/policy owner<\/td><\/tr>
                                                                                                                    4<\/td>Workspace creation returns a policy error<\/td>Deployment details show deny policy assignment<\/td>Use approved region\/parameters, or ask policy owner<\/td><\/tr>
                                                                                                                    5<\/td>Workspace not listed when adding Sentinel<\/td>Name\/region\/type\/subscription and current role<\/td>Verify supported workspace type and effective permissions<\/td><\/tr>
                                                                                                                    6<\/td>Sentinel appears in Azure, not Defender<\/td>Sentinel Workspaces settings in Defender<\/td>Confirm onboarding\/admin rights; allow initial provisioning<\/td><\/tr>
                                                                                                                    7<\/td>Azure Activity solution not in Content hub<\/td>Search filters, content status, tenant<\/td>Clear filters; select supported content; log blocker<\/td><\/tr>
                                                                                                                    8<\/td>Content Hub install denied<\/td>Sentinel Contributor at correct RG<\/td>Instructor\/admin performs install; do not grant broad Owner<\/td><\/tr>
                                                                                                                    9<\/td>Azure Activity connector shows disconnected<\/td>Diagnostic export or policy assignment existence<\/td>Inspect actual approved scope\/destination; check delays<\/td><\/tr>
                                                                                                                    10<\/td>Cannot assign Azure Policy<\/td>Owner at policy assignment scope<\/em><\/td>Authorized policy owner executes assignment<\/td><\/tr>
                                                                                                                    11<\/td>Activity log visible, AzureActivity<\/code> absent<\/td>Export config \/ status \/ correct workspace<\/td>Repair pipeline, not KQL syntax<\/td><\/tr>
                                                                                                                    12<\/td>Activity log contains event but KQL no match<\/td>Query time range and ResourceId<\/code>\/ResourceGroup<\/code><\/td>Broaden scope\/time, use case-insensitive comparison<\/td><\/tr>
                                                                                                                    13<\/td>AzureActivity<\/code> table unknown<\/td>Confirm Log Analytics workspace has connector data<\/td>Inspect table\/permission; no invented data<\/td><\/tr>
                                                                                                                    14<\/td>\u201cForbidden\u201d on query<\/td>Actual workspace query\/read permissions<\/td>Grant only minimum required access after admin review<\/td><\/tr>
                                                                                                                    15<\/td>Wrong Caller<\/code> identity interpretation<\/td>Real field value and claims context<\/td>Treat GUID\/SPN as identity identifier, not always a human<\/td><\/tr>
                                                                                                                    16<\/td>Query where<\/code> filter gives zero<\/td>Run unfiltered query and compare field values<\/td>Fix predicate, casing or lookback<\/td><\/tr>
                                                                                                                    17<\/td>Chart is empty despite query success<\/td>Query aggregation and selected time range<\/td>Use summarize ... by bin(TimeGenerated, 1h)<\/code> on numeric result<\/td><\/tr>
                                                                                                                    18<\/td>Template Create rule disabled<\/td>Template required data source status<\/td>Enable approved source or use permitted alternative<\/td><\/tr>
                                                                                                                    19<\/td>Template enabled but no alert<\/td>Query matches, schedule, threshold, suppression<\/td>Explain no matching behavior; do not fake alert<\/td><\/tr>
                                                                                                                    20<\/td>Rule query rejected<\/td>Test KQL, required TimeGenerated<\/code>, output schema<\/td>Correct query and pass wizard validation<\/td><\/tr>
                                                                                                                    21<\/td>Alert storm in classroom<\/td>Rule filters too broad; repeated matching window<\/td>Disable lab rule, narrow unique RG scope; suppress when available<\/td><\/tr>
                                                                                                                    22<\/td>Alert exists but no new<\/strong> incident<\/td>Alert’s related incident link and Defender grouping<\/td>Check existing correlated incident and incident settings<\/td><\/tr>
                                                                                                                    23<\/td>Analyst cannot update incident<\/td>Sentinel Responder\/Contributor; Defender RBAC for cases<\/td>Ask authorized SOC role owner; don’t elevate self<\/td><\/tr>
                                                                                                                    24<\/td>Incident\/case menu not available<\/td>Preview entitlement vs standard Defender incident view<\/td>Use supported incident queue; document UI branch<\/td><\/tr>
                                                                                                                    25<\/td>Workbook displays blanks<\/td>Required tables, query scope, workbook filters<\/td>Use compatible template or instructor-provided workbook<\/td><\/tr>
                                                                                                                    26<\/td>Workbook save denied<\/td>Workbook Contributor \/ RG permission<\/td>Use read-only template or ask authorized editor<\/td><\/tr>
                                                                                                                    27<\/td>Source data delay<\/td>Event time vs EventSubmissionTimestamp<\/code>; export timing<\/td>Recheck, record actual latency; no fixed SLA assumed<\/td><\/tr>
                                                                                                                    28<\/td>Unexpected duplicate Azure Activity rows<\/td>Subscription vs management group exports<\/td>Review diagnostic export topology; investigate overlap<\/td><\/tr>
                                                                                                                    29<\/td>Costs still accruing after class<\/td>Active workspace\/connector\/retention and Cost Management<\/td>Verify retained owner or approved offboarding\/cleanup<\/td><\/tr>
                                                                                                                    30<\/td>\u201cNo access\u201d after workspace deletion<\/td>Workspace may have been soft-deleted or changed<\/td>Stop; check Azure Monitor documented recovery route<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                                                                                    Root-cause worksheet<\/h2>\n\n\n\n
                                                                                                                    # Lab Troubleshooting Record\n\n- Symptom as observed:\n- Exact error code\/text (if any):\n- Current portal and selected tenant\/subscription\/workspace:\n- First failing boundary: SOURCE \/ EXPORT \/ INGESTION \/ QUERY \/ RULE \/ ALERT \/ INCIDENT \/ WORKBOOK \/ RBAC\n- What was expected:\n- What was actually observed:\n- Three hypotheses (ranked):\n  1.\n  2.\n  3.\n- Non-destructive tests performed:\n- Evidence (links\/filenames):\n- Most likely root cause:\n- Correct remediation owner and scope:\n- Retest outcome: PASS \/ BLOCKED \/ PENDING\n<\/code><\/pre>\n\n\n\n
                                                                                                                    \n\n\n\n
                                                                                                                    5. Optional Azure CLI verification (instructor or provisioner)<\/h1>\n\n\n\n
                                                                                                                    \n
                                                                                                                    Optional, not required for the portal-based core course.<\/strong> Commands here are documented Azure CLI patterns; use an approved Azure Cloud Shell or preinstalled Azure CLI. Do not<\/strong> paste production credentials or run CLI delete commands from a learner laptop. A CLI success message does not prove the Sentinel connector is working: validate AzureActivity<\/code> separately. [R22], [R23]<\/p>\n<\/blockquote>\n\n\n\n
                                                                                                                    Verify the actual signed-in Azure context<\/h3>\n\n\n\n
                                                                                                                    az account show --output table\naz account list --output table\n# Replace with the training subscription ID, and re-check.<\/em>\naz account set --subscription \"<TRAINING-SUBSCRIPTION-ID>\"\naz account show --query \"{subscription:id, tenant:tenantId, name:name}\" --output table\n<\/code><\/pre>\n\n\n\n
                                                                                                                    Read-only resource and workspace verification<\/h3>\n\n\n\n
                                                                                                                    az group show --name \"rg-sentinel-foundations-lab01\" --output table\naz monitor log-analytics workspace show \\\n  --resource-group \"rg-sentinel-foundations-lab01\" \\\n  --workspace-name \"law-sentinel-foundations-lab01\" \\\n  --query \"{name:name, id:id, location:location, provisioningState:provisioningState}\" \\\n  --output json\n<\/code><\/pre>\n\n\n\n
                                                                                                                    Read subscription Activity Log events independently from workspace ingestion<\/h3>\n\n\n\n
                                                                                                                    # This queries the Azure control-plane Activity Log, NOT the Sentinel workspace.<\/em>\naz monitor activity-log list \\\n  --resource-group \"rg-sentinel-signal-lab01\" \\\n  --offset 24h \\\n  --output json\n<\/code><\/pre>\n\n\n\n
                                                                                                                    Interpret carefully:<\/strong> Azure Activity CLI\/API filters and the workspace query target different points of the pipeline. For subscription-level activity, some RG-scope filters may miss events; check an appropriately scoped subscription Activity Log view if needed. Prefer the Azure portal source-versus-destination comparison in D1-L08 when teaching beginners.<\/p>\n\n\n\n
                                                                                                                    Why no scripted bulk-provisioning or deletion in this Foundations guide?<\/h3>\n\n\n\n
                                                                                                                    A teaching environment differs from a controlled production deployment pipeline. Portal-guided provisioning makes learners explicitly inspect the tenant, scope, RBAC, export destination, cost, and consent<\/strong>. Infrastructure as Code, automated deployment and robust multi-environment cleanup belong to the Advanced module (Day 5). This is an intentional progression boundary, not a missing capability.<\/p>\n\n\n\n
                                                                                                                    \n\n\n\n
                                                                                                                    6. Instructor’s preflight, learner handoff, and evidence packaging<\/h1>\n\n\n\n
                                                                                                                    6.1 Instructor day-wise readiness matrix<\/h2>\n\n\n\n
                                                                                                                    Checklist<\/th>Before Day 1<\/th>Before Day 2<\/th><\/tr><\/thead>
                                                                                                                    Approved Azure subscription and correct directory<\/td>Required<\/td>Recheck<\/td><\/tr>
                                                                                                                    Known workspace\/RG\/region and resource suffixes<\/td>Required<\/td>Verify unchanged<\/td><\/tr>
                                                                                                                    Engineer\/provisioner\/analyst access separation<\/td>Required<\/td>Required for rule\/incident<\/td><\/tr>
                                                                                                                    Cost owner and cleanup plan<\/td>Required<\/td>Review again<\/td><\/tr>
                                                                                                                    Defender portal navigation<\/td>Check<\/td>Required<\/td><\/tr>
                                                                                                                    Azure Activity diagnostic export plan<\/td>Check and approve<\/td>Must function for live labs<\/td><\/tr>
                                                                                                                    At least one safe Azure Activity signal<\/td>Generated in D1-L08<\/td>Refresh as needed<\/td><\/tr>
                                                                                                                    Synthetic KQL fallback<\/td>Available<\/td>Available if live environment blocked<\/td><\/tr>
                                                                                                                    Built-in Azure Activity solution\/template<\/td>Install\/verify<\/td>Rule template visible<\/td><\/tr>
                                                                                                                    Controlled temporary-rule naming and suppression<\/td>Draft policy<\/td>Approve before creation<\/td><\/tr>
                                                                                                                    Incident-cases preview vs standard UI path<\/td>Discover<\/td>Select documented path<\/td><\/tr>
                                                                                                                    Compatible workbook present<\/td>Preselect<\/td>Required for workbook exercise<\/td><\/tr>
                                                                                                                    Assessment screenshots and redaction policy<\/td>Prepare<\/td>Collect<\/td><\/tr>
                                                                                                                    Rule\/connector\/workspace cleanup ownership<\/td>Assigned<\/td>Execute or document retention<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                                                                                    6.2 Evidence-folder template<\/h2>\n\n\n\n
                                                                                                                    Microsoft-Sentinel-Foundations-Labs\/\n  Day01\/\n    D1-L01-SOC-Worksheet.md\n    D1-L02-Architecture.md\n    D1-L03-Environment-Readiness.md\n    D1-L04-Workspace-Overview.png\n    D1-L05-Sentinel-Enabled.png\n    D1-L05-Defender-Workspace.png\n    D1-L06-Content-Record.md\n    D1-L07-Connector-Configuration.md\n    D1-L08-Azure-Source-Activity.png\n    D1-L08-Sentinel-AzureActivity-Result.png\n  Day02\/\n    D2-L01-Record-Worksheet.md\n    D2-L02-KQL-Queries.kql\n    D2-L03-Simulation-Results.md\n    D2-L04-Analytics-Template-Rule.png\n    D2-L05-Lab-Rule-Query.kql\n    D2-L05-Alert.png\n    D2-L05-Incident.png\n    D2-L06-Incident-Report.md\n    D2-L07-Workbook-Interpretation.png\n    D2-L08-Troubleshooting-Worksheet.md\n  Assessment\/\n    LearnerID-Foundations-Capstone.md\n    Grading-Sheet.md\n  Cleanup\/\n    END-L01-Signed-Cleanup-Record.md\n<\/code><\/pre>\n\n\n\n
                                                                                                                    Note:<\/strong> This is an illustrative tree, not automatically generated files; the user requested one Markdown guide<\/strong>, which contains all the templates and instructions. If learner evidence includes sensitive tenant identifiers or security telemetry, use an approved private repository\/document store, not a public file share.<\/p>\n\n\n\n
                                                                                                                    6.3 Curriculum traceability \u2014 every Foundation topic accounted for<\/h2>\n\n\n\n
                                                                                                                    Topic ID<\/th>Exact syllabus topic<\/th>Where it is practiced\/verified<\/th><\/tr><\/thead>
                                                                                                                    F01<\/strong><\/td>The security operations problem<\/td>D1-L01 event vs alert tabletop<\/td><\/tr>
                                                                                                                    F02<\/strong><\/td>Fundamental security terminology<\/td>D1-L01 definitions and answer checks<\/td><\/tr>
                                                                                                                    F03<\/strong><\/td>What Microsoft Sentinel provides<\/td>D1-L01 SIEM and product benefits\/limits<\/td><\/tr>
                                                                                                                    F04<\/strong><\/td>People and responsibilities<\/td>D1-L01 escalation chain; D1-L03 RBAC<\/td><\/tr>
                                                                                                                    F05<\/strong><\/td>Where Sentinel fits and when to adopt it<\/td>D1-L01 5W1H and adoption scenarios<\/td><\/tr>
                                                                                                                    F06<\/strong><\/td>Comparison with alternative approaches<\/td>D1-L01 SIEM vs EDR\/XDR\/log-only comparison<\/td><\/tr>
                                                                                                                    F07<\/strong><\/td>Foundational platform architecture<\/td>D1-L02 source\u2192ingestion\u2192detection\u2192incident diagram<\/td><\/tr>
                                                                                                                    F08<\/strong><\/td>Azure resource dependencies<\/td>D1-L02\/D1-L03 tenant\/subscription\/RG\/workspace<\/td><\/tr>
                                                                                                                    F09<\/strong><\/td>Prerequisites and deployment planning<\/td>Instructor checklist, D1-L03\/L04, cost and cleanup<\/td><\/tr>
                                                                                                                    F10<\/strong><\/td>Baseline access permissions<\/td>D1-L03 least-privilege, role matrix<\/td><\/tr>
                                                                                                                    F11<\/strong><\/td>Initial workspace setup<\/td>D1-L04\/L05 Log Analytics \u2192 Sentinel \u2192 Defender<\/td><\/tr>
                                                                                                                    F12<\/strong><\/td>First data connection<\/td>D1-L06\/L07\/L08 Azure Activity with source\/destination proof<\/td><\/tr>
                                                                                                                    F13<\/strong><\/td>Understanding ingested security records<\/td>D2-L01 field\/timestamp worksheet<\/td><\/tr>
                                                                                                                    F14<\/strong><\/td>KQL essentials<\/td>D2-L02 K01\u2013K12; D2-L03 synthetic alternative<\/td><\/tr>
                                                                                                                    F15<\/strong><\/td>Basic log validation<\/td>D1-L08 ingestion checks; D2-L01\/L02 queries<\/td><\/tr>
                                                                                                                    F16<\/strong><\/td>Built-in security content<\/td>D2-L04 template\/content roles and prerequisites<\/td><\/tr>
                                                                                                                    F17<\/strong><\/td>Activate a starter analytic rule<\/td>D2-L04 Azure Activity template; D2-L05 controlled validation<\/td><\/tr>
                                                                                                                    F18<\/strong><\/td>Detection-to-incident fundamentals<\/td>D2-L05 actual alert\/incident chain<\/td><\/tr>
                                                                                                                    F19<\/strong><\/td>Guided first-line triage<\/td>D2-L06 evidence\/alternate hypothesis<\/td><\/tr>
                                                                                                                    F20<\/strong><\/td>Basic disposition and escalation<\/td>D2-L06 classification and escalation matrix<\/td><\/tr>
                                                                                                                    F21<\/strong><\/td>Consume an out-of-box workbook<\/td>D2-L07 compatible workbook interpretation<\/td><\/tr>
                                                                                                                    F22<\/strong><\/td>Entry-level SOC operating procedure<\/td>D2-L06 SOP, D2-L08 checklist, final capstone<\/td><\/tr>
                                                                                                                    F23<\/strong><\/td>Entry-level troubleshooting<\/td>D2-L08 T01\u2013T06, extended table, root-cause record<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                                                                                    6.4 What this course does not<\/em> claim to do<\/h2>\n\n\n\n
                                                                                                                      \n
                                                                                                                    • It does\u00a0not<\/strong>\u00a0treat an offline\u00a0datatable<\/code>\u00a0as proof of real Sentinel ingestion.<\/li>\n\n\n\n
                                                                                                                    • It does\u00a0not<\/strong>\u00a0guarantee a suspicious deployment template will fire on a safe tag update.<\/li>\n\n\n\n
                                                                                                                    • It does\u00a0not<\/strong>\u00a0require a Microsoft Defender XDR E5 license solely to connect Sentinel to the Defender portal.<\/li>\n\n\n\n
                                                                                                                    • It does\u00a0not<\/strong>\u00a0say all workspaces automatically appear to all users; Defender onboarding and role scope matter.<\/li>\n\n\n\n
                                                                                                                    • It does\u00a0not<\/strong>\u00a0claim all tenants have incident-cases preview enabled.<\/li>\n\n\n\n
                                                                                                                    • It does\u00a0not<\/strong>\u00a0assume a data connector’s\u00a0Connected<\/code>\u00a0status proves every data record arrived.<\/li>\n\n\n\n
                                                                                                                    • It does\u00a0not<\/strong>\u00a0require dangerous remediation, production changes, or privilege escalation to pass.<\/li>\n\n\n\n
                                                                                                                    • It does\u00a0not<\/strong>\u00a0teach advanced AMA\/DCR\/CEF, multi-table detection correlation, UEBA enrichment, custom workbook design, SOAR playbooks, repository CI\/CD or lake\/enterprise architecture; those are later-module topics.<\/li>\n<\/ul>\n\n\n\n
                                                                                                                      \n\n\n\n
                                                                                                                      7. Official Microsoft documentation and verification log<\/h1>\n\n\n\n
                                                                                                                      Review date:<\/strong> 1 November 2026. Verification type:<\/strong> Documentation\/technical-reference review using Microsoft Learn; no authenticated live tenant execution. Links below are primary sources and should be rechecked immediately before future instructor delivery. Where Microsoft changes navigation, use the referenced article’s Defender portal<\/strong> tab and record actual UI differences.<\/p>\n\n\n\n
                                                                                                                      Ref<\/th>Official source<\/th>Guidance verified for this guide<\/th><\/tr><\/thead>
                                                                                                                      R01<\/strong><\/td>Onboard Microsoft Sentinel to a Log Analytics workspace<\/a><\/td>End-to-end quickstart, workspace, Content hub, Azure Activity connector, example Suspicious Resource deployment template, querying AzureActivity<\/td><\/tr>
                                                                                                                      R02<\/strong><\/td>Prerequisites to deploy Microsoft Sentinel<\/a><\/td>Azure\/tenant\/workspace requirements and role planning<\/td><\/tr>
                                                                                                                      R03<\/strong><\/td>Connect Microsoft Sentinel to the Microsoft Defender portal<\/a><\/td>Defender onboarding paths, automatic\/manual connection, required roles, primary workspace, no Defender XDR license just to connect Sentinel<\/td><\/tr>
                                                                                                                      R04<\/strong><\/td>Plan Microsoft Sentinel costs and billing<\/a><\/td>31-day \/ 10 GB\/day Analytics-tier trial conditions, additional charge categories, pay-as-you-go<\/td><\/tr>
                                                                                                                      R05<\/strong><\/td>Roles and permissions in Microsoft Sentinel<\/a><\/td>Reader\/Responder\/Contributor, Content hub, query\/workbook permissions and least privilege<\/td><\/tr>
                                                                                                                      R06<\/strong><\/td>Azure Activity Log overview and export<\/a><\/td>Subscription Activity logs, export to Log Analytics, AzureActivity table, source-vs-destination comparison, case-insensitive field values<\/td><\/tr>
                                                                                                                      R07<\/strong><\/td>Microsoft Defender unified RBAC permission details<\/a><\/td>Defender permissions are distinct from Azure resource RBAC and can affect case management<\/td><\/tr>
                                                                                                                      R08<\/strong><\/td>Discover and manage content from Microsoft Sentinel Content hub<\/a><\/td>Solution installation, templates vs active content, Contributor role<\/td><\/tr>
                                                                                                                      R09<\/strong><\/td>Microsoft Sentinel diagnostic-setting-based data connectors<\/a><\/td>Azure Policy-based connector requirements and diagnostic setting alternative, legacy Azure Activity transition<\/td><\/tr>
                                                                                                                      R10<\/strong><\/td>AzureActivity table schema<\/a><\/td>Field spelling and types: TimeGenerated, CategoryValue, ResourceId, ResourceGroup, Caller, OperationNameValue, ActivityStatusValue, CorrelationId<\/td><\/tr>
                                                                                                                      R11<\/strong><\/td>Azure Activity Log export troubleshooting<\/a><\/td>Diagnostic export and non-instant data availability checks<\/td><\/tr>
                                                                                                                      R12<\/strong><\/td>Log Analytics tutorial<\/a> and Getting started with log queries<\/a><\/td>KQL query execution, time filters, display of data, common no-result troubleshooting<\/td><\/tr>
                                                                                                                      R13<\/strong><\/td>Investigate incidents in Microsoft Defender (legacy)<\/a><\/td>Supported older incident workflow and evidence interpretation<\/td><\/tr>
                                                                                                                      R14<\/strong><\/td>Create scheduled analytics rules from templates<\/a><\/td>Rule templates view, source prerequisite checks, activation workflow<\/td><\/tr>
                                                                                                                      R15<\/strong><\/td>Create a scheduled analytics rule from scratch<\/a><\/td>TimeGenerated<\/code>, allowed intervals, lookback, simulation, threshold, suppression, incident creation and Defender correlation caveats<\/td><\/tr>
                                                                                                                      R16<\/strong><\/td>Investigate incident cases in Microsoft Defender<\/a><\/td>Preview case navigation, alerts\/assets\/evidence, preview access requirements<\/td><\/tr>
                                                                                                                      R17<\/strong><\/td>Manage incident cases in Microsoft Defender<\/a><\/td>Case owner\/status\/classification\/actions and sync behavior<\/td><\/tr>
                                                                                                                      R18<\/strong><\/td>Visualize and monitor data using Microsoft Sentinel workbooks<\/a><\/td>Threat management \u2192 Workbooks, template source prerequisites, save\/view process<\/td><\/tr>
                                                                                                                      R19<\/strong><\/td>Remove Microsoft Sentinel from your workspace<\/a><\/td>Authorized offboarding process versus deleting workspace<\/td><\/tr>
                                                                                                                      R20<\/strong><\/td>Implications of removing Microsoft Sentinel<\/a><\/td>Connector\/table impacts and consequences of offboarding<\/td><\/tr>
                                                                                                                      R21<\/strong><\/td>Delete and recover a Log Analytics workspace<\/a><\/td>Soft delete\/recovery and safe deletion scope<\/td><\/tr>
                                                                                                                      R22<\/strong><\/td>Azure CLI Log Analytics workspace reference<\/a><\/td>Read-only workspace show command<\/td><\/tr>
                                                                                                                      R23<\/strong><\/td>Azure CLI account commands<\/a> and Azure Activity Log Azure CLI examples<\/a><\/td>Verify Azure CLI identity and inspect activity independently<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                                                                                      7.1 Verification gaps and delivery controls<\/h2>\n\n\n\n
                                                                                                                      Claim<\/th>Documentation verified?<\/th>Requires actual tenant test?<\/th>How to close the gap<\/th><\/tr><\/thead>
                                                                                                                      Onboarding workspace from Azure portal<\/td>Yes<\/strong>, R01<\/td>Yes<\/strong><\/td>D1-L04\/L05 PASS with actual workspace screenshots<\/td><\/tr>
                                                                                                                      Defender manual\/automatic connection<\/td>Yes<\/strong>, R03<\/td>Yes<\/strong><\/td>D1-L05 workspace listed in tenant<\/td><\/tr>
                                                                                                                      Policy route and diagnostic export configuration<\/td>Yes<\/strong>, R01\/R09<\/td>Yes<\/strong><\/td>D1-L07 live export config and owner approval<\/td><\/tr>
                                                                                                                      AzureActivity<\/code> table\/fields<\/td>Yes<\/strong>, R10<\/td>Yes<\/strong> (data contents)<\/td>D1-L08 actual matching event<\/td><\/tr>
                                                                                                                      Beginner KQL operators<\/td>Yes<\/strong>, R12<\/td>Yes<\/strong> (environment and data)<\/td>D2-L02 query executions<\/td><\/tr>
                                                                                                                      datatable<\/code> simulated syntax<\/td>Yes<\/strong>, Kusto-compatible operator pattern<\/td>Yes<\/strong>, if no Kusto service is accessible<\/td>D2-L03 outputs marked simulated<\/td><\/tr>
                                                                                                                      Starter analytics template<\/td>Yes<\/strong>, R01\/R14<\/td>Yes<\/strong> (specific tenant\/version)<\/td>D2-L04 template active and prerequisites satisfied<\/td><\/tr>
                                                                                                                      Actual alert and incident creation<\/td>Yes<\/strong>, R15 explains mechanism<\/td>Always<\/strong><\/td>D2-L05 Alert ID and incident\/case ID<\/td><\/tr>
                                                                                                                      Defender incident cases preview<\/td>Yes<\/strong>, R16\/R17<\/td>Yes<\/strong> (preview scope)<\/td>Choose available Path A\/Path B in D2-L06<\/td><\/tr>
                                                                                                                      Workbook availability<\/td>Yes<\/strong>, R18 explains mechanism<\/td>Yes<\/strong> (installed compatible template)<\/td>D2-L07 actual chart\/filter evidence<\/td><\/tr>
                                                                                                                      Cleanup, billing, policy ownership<\/td>Yes<\/strong>, R19\u2013R21 for product behavior<\/td>Always<\/strong><\/td>END-L01 signed cleanup and subscription review<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
                                                                                                                      Final editorial check for instructors:<\/strong> Microsoft Sentinel and the Defender portal evolve quickly. Before repeating this class, reopen R01, R03, R08, R14\u2013R18, verify the portal-selected paths, verify new pricing\/trial terms, retest the lab signal in a disposable subscription, and update screenshots and gate expectations. An outdated icon is a cosmetic issue; a changed role prerequisite, missing connector or unsupported incident flow is a blocking lab issue<\/strong>.<\/p>\n\n\n\n
                                                                                                                      \n\n\n\n
                                                                                                                      8. Final instructor sign-off and progression decision<\/h1>\n\n\n\n
                                                                                                                      Course: Microsoft Sentinel \u2014 Foundations, Days 1 and 2\nEdition: 1 November 2026\nLearner\/Group ID: __________________________________\nDelivery model: A Full live \/ B Instructor-managed \/ C Simulation\nApproved tenant\/subscription: _______________________\nTraining workspace\/region: __________________________\nDay 1 labs completed: ______ \/ 8\nDay 2 labs completed: ______ \/ 9\nReal AzureActivity source\u2192workspace matched: Yes \/ No\nReal alert ID recorded: Yes \/ No \/ Blocked\nReal incident\/case ID recorded: Yes \/ No \/ Blocked\nKQL competency passed: Yes \/ No\nIncident disposition passed: Yes \/ No \/ Observed\nWorkbook interpretation passed: Yes \/ No \/ Blocked\nAssessment score: ______ \/ 100\nMandatory gate result: ______________________________\nIncomplete live steps and exact remediation owner: ____\nCleanup owner\/sign-off: ______________________________\nOverall result: PASS \/ OBSERVED-SETUP \/ REMEDIATION \/ BLOCKED\nEligible for Intermediate Day 3? YES \/ NO \/ AFTER REMEDIATION\nInstructor signature\/date (UTC): _____________________\n<\/code><\/pre>\n\n\n\n
                                                                                                                      Course completion principle:<\/strong> A learner who merely watched a video or copied a KQL query has not necessarily mastered security operations. Award completion based on reproducible queries, cross-verified telemetry, an investigated training incident, a reasoned decision, and responsible cleanup<\/strong>. When a real deployment dependency is unavailable, keep the simulated learning credit but record the missing live evidence transparently.<\/p>\n\n\n\n
                                                                                                                      End of the single-file Day 1 + Day 2 Foundations lab manual.<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"
                                                                                                                      Module 1: Fundamentals \/ Essentials \/ Foundations | Day 1 and Day 2 Edition: 1 November 2026Format: Two-day, instructor-led, day-wise practical manual; no hourly timetableAudience: New SOC analysts, security engineers, Azure administrators,… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1258","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1258","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=1258"}],"version-history":[{"count":2,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1258\/revisions"}],"predecessor-version":[{"id":1271,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1258\/revisions\/1271"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=1258"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=1258"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=1258"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}