{"id":1262,"date":"2026-11-01T07:05:36","date_gmt":"2026-11-01T07:05:36","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/?p=1262"},"modified":"2026-11-01T07:08:26","modified_gmt":"2026-11-01T07:08:26","slug":"microsoft-sentinel-advance-one-complete-end-to-end-hands-on-lab-part-5","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/microsoft-sentinel-advance-one-complete-end-to-end-hands-on-lab-part-5\/","title":{"rendered":"Microsoft Sentinel Advance: One Complete End-to-End Hands-On Lab &#8211; Part &#8211; 5"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Module 3: Advanced |&nbsp;<strong>Day 5 only<\/strong>&nbsp;| Enterprise Architecture, Data Lake, DevSecOps and SOC Governance<\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Edition:<\/strong>&nbsp;1 November 2026<br><strong>Training path:<\/strong>&nbsp;Day 5 of the five-day progressive Microsoft Sentinel program<br><strong>This manual:<\/strong>&nbsp;Day 5 only; syllabus competencies&nbsp;<strong>A15\u2013A27<\/strong><br><strong>Prerequisite:<\/strong>&nbsp;Days 1\u20134 operational\/evidence gates completed<br><strong>Primary UI:<\/strong>&nbsp;<a href=\"https:\/\/security.microsoft.com\/\">Microsoft Defender portal<\/a>&nbsp;for Sentinel; Azure portal for resource governance<br><strong>Output:<\/strong>&nbsp;Design decision records, data-tier plan, cost model, validated source-control workflow, health evidence and enterprise capstone<br><strong>Format:<\/strong>&nbsp;Step-by-step and day-wise;&nbsp;<strong>no hourly schedule<\/strong><br><strong>Safety:<\/strong>&nbsp;Lab-only data, no unapproved production billing, retention or security-policy changes<\/p>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">READ FIRST \u2014 scope, accuracy, real-environment caveats<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">This is a&nbsp;<strong>standalone Day 5 instructor-and-learner manual<\/strong>. It assumes students already know workspace setup, query fundamentals, non-Microsoft collection, correlation, watchlists, rule tuning, ASIM, threat hunting and guarded playbooks. Those skills are&nbsp;<strong>inputs<\/strong>, not re-taught topics.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Validation status:<\/strong>&nbsp;The steps and product behavior were researched against Microsoft Learn information available&nbsp;<strong>1 November 2026<\/strong>. This file can be structurally validated, and its offline scenarios can be calculated deterministically, but&nbsp;<strong>no actions have been executed against your live Azure\/Microsoft 365 tenant<\/strong>. Every paid, privileged, tenant-wide, preview or destructive operation has a&nbsp;<strong>read-only alternative<\/strong>&nbsp;and a measurable operational PASS condition. Do not claim that a feature is enabled because this guide describes it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>2026-specific issues you must teach correctly:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Defender portal is the primary Sentinel UI; Microsoft states Azure-portal Sentinel support ends after\u00a0<strong>31 March 2027<\/strong>\u00a0[R01]. Azure portal remains essential to administer Azure services.<\/li>\n\n\n\n<li>The\u00a0<strong>Analytics tier<\/strong>\u00a0supports real-time detections and normal interactive SOC operations; the\u00a0<strong>Data Lake tier<\/strong>\u00a0emphasizes cheaper long-term retention and job-based\/historical analytics. Moving a table to lake-only can\u00a0<strong>break real-time queries and detections<\/strong>\u00a0[R02\u2013R03]. Never modify a real table before mapping downstream dependencies.<\/li>\n\n\n\n<li>Data-lake onboarding is a\u00a0<strong>tenant-level one-time setup<\/strong>\u00a0tied to billing subscription\/resource group and the Primary SIEM workspace in Defender. It can introduce charges;\u00a0<strong>do not run onboarding unless explicitly approved<\/strong>. Onboarded resources should not be casually deleted [R04].<\/li>\n\n\n\n<li>Sentinel repository connections deploy supported\u00a0<strong>ARM or Bicep<\/strong>\u00a0custom content from GitHub or Azure DevOps. They can overwrite portal edits, and deleting a file from Git\u00a0<strong>does not automatically delete<\/strong>\u00a0the deployed Sentinel resource [R05\u2013R06].<\/li>\n\n\n\n<li>Enable\u00a0<code>SentinelHealth<\/code>\/<code>SentinelAudit<\/code>\u00a0in settings\u00a0<em>before<\/em>\u00a0expecting rows. Microsoft&#8217;s\u00a0<code>_SentinelHealth()<\/code>\u00a0and\u00a0<code>_SentinelAudit()<\/code>\u00a0functions are preferred for compatibility.\u00a0<code>SentinelHealth<\/code>\u00a0alone does\u00a0<strong>not<\/strong>\u00a0show internal Logic Apps execution; inspect Logic Apps diagnostics\/run history [R07\u2013R08].<\/li>\n\n\n\n<li>Workspace and tenant count should follow\u00a0<strong>residency, access boundaries, ownership, connector tenancy and actual operating requirements<\/strong>, not a reflexive \u201cworkspace per subscription\u201d rule [R09].<\/li>\n\n\n\n<li><strong>Costs vary by region, data type, commitment, retention, workflows and billing agreement<\/strong>; example dollar figures are illustrative only. Never apply a pricing-tier change to make a lab pass [R10\u2013R11].<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Day 5 learning outcome and 5W1H<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Lens<\/th><th class=\"has-text-align-left\" data-align=\"left\">Enterprise outcome<\/th><\/tr><\/thead><tbody><tr><td><strong>What?<\/strong><\/td><td>Workspace topology, Defender\/data-lake retention, historical jobs, telemetry unit economics, repository deployment, health\/audit, SOC SLOs and recovery<\/td><\/tr><tr><td><strong>Why?<\/strong><\/td><td>Preserve detection coverage and evidence while meeting residency, performance, change, reliability and budget constraints<\/td><\/tr><tr><td><strong>Who?<\/strong><\/td><td>Global\/local SOC, cloud\/platform team, Detection Engineering, compliance, FinOps, release approver and incident commander<\/td><\/tr><tr><td><strong>When?<\/strong><\/td><td>Split workspaces only for concrete requirements; change retention after dependency review; deploy via gated release; practice failures before incidents<\/td><\/tr><tr><td><strong>Where?<\/strong><\/td><td>Microsoft Entra tenant boundaries, Log Analytics workspaces, Defender portal, data lake, GitHub\/Azure DevOps, Azure billing and monitoring<\/td><\/tr><tr><td><strong>How?<\/strong><\/td><td>Define requirements \u2192 choose a topology \u2192 classify\/tier data \u2192 cost-model sources \u2192 govern Git deployment \u2192 verify health \u2192 defend capstone<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Aster Retail enterprise case \u2014 fictional inputs, not a production template<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Aster Retail operates in two business geographies (Region A and Region B), with regional data-residency obligations. It has a cloud operations team, central SOC, regulated HR and finance logs, network security telemetry and application audit streams. A single trained detection engineer previously built a correlated detection and a safe approval-gated playbook (Days 3\u20134). Now leadership asks for&nbsp;<strong>a production-operating model<\/strong>&nbsp;with change control, searchable history, cost guardrails and measurable SOC outcomes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Assumptions for the exercises:<\/strong>&nbsp;Both regional units have a documented legal boundary; logs containing employee identifiers may require local storage; central analysts must be able to view permitted incidents; only approved metadata is shared across borders; learner examples use fake identities and reserved documentation IP addresses. Do not assume these requirements match actual laws in any particular jurisdiction\u2014consult legal\/privacy owners in a real design.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Region A sources \/ legal entitySentinel Workspace ARegion B sources \/ legal entitySentinel Workspace BAnalytics tier: detection-ready dataAnalytics tier: detection-ready dataCentral SOC: authorized multi-workspace viewLonger-term lake retention, if approvedLonger-term lake retention, if approvedGit: PR \/ validation \/ releaseApproved workspace deploymentsHealth + audit \/ Cost ManagementHistorical lake jobs: governed access<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Diagram caveat:<\/strong>&nbsp;These arrows describe responsibilities,&nbsp;<strong>not guaranteed cross-border replication<\/strong>&nbsp;or automatic cross-tenant incident merging. The exact topology, data residence and query limits must be validated in your tenant.<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">Instructor preflight and safe lab tracks<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Preflight requirements<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>[ ] Existing\u00a0<strong>non-production<\/strong>\u00a0Sentinel-enabled workspace and Day 4 detection\/playbook artifacts; keep the latter\u00a0<strong>disabled<\/strong>\u00a0by default.<\/li>\n\n\n\n<li>[ ] Approval to view Azure\u00a0<strong>Cost Management<\/strong>, Sentinel configuration and data-table settings;\u00a0<strong>no write permission<\/strong>\u00a0to production pricing or retention for learners.<\/li>\n\n\n\n<li>[ ] One approved GitHub or Azure DevOps\u00a0<strong>test repository<\/strong>\u00a0with a designated branch, signed-off security access, GitHub Actions\/Pipelines permitted where appropriate, and no secrets committed.<\/li>\n\n\n\n<li>[ ] If repository\u00a0<strong>connection<\/strong>\u00a0will be exercised: an instructor with\u00a0<strong>Owner on the workspace resource group<\/strong>; collaborator access to GitHub or project-admin access to Azure DevOps; repository authorization policies and a\u00a0<strong>home-tenant account<\/strong>, not unsupported external guest [R05].<\/li>\n\n\n\n<li>[ ] If data lake will be exercised: verify supported region, Primary SIEM workspace, required roles, written approval from billing owner, cost control and safe resource group.\u00a0<strong>Do not delete the data-lake billing resource group<\/strong>\u00a0to clean up a lab [R04].<\/li>\n\n\n\n<li>[ ] Azure CLI installed only if optional CLI checks are used (<code>az version<\/code>); auth to approved sandbox only. Any\u00a0<code>az deployment ...<\/code>\u00a0command targets a test resource group, never production.<\/li>\n\n\n\n<li>[ ] Sentinel Health\/Audit enablement approved for\u00a0<strong>test<\/strong>\u00a0workspace and an owner assigned to review extra billed audit data [R07\u2013R08].<\/li>\n\n\n\n<li>[ ] Named SOC\/service owners, retention counsel, cost owner, change approver and final capstone reviewer.<\/li>\n\n\n\n<li>[ ] Evidence storage and cleanup process defined; no screenshots of real customer data, personal UPNs, tokens or production billing details.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Operational versus conceptual tracks<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Track<\/th><th class=\"has-text-align-left\" data-align=\"left\">Available capabilities<\/th><th class=\"has-text-align-left\" data-align=\"left\">Can claim as PASS<\/th><\/tr><\/thead><tbody><tr><td><strong>A \u2014 Full non-prod deployment<\/strong><\/td><td>Approved multiworkspace visibility, data lake access, test repo connection, health\/audit events, billing visibility<\/td><td>Live component pass only with portal\/CLI evidence; capstone pass if rubric met<\/td><\/tr><tr><td><strong>B \u2014 Instructor-run\/shared<\/strong><\/td><td>Learner authors ADRs\/KQL\/templates while instructor operates tenant-wide steps<\/td><td>Competency pass, with actor attribution to instructor<\/td><\/tr><tr><td><strong>C \u2014 Restricted\/synthetic<\/strong><\/td><td>No admin actions; read-only table samples, cost worksheet, mock PR and health fixtures<\/td><td>Design\/reasoning pass only; no claim of live data lake\/CI-CD deployment<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Control rule:<\/strong>&nbsp;Tenant-level onboarding, paid retention, commitment-tier change and repository authorization require&nbsp;<strong>separate recorded approval<\/strong>&nbsp;from the right owner. Course attendance alone is not authorization.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Evidence contract and naming<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Create&nbsp;<code>D5\/&lt;learner-id&gt;\/<\/code>&nbsp;with folders&nbsp;<code>01-architecture<\/code>,&nbsp;<code>02-data<\/code>,&nbsp;<code>03-economics<\/code>,&nbsp;<code>04-delivery<\/code>,&nbsp;<code>05-observability<\/code>,&nbsp;<code>06-capstone<\/code>&nbsp;and a&nbsp;<code>validation-ledger.md<\/code>&nbsp;file. For each real lab record: UTC timestamp, workspace\/subscription scope, exact query or file version, expected result, observed result, operator, PASS\/BLOCKED\/SUBSTITUTED and redacted proof. If a live action did not execute, mark&nbsp;<strong>not tested<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">DAY 5 \u2014 STEP-BY-STEP LABS<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">D5-L00 \u2014 Enterprise preflight and artifact handoff from Days 1\u20134<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mapped:<\/strong>&nbsp;prerequisites, A15\/A22\/A26.&nbsp;<strong>Purpose:<\/strong>&nbsp;Make the new enterprise exercises traceable to tested baseline artifacts.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Open Defender and select the\u00a0<strong>correct<\/strong>\u00a0Sentinel workspace and organization tenant. Record both names and subscription\/region in the private evidence ledger.<\/li>\n\n\n\n<li>Inspect the\u00a0<strong>Day 4<\/strong>\u00a0detection design, query and regression matrix. Preserve its query as a reviewed input; avoid inventing a new rule simply for repository exercises.<\/li>\n\n\n\n<li>Inspect the\u00a0<strong>Day 4<\/strong>\u00a0approval-gated Logic App. Confirm lab-only automation is\u00a0<strong>disabled<\/strong>\u00a0and there are no pending test approvals that could act unexpectedly.<\/li>\n\n\n\n<li>Verify the source field contract, synthetic\/real evidence labels and incident ownership. Record which dependencies need real-time Analytics-tier data (detection, hunting, workbook, playbook lookup) and which are historical\/compliance needs.<\/li>\n\n\n\n<li>Review the Git test repository branch and Azure resource group permission.\u00a0<strong>Block<\/strong>\u00a0any automatic production deployment until the branch, credentials and connection scopes have been reviewed.<\/li>\n\n\n\n<li>Agree with the instructor which tasks are\u00a0<strong>read-only<\/strong>\u00a0and which are allowed to\u00a0<strong>provision<\/strong>. Obtain billing-owner signoff for any optional data-lake setup.<\/li>\n\n\n\n<li>Complete a short preflight evidence sheet with signature fields for platform owner, security owner, FinOps reviewer and instructor.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PASS:<\/strong>&nbsp;A verified Day 4 input artifact, scoped resources\/roles, cost-approved lab track and no unexpected active automation.<br><strong>Evidence:<\/strong>&nbsp;<code>D5-L00-preflight.md<\/code>; source IDs and signoff.&nbsp;<strong>Read:<\/strong>&nbsp;[R01], [R05], [R09].<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">D5-L01 \u2014 Choose single versus multiple workspaces on defensible requirements<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mapped:<\/strong>&nbsp;A15.&nbsp;<strong>Outcome:<\/strong>&nbsp;A documented workspace\/tenant strategy, not an arbitrary workspace count.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Read the enterprise scenario and classify each requirement:\u00a0<strong>must<\/strong>,\u00a0<strong>should<\/strong>, or\u00a0<strong>nice to have<\/strong>. Include residency, independent admin ownership, data access restrictions, cost allocation, tenant-specific Microsoft connectors, SOC visibility, incident handling and query limitations.<\/li>\n\n\n\n<li>Draw two candidate topologies:\u00a0<strong>Option S \u2014 a single centralized workspace<\/strong>\u00a0and\u00a0<strong>Option M \u2014 separate regional workspaces with authorized cross-workspace SOC operations<\/strong>.<\/li>\n\n\n\n<li>Use this decision matrix;\u00a0<em>do not fill in \u201csupports\u201d by intuition<\/em>:<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Criterion<\/th><th class=\"has-text-align-left\" data-align=\"left\">Option S: one workspace<\/th><th class=\"has-text-align-left\" data-align=\"left\">Option M: regional workspaces<\/th><th class=\"has-text-align-left\" data-align=\"left\">Test \/ owner<\/th><\/tr><\/thead><tbody><tr><td>Data residency<\/td><td>Might conflict with region-specific obligations<\/td><td>Regional isolation possible<\/td><td>Legal\/privacy approval<\/td><\/tr><tr><td>SOC operations<\/td><td>Simpler central analysis<\/td><td>Requires multiworkspace permissions\/workflows<\/td><td>SOC lead<\/td><\/tr><tr><td>Access boundary<\/td><td>Workspace\/table RBAC may be sufficient<\/td><td>Separate workspace administrative boundary<\/td><td>IAM owner<\/td><\/tr><tr><td>Tenant-local SaaS connectors<\/td><td>Some require same tenant as destination<\/td><td>Usually need local tenant workspace<\/td><td>Connector engineer<\/td><\/tr><tr><td>Cost allocation<\/td><td>Shared billing<\/td><td>Per workspace\/entity accounting<\/td><td>FinOps<\/td><\/tr><tr><td>Operational overhead<\/td><td>Lower baseline<\/td><td>More connectors, rules and change coordination<\/td><td>Platform lead<\/td><\/tr><tr><td>Query\/incident reach<\/td><td>Simple single workspace<\/td><td>Must test multiworkspace access\/limits<\/td><td>SOC engineer<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<ol start=\"4\" class=\"wp-block-list\">\n<li>Determine whether\u00a0<strong>multiple Entra tenants<\/strong>\u00a0are involved. Microsoft notes tenant-local Microsoft\/Azure SaaS connectors generally need a workspace in each corresponding tenant [R09]. Do not promise direct cross-tenant collection through a native connector without checking.<\/li>\n\n\n\n<li>In Defender, inspect any supported\u00a0<strong>SIEM workspaces<\/strong>\u00a0and multitenant management capabilities\u00a0<strong>without adding<\/strong>\u00a0a new tenant. If connecting a secondary workspace is shown as preview, record it as\u00a0<strong>preview<\/strong>\u00a0and require supported feature\/permission checks [R12].<\/li>\n\n\n\n<li>If instructor approved, demonstrate a read-only cross-workspace query against two\u00a0<strong>accessible<\/strong>\u00a0workspaces; replace the placeholders with exact approved workspace IDs. If the tables are not in both workspaces, use a shared common table available in both or mark as unavailable.<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/ D5-L01 optional: Log Analytics cross-workspace example.\n\/\/ Replace values only with approved, accessible workspace GUIDs.\nunion withsource=WorkspaceSource\n  workspace('00000000-0000-0000-0000-000000000001').AzureActivity,\n  workspace('00000000-0000-0000-0000-000000000002').AzureActivity\n| where TimeGenerated &gt;= ago(1d)\n| summarize EventCount=count() by WorkspaceSource\n<\/code><\/pre>\n\n\n\n<ol start=\"7\" class=\"wp-block-list\">\n<li>State clearly: the GUIDs above are\u00a0<strong>fake<\/strong>\u00a0and the query will not run unchanged. The\u00a0<code>workspace()<\/code>\u00a0form applies to supported Log Analytics cross-workspace queries; Defender unified advanced hunting can have different scoping controls. Document actual syntax used and granted access.<\/li>\n\n\n\n<li>Produce an\u00a0<strong>Architecture Decision Record<\/strong>\u00a0(ADR) with\u00a0<em>decision, rationale, rejected options, consequences, required validation, owner and revisit triggers<\/em>.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PASS:<\/strong>&nbsp;ADR justified by at least three genuine constraints, not preference; cross-workspace capabilities honestly described; tenant-bound connector limits acknowledged.<br><strong>Evidence:<\/strong>&nbsp;<code>D5-L01-workspace-architecture-ADR.md<\/code>, two topology diagrams.&nbsp;<strong>Read:<\/strong>&nbsp;[R09], [R12].<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">D5-L02 \u2014 Design production reference architecture and trust boundaries<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mapped:<\/strong>&nbsp;A16.&nbsp;<strong>Outcome:<\/strong>&nbsp;Turn the workspace decision into security-operable architecture.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Extend the selected architecture with\u00a0<strong>sources \u2192 ingestion path \u2192 workspace\/tier \u2192 detection \u2192 incident\/case \u2192 approved response \u2192 audit<\/strong>. Include separate control-plane and data-plane responsibilities.<\/li>\n\n\n\n<li>Define a\u00a0<strong>RACI<\/strong>\u00a0for every component: data-source owner, connector operator, detection engineer, incident responder, platform IAM administrator, compliance owner and FinOps.<\/li>\n\n\n\n<li>Identify all\u00a0<strong>cross-boundary flows<\/strong>\u00a0(region, tenant, team, provider, service principal) and write the specific allowed data elements. If residency requires local storage, centralize only\u00a0<strong>permitted summaries or investigations<\/strong>, not unreviewed full raw logs.<\/li>\n\n\n\n<li>For each workspace document region, subscription, resource group, source list, owner, Microsoft Entra access, rule deployment branch, incident routing, retention classification, budget allocation and escalation contact.<\/li>\n\n\n\n<li>Perform a\u00a0<strong>threat-model walk-through<\/strong>: excessive access, poisoned data, missing source, unauthorized rule deployment, stale TI, missing audit, cross-region exposure and failed connector token.<\/li>\n\n\n\n<li>List explicit operational dependencies: Defender portal access, connector API, AMAs\/DCRs (if deployed earlier), Log Analytics, Git authorization, approval provider, Logic Apps and cost-monitoring service.<\/li>\n\n\n\n<li>Define a\u00a0<strong>no-single-point-of-knowledge<\/strong>\u00a0handoff: repository documents, backup operator, runbooks and escalation chain.<\/li>\n\n\n\n<li>Review the design with the instructor using these acceptance questions:\n<ul class=\"wp-block-list\">\n<li>Can a regional owner restrict raw security evidence without blocking authorized central triage?<\/li>\n\n\n\n<li>Can the SOC detect a stopped critical connector?<\/li>\n\n\n\n<li>Can a new rule be blocked or rolled back?<\/li>\n\n\n\n<li>Can incidents be investigated when the approval system is unavailable?<\/li>\n\n\n\n<li>Are data residency and privacy assertions reviewed by the proper authority?<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PASS:<\/strong>&nbsp;Architecture diagram, RACI, trust-boundary inventory and at least five design risks with mitigations.<br><strong>Evidence:<\/strong>&nbsp;<code>D5-L02-reference-architecture.md<\/code>,&nbsp;<code>D5-L02-boundaries.csv<\/code>.&nbsp;<strong>Read:<\/strong>&nbsp;[R09], [R12].<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">D5-L03 \u2014 Audit Analytics versus Data Lake tier and retention policies<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mapped:<\/strong>&nbsp;A17.&nbsp;<strong>Outcome:<\/strong>&nbsp;Protect active detections while selecting retention based on security and governance needs.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In\u00a0<strong>Defender > Microsoft Sentinel<\/strong>, navigate to the supported\u00a0<strong>Data management \/ Tables<\/strong>\u00a0or connector table management experience.\u00a0<strong>Observe<\/strong>, but do not change, each source table&#8217;s analytics retention, total retention, billing plan and last-seen events.<\/li>\n\n\n\n<li>Identify which sources feed a\u00a0<strong>real-time analytics rule<\/strong>,\u00a0<strong>workbook<\/strong>,\u00a0<strong>watchlist-based correlation<\/strong>\u00a0or\u00a0<strong>live investigation<\/strong>. Those inputs require the appropriate interactive Analytics-tier availability. A lake-only change is\u00a0<strong>not<\/strong>\u00a0a harmless cost toggle.<\/li>\n\n\n\n<li>Classify at least five sources using the template:<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Source example<\/th><th class=\"has-text-align-left\" data-align=\"left\">Detection critical?<\/th><th class=\"has-text-align-left\" data-align=\"left\">Proposed tier<\/th><th class=\"has-text-align-left\" data-align=\"left\">Analytics retention<\/th><th class=\"has-text-align-left\" data-align=\"left\">Total\/lake retention<\/th><th class=\"has-text-align-left\" data-align=\"left\">Legal owner<\/th><th class=\"has-text-align-left\" data-align=\"left\">Why<\/th><\/tr><\/thead><tbody><tr><td>Privileged identity sign-ins<\/td><td>Yes<\/td><td>Analytics + optional mirrored lake<\/td><td>Policy-defined<\/td><td>Policy-defined<\/td><td>IAM\/SOC<\/td><td>Real-time account misuse detection<\/td><\/tr><tr><td>Security firewall alerts<\/td><td>Yes<\/td><td>Analytics + lake when justified<\/td><td>Policy-defined<\/td><td>Policy-defined<\/td><td>Network SOC<\/td><td>Network correlation<\/td><\/tr><tr><td>High-volume debug traces<\/td><td>Maybe<\/td><td>Conditional lake-only<\/td><td>Not applicable if lake-only<\/td><td>Policy-defined<\/td><td>App owner<\/td><td>Little real-time detection value<\/td><\/tr><tr><td>Access evidence \/ audit<\/td><td>Depends<\/td><td>Analytics for critical subset<\/td><td>Policy-defined<\/td><td>Longer-term per legal need<\/td><td>Compliance<\/td><td>Forensic and legal record<\/td><\/tr><tr><td>Container platform audit<\/td><td>Yes where used by active rules<\/td><td>Analytics + lake<\/td><td>Policy-defined<\/td><td>Policy-defined<\/td><td>Platform SOC<\/td><td>Change\/identity investigation<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<ol start=\"4\" class=\"wp-block-list\">\n<li>Compare expected availability:\u00a0<strong>Analytics = interactive real-time security features<\/strong>;\u00a0<strong>Data Lake = historical KQL jobs\/notebooks and cheaper extended storage, with noninteractive limitations<\/strong>\u00a0[R02\u2013R03].<\/li>\n\n\n\n<li>Check the actual defaults in the current tenant. Microsoft documents\u00a0<strong>30 days default Analytics retention in certain Defender\/Sentinel table contexts<\/strong>, plus\u00a0<strong>90-day no-extra-charge extension for qualifying Sentinel solution tables<\/strong>; defaults and charges are not identical for every table [R02]. Record what your table settings actually show.<\/li>\n\n\n\n<li>Calculate proposed\u00a0<strong>effective detection lookback<\/strong>\u00a0against retained analytics days. For every rule, its query&#8217;s needed data must remain in a suitable tier for scheduled evaluation. Identify at least one rule that would break if a table went lake-only.<\/li>\n\n\n\n<li>Conduct a\u00a0<strong>change impact review<\/strong>: data inventory, data-owner signoff, affected queries\/rules, historical lookback, billing estimates, rollback behavior and legal hold. Shortening retention could have delayed deletion semantics; do not assume an immediate or instant reversible switch.<\/li>\n\n\n\n<li><strong>Optional, only with written approval and an isolated throwaway test table:<\/strong>\u00a0change a low-value test table&#8217;s retention\/tier, verify it, then revert through the approved procedure.\u00a0<strong>Never<\/strong>\u00a0apply the step to live security tables used by Day 4.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PASS:<\/strong>&nbsp;Table-to-detection dependency matrix, selected tiers with defensible rationale, and a list of impacts of lake-only conversion. Live tier change is&nbsp;<strong>optional<\/strong>&nbsp;and not required for the conceptual PASS.<br><strong>Evidence:<\/strong>&nbsp;<code>D5-L03-tier-retention-matrix.csv<\/code>,&nbsp;<code>D5-L03-dependency-review.md<\/code>.&nbsp;<strong>Read:<\/strong>&nbsp;[R02\u2013R03].<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">D5-L04 \u2014 Assess and optionally onboard the Microsoft Sentinel data lake<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mapped:<\/strong>&nbsp;A17, A18.&nbsp;<strong>Outcome:<\/strong>&nbsp;Know exactly what requires tenant-level authorization and prove the lake is actually available before claiming a deployment.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Track 1 \u2014 default read-only assessment (safe in any tenant)<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In Defender, navigate to\u00a0<strong>System > Settings > Microsoft Sentinel > Data lake<\/strong>. Record whether the tenant is already onboarded, the setup button is available, or the panel reports a permission\/feature limitation [R04].<\/li>\n\n\n\n<li>Confirm the intended\u00a0<strong>Primary SIEM workspace<\/strong>\u00a0and its region. Do not infer that every additional workspace is automatically included: Microsoft documents extra steps for some workspaces created after lake onboarding.<\/li>\n\n\n\n<li>Check the official\u00a0<strong>supported-region list<\/strong>, data-lake role requirements and available billing subscription\/resource group. If any is unclear, stop at this read-only checkpoint.<\/li>\n\n\n\n<li>Prepare a risk\/approval sheet with: billing owner, one-time setup owner, chargeback, resource group, data residency, retention, permissions, cleanup restrictions and operational support contact.<\/li>\n\n\n\n<li>Record the expected proof of successful setup: setup status is complete, supported lake exploration appears, access to at least one allowed table is verified and related cost-governance owners know about it. Merely having a menu entry is not enough.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Track 2 \u2014 optional&nbsp;<em>approved<\/em>&nbsp;onboarding (not to be done by ordinary students)<\/h3>\n\n\n\n<ol start=\"6\" class=\"wp-block-list\">\n<li>Obtain explicit written approval for\u00a0<strong>tenant-level data-lake onboarding and its billing arrangement<\/strong>. The subscription\/resource group selection is significant and is not casually movable after setup.<\/li>\n\n\n\n<li>Ensure the workspace is connected to the Defender portal and set as\u00a0<strong>Primary SIEM<\/strong>, following the official onboarding prerequisites. Do not proceed using an arbitrary non-primary workspace.<\/li>\n\n\n\n<li>In\u00a0<strong>System > Settings > Microsoft Sentinel > Data lake<\/strong>, select\u00a0<strong>Start setup<\/strong>\u00a0if the tenant is not already onboarded. Choose the\u00a0<strong>approved<\/strong>\u00a0subscription and resource group and select the documented\u00a0<strong>Set up data lake<\/strong>\u00a0action.<\/li>\n\n\n\n<li>Revisit the settings page to confirm completion. Microsoft notes the operation can take time. Do\u00a0<strong>not<\/strong>\u00a0repeatedly recreate provisioning resources because the UI has not immediately updated.<\/li>\n\n\n\n<li>Open\u00a0<strong>Microsoft Sentinel > Query data lake<\/strong>\u00a0or the current Data lake exploration entry in Defender. Inspect an allowed table and save a\u00a0<em>read-only<\/em>\u00a0query\/result.<\/li>\n\n\n\n<li>Record the exact tenant, billing resource group, setup status, table availability and UTC query evidence. If onboarding fails, save the error and stop; do\u00a0<strong>not<\/strong>\u00a0delete the data lake&#8217;s billing subscription\/resource group to reset it.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PASS (read-only):<\/strong>&nbsp;Feature eligibility, roles, cost ownership and safe decision documented.&nbsp;<strong>Operational PASS:<\/strong>&nbsp;authorized setup shows complete status and a real lake query against approved data succeeds.<br><strong>Evidence:<\/strong>&nbsp;<code>D5-L04-lake-preflight.md<\/code>, redacted setup-status screenshot and observed query result if executed.<br><strong>Troubleshooting:<\/strong>&nbsp;No Start setup \u2192 already onboarded, missing roles, unsupported configuration or integration prerequisites; no new table \u2192 inclusion\/mirroring configuration or propagation delay; query denied \u2192 lake role\/workspace permissions; region mismatch \u2192 review supported geographies.<br><strong>Read:<\/strong>&nbsp;[R04], [R13].<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">D5-L05 \u2014 Investigate historical telemetry with KQL jobs<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mapped:<\/strong>&nbsp;A18.&nbsp;<strong>Outcome:<\/strong>&nbsp;Distinguish&nbsp;<em>interactive exploration<\/em>&nbsp;from a&nbsp;<em>persisted historical job<\/em>, and control where results are written.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>If the lake is already available, open\u00a0<strong>Microsoft Sentinel > Data lake exploration > Query data lake<\/strong>\u00a0and inspect the table selector. Select a table that contains approved test or non-sensitive data.\u00a0<strong>Do not expect arbitrary Log Analytics custom tables to be present without lake inclusion.<\/strong><\/li>\n\n\n\n<li>Run a\u00a0<strong>read-only<\/strong>\u00a0KQL aggregation against an available lake table. The following is an example\u00a0<strong>only if\u00a0<code>AzureActivity<\/code>\u00a0is visible<\/strong>; otherwise replace table and fields after confirming actual schema:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/ D5-L05: example retrospective query on available lake data.\nAzureActivity\n| where TimeGenerated &gt;= ago(7d)\n| summarize Events=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated)\n    by OperationNameValue\n| top 20 by Events desc\n<\/code><\/pre>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li>Record the query time, source workspace selection, UTC range, number of returned records and which table\/columns are present. If zero records, distinguish\u00a0<em>no matching events<\/em>\u00a0from a source not mirrored\/ingested or a denied query.<\/li>\n\n\n\n<li>Explain the business use case for a\u00a0<strong>KQL job<\/strong>: repeat a historical investigation, summarize high-volume low-fidelity records, scan retrospective indicators or promote only selected results to Analytics-tier tables for further investigation [R14].<\/li>\n\n\n\n<li><strong>Before creating any job<\/strong>, check cost, permissions, result destination, table naming, privacy classification and whether the job could reprocess large historical volumes. Running a query and\u00a0<strong>creating a job<\/strong>\u00a0are separate actions.<\/li>\n\n\n\n<li>If approved, open\u00a0<strong>Microsoft Sentinel > Data lake exploration > Jobs > Create job<\/strong>, or\u00a0<strong>Create job<\/strong>\u00a0from the query editor. Give the job a unique name and description. The documentation states job names may not contain\u00a0<code>#<\/code>\u00a0or\u00a0<code>-<\/code>, so use a name such as\u00a0<code>D5LakeReview&lt;initials><\/code>\u00a0[R14].<\/li>\n\n\n\n<li>Choose\u00a0<strong>one-time<\/strong>\u00a0for the exercise. Select the approved destination\u00a0<strong>workspace<\/strong>\u00a0and\u00a0<strong>new<\/strong>\u00a0result table. Confirm that the destination is not a shared existing table and that the columns\/time scope are minimized. Some destination types require additional roles; follow the wizard&#8217;s exact permission feedback.<\/li>\n\n\n\n<li>In the wizard select the intended source workspaces; review the query, destination table schema, UTC window, cost estimate\/approval and result classification.\u00a0<strong>Only an instructor with write authorization selects Submit.<\/strong><\/li>\n\n\n\n<li>After execution, open the\u00a0<strong>job status<\/strong>\u00a0and its destination table. Validate a\u00a0<code>Succeeded<\/code>\u00a0state\u00a0<strong>and<\/strong>\u00a0the expected records in the destination. New Analytics-tier job tables can use a\u00a0<code>_KQL_CL<\/code>\u00a0suffix, depending on job type [R14].<\/li>\n\n\n\n<li>If the organization will not authorize a job, complete a\u00a0<strong>design-only alternative<\/strong>: take a screenshot of the query result, fill in the job specification and state\u00a0<em>Job not submitted; historical query demonstrated only<\/em>.<\/li>\n\n\n\n<li>Document how to avoid unnecessary large outputs (time bounds,\u00a0<code>project<\/code>\u00a0only needed columns, aggregated results, destination retention). State the handoff plan if historical data must be used to create a new detection in Analytics tier.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PASS:<\/strong>&nbsp;Historical query with explicit time\/range and table; job lifecycle described.&nbsp;<strong>Operational job PASS:<\/strong>&nbsp;real job status plus output-table records and cost owner documented.<br><strong>Evidence:<\/strong>&nbsp;<code>D5-L05-kql-job-design.md<\/code>, query text, optional job ID\/output record count.<br><strong>Troubleshooting:<\/strong>&nbsp;Missing lake table \u2192 tier\/onboarding; permission denied on destination \u2192 role or lake managed identity; job succeeded with zero rows \u2192 source\/time filter; schema mismatch \u2192 adjust output columns; large unexpected cost \u2192 stop before resubmission.<br><strong>Read:<\/strong>&nbsp;[R04], [R14].<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">D5-L06 \u2014 Measure security-data ingestion and form a cost baseline<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mapped:<\/strong>&nbsp;A19.&nbsp;<strong>Outcome:<\/strong>&nbsp;Convert telemetry volumes into cost drivers while separating&nbsp;<em>measured usage<\/em>&nbsp;from&nbsp;<em>estimated price<\/em>.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In Azure\u00a0<strong>Cost Management + Billing > Cost analysis<\/strong>, choose the\u00a0<strong>approved test<\/strong>\u00a0subscription\/resource-group scope. Inspect recent daily costs for Sentinel, Azure Monitor\/Log Analytics, Logic Apps, storage and data-lake resources where present.<\/li>\n\n\n\n<li>Record the\u00a0<strong>currency<\/strong>, billing account, pricing plan, region, commitment tier, credit\/grant and whether the cost line is actual or amortized. Different scopes and contracts can change the numbers;\u00a0<strong>never quote the worked example as an actual Microsoft price<\/strong>.<\/li>\n\n\n\n<li>In Defender Table management, use\u00a0<strong>Table insights<\/strong>\u00a0to inspect ingestion patterns and unusual volumes. Microsoft notes Table insights is\u00a0<strong>not a billing-grade surface<\/strong>; reconcile with Cost Management for monetary conclusions [R02].<\/li>\n\n\n\n<li>If the workspace exposes the Log Analytics\u00a0<strong><code>Usage<\/code><\/strong>\u00a0table, run the following read-only query from the appropriate workspace query context. Validate whether\u00a0<code>Quantity<\/code>\u00a0is in MB for the returned table before converting to GiB:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/ D5-L06A: approximate data-volume profile, if Usage exists.\nUsage\n| where TimeGenerated &gt;= ago(7d)\n| summarize UsageMB=sum(Quantity) by DataType\n| extend ApproxGiB=round(UsageMB \/ 1024.0, 2)\n| top 20 by ApproxGiB desc\n<\/code><\/pre>\n\n\n\n<ol start=\"5\" class=\"wp-block-list\">\n<li>If\u00a0<code>Usage<\/code>\u00a0is absent or insufficient, use Table insights and Azure Cost Management exports instead;\u00a0<strong>do not claim zero ingestion from a missing table<\/strong>. Data ingestion estimates from\u00a0<code>_BilledSize<\/code>\u00a0in eligible tables are approximate and not a substitute for the invoice.<\/li>\n\n\n\n<li>For a bounded raw-data comparison where the table exposes billing fields, use a schema-confirmed query such as:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/ D5-L06B: illustrative table-level size (use only if _BilledSize exists).\nAzureActivity\n| where TimeGenerated &gt;= ago(1d)\n| summarize Events=count(), ApproxGiB=round(sum(_BilledSize)\/1024.0\/1024.0\/1024.0, 4)\n<\/code><\/pre>\n\n\n\n<ol start=\"7\" class=\"wp-block-list\">\n<li>Reconcile table volume with\u00a0<strong>free\/charged<\/strong>\u00a0data-source distinctions and your actual contract. Some alert and Azure Activity sources have special pricing; raw event types can still be billable [R10]. Do not multiply all ingest by a single rate without checking.<\/li>\n\n\n\n<li>Assemble a baseline with these fields: source\/table, ingest GiB\/day, committed\/variable rate, chargeability, analytics retention, lake retention, queries\/jobs, Logic Apps executions, business owner and estimated monthly total.<\/li>\n\n\n\n<li>List at least three cost risks not captured by raw ingestion alone: lake KQL job compute, longer retention, downstream workflow\/API calls, duplicate connectors, cross-region transfer or separate storage\/service charges.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PASS:<\/strong>&nbsp;Source volumes, cost scope\/currency and estimating assumptions documented; at least one actual observation or explicitly labeled instructor-supplied fixture.<br><strong>Evidence:<\/strong>&nbsp;<code>D5-L06-cost-baseline.csv<\/code>, sanitized Azure cost dashboard extract.<br><strong>Troubleshooting:<\/strong>&nbsp;Usage table empty \u2192 use billing or table insights; unexpected fees \u2192 separate the Sentinel and Monitor pricing modes; charge discrepancy \u2192 currency, daily allocation, free sources and invoice delays.&nbsp;<strong>Read:<\/strong>&nbsp;[R02], [R10\u2013R11].<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">D5-L07 \u2014 Build and independently verify a telemetry economics model<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mapped:<\/strong>&nbsp;A19, A20.&nbsp;<strong>Outcome:<\/strong>&nbsp;Make cost tradeoffs explainable without relying on fabricated current price lists.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Model inputs (illustrative teaching rates only; NOT Microsoft quotations):<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Source<\/th><th class=\"has-text-align-right\" data-align=\"right\">GiB\/day total<\/th><th class=\"has-text-align-right\" data-align=\"right\">GiB\/day Analytics<\/th><th class=\"has-text-align-right\" data-align=\"right\">GiB\/day lake-only<\/th><th class=\"has-text-align-left\" data-align=\"left\">Driver<\/th><\/tr><\/thead><tbody><tr><td>Identity \/ high-value access<\/td><td class=\"has-text-align-right\" data-align=\"right\">5<\/td><td class=\"has-text-align-right\" data-align=\"right\">5<\/td><td class=\"has-text-align-right\" data-align=\"right\">0<\/td><td>Active detections<\/td><\/tr><tr><td>Network activity<\/td><td class=\"has-text-align-right\" data-align=\"right\">40<\/td><td class=\"has-text-align-right\" data-align=\"right\">10<\/td><td class=\"has-text-align-right\" data-align=\"right\">30<\/td><td>Selective alerting, full history<\/td><\/tr><tr><td>Application diagnostics<\/td><td class=\"has-text-align-right\" data-align=\"right\">25<\/td><td class=\"has-text-align-right\" data-align=\"right\">5<\/td><td class=\"has-text-align-right\" data-align=\"right\">20<\/td><td>Low-priority historical review<\/td><\/tr><tr><td><strong>Total<\/strong><\/td><td class=\"has-text-align-right\" data-align=\"right\"><strong>70<\/strong><\/td><td class=\"has-text-align-right\" data-align=\"right\"><strong>20<\/strong><\/td><td class=\"has-text-align-right\" data-align=\"right\"><strong>50<\/strong><\/td><td><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Assume&nbsp;<strong>for arithmetic teaching only<\/strong>: Analytics ingest&nbsp;<strong>$4.00\/GiB<\/strong>, lake-only ingest&nbsp;<strong>$0.60\/GiB<\/strong>, 30-day month, and $0.03\/GiB-month incremental historical storage across&nbsp;<strong>90 days of lake-only<\/strong>&nbsp;data. These invented unit rates are&nbsp;<strong>not current pricing<\/strong>, and the model intentionally ignores commitment discounts, special source exclusions, mirrored storage inclusion, execution\/compute and support costs. They must be replaced with the organization&#8217;s approved rate sheet.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code><em># D5-L07 - arithmetic-only model. No cloud access; replace with approved rates.<\/em>\nsources = &#91;(\"Identity\", 5, 0), (\"Network\", 10, 30), (\"Application\", 5, 20)]\nanalytics_gib = sum(a for _, a, _ in sources)\nlake_only_gib = sum(l for _, _, l in sources)\nmonth_days = 30\nanalytics_rate = 4.00  <em># Illustrative only<\/em>\nlake_ingest_rate = 0.60  <em># Illustrative only<\/em>\nlake_storage_rate = 0.03  <em># Illustrative only<\/em>\nlake_retention_days = 90\nmonthly_analytics = analytics_gib * month_days * analytics_rate\nmonthly_lake_ingest = lake_only_gib * month_days * lake_ingest_rate\nstored_lake_gib = lake_only_gib * lake_retention_days\nmonthly_storage = stored_lake_gib * lake_storage_rate\nprint({\"analytics\": monthly_analytics, \"lake_ingest\": monthly_lake_ingest,\n       \"storage\": monthly_storage,\n       \"illustrative_total\": monthly_analytics + monthly_lake_ingest + monthly_storage})\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Expected illustrative output:<\/strong>&nbsp;Analytics&nbsp;<strong>$2,400<\/strong>&nbsp;+ lake ingestion&nbsp;<strong>$900<\/strong>&nbsp;+ incremental lake storage&nbsp;<strong>$135<\/strong>&nbsp;=&nbsp;<strong>$3,435\/month<\/strong>. This is a model only. The storage calculation represents a&nbsp;<em>steady-state<\/em>&nbsp;approximation and should not be treated as an invoice line.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Run the Python snippet locally (or verify with a calculator). Save the inputs and output.<\/li>\n\n\n\n<li>Create three scenarios using\u00a0<strong>approved actual rates<\/strong>: current all-Analytics, selected retention\/lake split, and risk-averse high-fidelity coverage. Do not assume a lower unit price makes a security-important data source safe to move to lake-only.<\/li>\n\n\n\n<li>Perform\u00a0<strong>sensitivity analysis<\/strong>: (a) 2x network data, (b) 30% reduction in app diagnostics through approved filtering, (c) longer regulatory retention. Show costs\u00a0<em>and<\/em>\u00a0detection implications.<\/li>\n\n\n\n<li>Include\u00a0<strong>pipeline\/test costs<\/strong>\u00a0such as KQL jobs, connector\/API operations and Logic Apps, clearly as separate assumptions.<\/li>\n\n\n\n<li>Add governance guardrails: daily ingest anomaly alert, forecast threshold, per-source owner, quarterly retention review, rate-plan approval and exception records.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PASS:<\/strong>&nbsp;Reproducible spreadsheet\/arithmetic, three scenarios, at least one documented security-coverage tradeoff and a financial disclaimer.<br><strong>Evidence:<\/strong>&nbsp;<code>D5-L07-telemetry-model.md<\/code>&nbsp;or&nbsp;<code>.csv<\/code>&nbsp;generated by learners (the manual itself remains one MD).&nbsp;<strong>Read:<\/strong>&nbsp;[R10\u2013R11].<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">D5-L08 \u2014 Prioritize telemetry by detection value; prevent accidental blind spots<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mapped:<\/strong>&nbsp;A20.&nbsp;<strong>Outcome:<\/strong>&nbsp;Save cost&nbsp;<em>only when observable security coverage and policy remain acceptable<\/em>.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>List sources by\u00a0<strong>threat scenarios they actually support<\/strong>\u00a0(privileged access, persistence, lateral movement, business-application fraud, exfiltration and infrastructure change), not merely by GiB\/day.<\/li>\n\n\n\n<li>For each candidate reduction, identify the exact\u00a0<strong>analytic rule<\/strong>, hunting query, workbook or compliance control that depends on the table or field.<\/li>\n\n\n\n<li>Classify three cost actions: (a) eliminate confirmed duplicate collection, (b) filter\u00a0<strong>unnecessary<\/strong>\u00a0low-value messages at the approved ingestion transform\/source, (c) change retention\/tier only after a dependency and legal review.<\/li>\n\n\n\n<li>Explicitly\u00a0<strong>reject<\/strong>\u00a0changes that would remove necessary event IDs, timestamps, actor\/target distinction or privileged event records from an active detection. A lower log bill is not a win if it creates unmonitored high-risk access.<\/li>\n\n\n\n<li>Propose\u00a0<strong>before\/after verification<\/strong>: same synthetic attack fixture, expected source event counts, row parsing fidelity, rule outputs, workbook observations, missed-event check and cost change.<\/li>\n\n\n\n<li>Record a control owner&#8217;s written decision and rollback condition for each proposed filter. Do\u00a0<strong>not<\/strong>\u00a0deploy these changes to production during training.<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Candidate change<\/th><th class=\"has-text-align-left\" data-align=\"left\">Benefit<\/th><th class=\"has-text-align-left\" data-align=\"left\">Potential security loss<\/th><th class=\"has-text-align-left\" data-align=\"left\">Approval \/ test<\/th><\/tr><\/thead><tbody><tr><td>Eliminate proven duplicate connector<\/td><td>Reduced noise and billing<\/td><td>May lose independent backup feed<\/td><td>Validate source lineage<\/td><\/tr><tr><td>Filter verbose debug info<\/td><td>Lower low-value volume<\/td><td>May remove forensic context<\/td><td>App\/SOC signoff and regression<\/td><\/tr><tr><td>Move high-volume firewall traffic lake-only<\/td><td>Cheaper retention<\/td><td>Could break active detection<\/td><td>Reject unless active subset remains<\/td><\/tr><tr><td>Shorten regulatory audit retention<\/td><td>Storage savings<\/td><td>Legal\/compliance violation<\/td><td>Legal authority required<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PASS:<\/strong>&nbsp;An explicit coverage-cost matrix, one&nbsp;<strong>rejected<\/strong>&nbsp;unsafe optimization and a rollback plan.<br><strong>Evidence:<\/strong>&nbsp;<code>D5-L08-coverage-cost-ADR.md<\/code>.&nbsp;<strong>Read:<\/strong>&nbsp;[R02], [R10\u2013R11].<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">D5-L09 \u2014 Package a proven analytics rule as supported content-as-code<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mapped:<\/strong>&nbsp;A21.&nbsp;<strong>Outcome:<\/strong>&nbsp;Store a working Day 4 rule in an auditable ARM\/Bicep source-controlled form without introducing a made-up deployment specification.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Select the\u00a0<strong>validated lab analytics rule<\/strong>\u00a0preserved from Day 4. Verify its name starts with\u00a0<code>D4-LAB-<\/code>\u00a0(or your approved equivalent), source tables are permitted and the query has a bounded lookback. Capture current rule ID, severity, enabled state, owner, workspace and known-good test cases.<\/li>\n\n\n\n<li>In Defender\u00a0<strong>Microsoft Sentinel > Configuration > Analytics<\/strong>, select the test rule. Select\u00a0<strong>Export<\/strong>\u00a0if offered. Microsoft documents export of analytics rules to ARM JSON, but the export\/import feature is described as\u00a0<strong>Preview<\/strong>; if it is absent, do not claim it works in your tenant [R15].<\/li>\n\n\n\n<li>Place the downloaded\u00a0<code>Azure_Sentinel_analytic_rule.json<\/code>\u00a0(or actual exported filename) into a private, authorized test repository, for example\u00a0<code>sentinel\/analytics\/aster-lab-rule.json<\/code>.\u00a0<strong>Do not<\/strong>\u00a0commit confidential production queries or incident identifiers.<\/li>\n\n\n\n<li>On your local computer, check that the exported file is valid JSON using\u00a0<strong>standard Python<\/strong>, which needs no Azure login:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code><em># Replace with the exact exported filename. This does not deploy anything.<\/em>\npython3 -m json.tool sentinel\/analytics\/aster-lab-rule.json &gt;\/dev\/null\n<\/code><\/pre>\n\n\n\n<ol start=\"5\" class=\"wp-block-list\">\n<li>Run this\u00a0<strong>structural inspection<\/strong>, changing only the filename. It checks JSON structure,\u00a0<strong>not<\/strong>\u00a0whether Azure accepts the API model:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>import json\nfrom pathlib import Path\npath = Path(\"sentinel\/analytics\/aster-lab-rule.json\")\nobj = json.loads(path.read_text(encoding=\"utf-8\"))\nassert isinstance(obj, dict), \"Expected ARM template object\"\nassert isinstance(obj.get(\"resources\"), list), \"Missing ARM resources array\"\nassert obj&#91;\"resources\"], \"No resources to deploy\"\nprint(\"Schema:\", obj.get(\"$schema\", \"MISSING\"))\nfor r in obj&#91;\"resources\"]:\n    print(\"Type:\", r.get(\"type\"), \"Name:\", r.get(\"name\"),\n          \"API version:\", r.get(\"apiVersion\"))\n<\/code><\/pre>\n\n\n\n<ol start=\"6\" class=\"wp-block-list\">\n<li>Inspect the file for actual\u00a0<strong>workspace name, location, IDs, analytic query, entity mappings, ATT&amp;CK tags, incident grouping, schedule, alert threshold and enabled flag<\/strong>. Some exports contain generated IDs and parameters that require environment-specific adaptation. Prefer\u00a0<strong>disabled<\/strong>\u00a0status for the initial sandbox deployment where supported; never copy a production-enabled rule into a second environment without review.<\/li>\n\n\n\n<li>Create a\u00a0<code>README.md<\/code>\u00a0in the repository explaining\u00a0<em>what the rule detects, required source tables, tenant\/workspace assumptions, scope, owner, severity, safe test fixture, known false positives and rollback<\/em>.<\/li>\n\n\n\n<li>Use the officially documented\u00a0<a href=\"https:\/\/github.com\/SentinelCICD\/RepositoriesSampleContent\">Sentinel repository sample content<\/a>\u00a0to compare file format and folder content. The repository supports\u00a0<strong>ARM JSON<\/strong>\u00a0and\u00a0<strong>Bicep<\/strong>, but their structure depends on content type [R05\u2013R06]. Do\u00a0<strong>not<\/strong>\u00a0rename a raw KQL file to\u00a0<code>.bicep<\/code>\u00a0or assume arbitrary YAML is deployable.<\/li>\n\n\n\n<li>Optional Bicep conversion: Microsoft warns that Bicep\u00a0<strong>does not support exported\u00a0<code>id<\/code>\u00a0properties in the same way<\/strong>, and recommends compatible ARM schema adjustment before decompilation. If using\u00a0<code>az bicep decompile<\/code>, inspect and correct the generated template against the official resource reference; compilation success alone is not deployment validity [R06].<\/li>\n\n\n\n<li>Commit the test template and report to a\u00a0<strong>feature branch<\/strong>, not directly to a production-synchronized deployment branch. Require reviewer approval and security\/owner signoff.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PASS:<\/strong>&nbsp;The exact tested rule has a valid JSON export or appropriately attributed official sample, a source-control commit, documented source prerequisites and a safety-reviewed deployment plan.&nbsp;<strong>Operational deployment PASS<\/strong>&nbsp;requires the later repository integration lab.<br><strong>Evidence:<\/strong>&nbsp;<code>D5-L09-content-package.md<\/code>, Git commit hash, JSON validation output, PR.<br><strong>Troubleshooting:<\/strong>&nbsp;No Export \u2192 preview\/permission\/portal limitation; missing parameters \u2192 inspect exported schema; portal-only edits not in Git \u2192 reconcile before release; Bicep&nbsp;<code>id<\/code>&nbsp;errors \u2192 consult Microsoft conversion rules.<br><strong>Read:<\/strong>&nbsp;[R05\u2013R06], [R15].<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">D5-L10 \u2014 Create a governed GitHub\/Azure DevOps repository deployment path<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mapped:<\/strong>&nbsp;A21, A22.&nbsp;<strong>Outcome:<\/strong>&nbsp;Verify promotion, approval, drift and rollback using one&nbsp;<em>nonproduction<\/em>&nbsp;Sentinel workspace.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Part A \u2014 Source-control workflow<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Choose a supported\u00a0<strong>GitHub or Azure DevOps<\/strong>\u00a0test repository. Require a protected default\/production branch; reviewers should not be the sole author of their own production changes.<\/li>\n\n\n\n<li>Use a simple structure, adapted to the organization&#8217;s selected supported content model:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>sentinel-content\/\n  README.md\n  analytics\/\n    aster-lab-identity-rule.json\n  tests\/\n    detection-test-matrix.md\n  governance\/\n    owners.md\n    change-record-template.md\n    rollback.md\n<\/code><\/pre>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li>Add validation to the\u00a0<strong>pull request<\/strong>, not just a post-deployment check: JSON syntax; schema\/resource-type review; KQL source validation in approved test workspace; fixture results; no secrets; expected rule name; enabled\/disabled plan; reviewer approval.<\/li>\n\n\n\n<li>For a basic\u00a0<strong>local precommit<\/strong>\u00a0check, run:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code><em># Example only after creating the above directory and exported JSON.<\/em>\npython3 -m json.tool analytics\/aster-lab-identity-rule.json &gt;\/dev\/null\n<em># If Azure CLI is installed, inspect it before any authenticated deployment:<\/em>\naz version\n<\/code><\/pre>\n\n\n\n<ol start=\"5\" class=\"wp-block-list\">\n<li><strong>Optional ARM deployment validation in authorized sandbox only:<\/strong>\u00a0inspect the exported template for its actual parameter names; construct an appropriately matching\u00a0<code>parameters.sandbox.json<\/code>\u00a0file and verify the resource group. The following shell is a\u00a0<strong>template<\/strong>\u00a0and will not run correctly until all placeholders and parameters match your exported resource:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code><em># DO NOT RUN until RG, TEMPLATE and PARAMETERS are reviewed and approved.<\/em>\nRG=\"&lt;approved-nonproduction-resource-group&gt;\"\nTEMPLATE=\"analytics\/aster-lab-identity-rule.json\"\nPARAMETERS=\"parameters.sandbox.json\"\naz account show --output table\naz deployment group validate --resource-group \"$RG\" \\\n  --template-file \"$TEMPLATE\" --parameters @\"$PARAMETERS\"\naz deployment group what-if --resource-group \"$RG\" \\\n  --template-file \"$TEMPLATE\" --parameters @\"$PARAMETERS\"\n<\/code><\/pre>\n\n\n\n<ol start=\"6\" class=\"wp-block-list\">\n<li>Save the\u00a0<strong>what-if<\/strong>\u00a0changes as review evidence. If an unexpected workspace\/rule\/RBAC or potentially destructive change appears,\u00a0<strong>stop<\/strong>. Do not let automatic merge\/deployment bypass this gate.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Part B \u2014 Sentinel Repositories integration (instructor-operated, permission-dependent)<\/h3>\n\n\n\n<ol start=\"7\" class=\"wp-block-list\">\n<li>Verify the instructor has\u00a0<strong>Owner on the Sentinel workspace resource group<\/strong>\u00a0and appropriate repository authorization; GitHub collaborator or Azure DevOps project administration. Microsoft requires connections from a supported\u00a0<strong>home-tenant<\/strong>\u00a0account rather than an unsupported B2B external identity [R05].<\/li>\n\n\n\n<li>In Defender, navigate\u00a0<strong>Microsoft Sentinel > Content management > Repositories > Add new<\/strong>. Give the connection a lab-specific name and select\u00a0<strong>GitHub<\/strong>\u00a0or\u00a0<strong>Azure DevOps<\/strong>.<\/li>\n\n\n\n<li>Select\u00a0<strong>Authorize<\/strong>, choose the explicitly approved repository and\u00a0<strong>sandbox branch<\/strong>, and limit\u00a0<strong>Content Types<\/strong>\u00a0to the intended\u00a0<strong>Analytics rules<\/strong>. For GitHub, review the app installation scope; do not grant organization-wide access if only the test repo is required.<\/li>\n\n\n\n<li>Create the connection. Microsoft states a workflow\/pipeline is generated in the repository to deploy supported content. In GitHub check\u00a0<strong>Actions<\/strong>, or in Azure DevOps check\u00a0<strong>Pipelines<\/strong>; capture the workflow name, job status, commit and deployment logs [R05].<\/li>\n\n\n\n<li>Check the\u00a0<strong>Sentinel Analytics<\/strong>\u00a0page for the created\/updated\u00a0<strong>test<\/strong>\u00a0rule and inspect its enabled state, ID, query and owner.\u00a0<strong>No rule or a failed pipeline = not deployed<\/strong>, even if the repository connection exists.<\/li>\n\n\n\n<li>Commit a\u00a0<strong>safe, reviewed change<\/strong>\u00a0(for example the description or a documented lab-only detail), merge via PR and observe the deployment job and new rule value. Record commit-to-deployment traceability.<\/li>\n\n\n\n<li><strong>Never edit the same managed rule directly in the portal<\/strong>\u00a0without reconciling the Git version: repository synchronization can overwrite portal edits. Demonstrate this as a design discussion unless the instructor explicitly authorizes a controlled drift test.<\/li>\n\n\n\n<li>Demonstrate rollback via\u00a0<strong>reverting the change in Git<\/strong>, review\/merge again and verify the expected previous rule state. Note:\u00a0<strong>deleting the file from Git does not delete the deployed Sentinel content<\/strong>; removing a managed resource requires a separate, controlled deletion in Sentinel [R05].<\/li>\n\n\n\n<li>At the end,\u00a0<strong>disconnect<\/strong>\u00a0the lab repository only if the owner authorizes it. The previously deployed content\u00a0<strong>remains in Sentinel<\/strong>\u00a0and must be managed explicitly. Remove the generated GitHub workflow \/ repository app grant only after checking dependencies.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting and release gate<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Failure<\/th><th class=\"has-text-align-left\" data-align=\"left\">Check first<\/th><th class=\"has-text-align-left\" data-align=\"left\">Safe response<\/th><\/tr><\/thead><tbody><tr><td>Connection not offered<\/td><td>Owner\/home tenant\/repository auth<\/td><td>Request correctly scoped admin assistance<\/td><\/tr><tr><td>Pipeline failure<\/td><td>GitHub Actions\/Azure DevOps logs<\/td><td>Fix schema\/permissions; do not retry production blindly<\/td><\/tr><tr><td>Export decompile fails<\/td><td>Unsupported&nbsp;<code>id<\/code>, schema, API version<\/td><td>Follow official Bicep conversion guidance<\/td><\/tr><tr><td>Rule created with unexpected state<\/td><td>Template and branch\/environment parameters<\/td><td>Disable and revert; stop promotion<\/td><\/tr><tr><td>Code changed but rule unchanged<\/td><td>Workflow trigger, branch or content-type selection<\/td><td>Trace commit \u2192 pipeline \u2192 deployment<\/td><\/tr><tr><td>Portal edit disappears<\/td><td>Repository is source of truth<\/td><td>Reinstate via reviewed Git change<\/td><\/tr><tr><td>Git file removed, rule remains<\/td><td>Documented retention of deployed resources<\/td><td>Separate authorized Sentinel cleanup<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PASS (local):<\/strong>&nbsp;Validated source artifact, branch\/PR\/review and rollback plan.&nbsp;<strong>Operational PASS:<\/strong>&nbsp;repository connection, workflow\/pipeline success, actual rule state, safe change and verified rollback.<br><strong>Evidence:<\/strong>&nbsp;<code>D5-L10-ci-cd-release-record.md<\/code>, commit IDs, run links and redacted rule state.<br><strong>Read:<\/strong>&nbsp;[R05\u2013R06], [R15].<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">D5-L11 \u2014 Implement production release governance and separation of duties<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mapped:<\/strong>&nbsp;A22.&nbsp;<strong>Outcome:<\/strong>&nbsp;Translate Git operations into auditable security change control.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Create a release checklist that\u00a0<strong>cannot<\/strong>\u00a0be satisfied by commit count alone. It must verify: source\/table availability, KQL performance, expected cases, false-positive tests, entity mappings, MITRE technique claims, owner, cost impact, workspace scope and a safe off switch.<\/li>\n\n\n\n<li>Design a four-stage flow:\u00a0<strong>Author branch \u2192 PR validation \u2192 approved test deployment \u2192 separate production approval<\/strong>. Avoid production auto-deploy from feature branches.<\/li>\n\n\n\n<li>Assign roles for each approval: detection maintainer, security engineering reviewer, data owner where schema changes, release approver, FinOps if collection\/retention changes, SOC on-call if alert volume changes.<\/li>\n\n\n\n<li>Write a\u00a0<strong>sample change record<\/strong>:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>Change ID: CHG-D5-LAB-001\nBusiness driver: Reduce false alerts for legitimate scheduled role grants\nRule ID and commit:\nAffected workspace(s): LAB ONLY\nRequired tables and expected latency:\nThreat detection \/ ATT&amp;CK statement:\nPositive and negative regression test IDs:\nRisk and customer impact:\nExpected alerts\/day and cost impact:\nRequired reviewers and approvals:\nDeployment\/rollback owner:\nRollback to commit:\nValidation window and evidence URL:\n<\/code><\/pre>\n\n\n\n<ol start=\"5\" class=\"wp-block-list\">\n<li>Conduct a mock review with the instructor acting as change authority. Present one deliberately flawed PR (for example no test fixture, broad workspace targeting or enabled containment action). The reviewer should\u00a0<strong>reject<\/strong>\u00a0it and document why.<\/li>\n\n\n\n<li>Prepare a rollback plan that states\u00a0<em>who<\/em>\u00a0can revert the commit,\u00a0<em>how<\/em>\u00a0the previous deployed rule ID\/state is validated,\u00a0<em>how<\/em>\u00a0duplicate alert generation will be detected and\u00a0<em>when<\/em>\u00a0SOC analysts are informed.<\/li>\n\n\n\n<li>Test a\u00a0<strong>nonproduction revert<\/strong>\u00a0only if approved. Record evidence; a Git revert button clicked without observing downstream rule state does\u00a0<strong>not<\/strong>\u00a0prove recovery.<\/li>\n\n\n\n<li>Discuss\u00a0<strong>change evidence retention<\/strong>\u00a0and access restrictions according to the organization&#8217;s real policies. Do not invent universal regulatory periods.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PASS:<\/strong>&nbsp;A signed example change record, negative PR review, incident-aware rollback and independent production release approval gate.<br><strong>Evidence:<\/strong>&nbsp;<code>D5-L11-change-record.md<\/code>,&nbsp;<code>D5-L11-release-checklist.md<\/code>.&nbsp;<strong>Read:<\/strong>&nbsp;[R05\u2013R06].<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">D5-L12 \u2014 Enable and interpret SentinelHealth and SentinelAudit<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mapped:<\/strong>&nbsp;A23.&nbsp;<strong>Outcome:<\/strong>&nbsp;Detect actual operational failures and control drift rather than treating UI availability as health.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Part A \u2014 Enable monitoring with permission<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In Defender choose\u00a0<strong>System > Settings > Microsoft Sentinel<\/strong>, then select\u00a0<strong>Auditing and health monitoring<\/strong>. Review whether it is already enabled and whether you can view its configured diagnostic settings [R07].<\/li>\n\n\n\n<li>If not enabled, the instructor first confirms the lab workspace and approval for any billable audit logs. Select\u00a0<strong>Enable<\/strong>\u00a0only in the approved environment. The product configures diagnostic settings for supported resources; otherwise use the documented\u00a0<strong>Configure diagnostic settings<\/strong>\u00a0path with explicit categories\/destinations.<\/li>\n\n\n\n<li>Record the enabled resource types: analytics rules,\u00a0<strong>selected supported data connectors<\/strong>, automation rules and playbook launch health where supported. Not every connector has a\u00a0<code>SentinelHealth<\/code>\u00a0integration. Microsoft currently documents\u00a0<strong>analytics-rule resource type<\/strong>\u00a0for auditing; do not claim arbitrary changes to every Sentinel object are audited there [R07].<\/li>\n\n\n\n<li>Explain the distinction:\u00a0<code>SentinelHealth<\/code>\u00a0tracks relevant Sentinel resource health and whether workflow launch succeeded;\u00a0<code>SentinelAudit<\/code>\u00a0records supported administrative changes; Logic Apps internal action details require\u00a0<strong>Logic Apps run history\/diagnostic logs<\/strong>\u00a0[R08].<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Part B \u2014 Query real events; absence is not immediate failure<\/h3>\n\n\n\n<ol start=\"5\" class=\"wp-block-list\">\n<li>Go to\u00a0<strong>Investigation &amp; response > Hunting > Advanced hunting<\/strong>\u00a0using a Sentinel workspace-aware query context. Run the Microsoft-recommended compatibility wrappers:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/ D5-L12A: supported Sentinel health function\n_SentinelHealth()\n| take 20\n<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/ D5-L12B: supported Sentinel audit function\n_SentinelAudit()\n| take 20\n<\/code><\/pre>\n\n\n\n<ol start=\"6\" class=\"wp-block-list\">\n<li>Check schema and event types in actual results; then adapt a bounded summary using fields\u00a0<strong>confirmed in your environment<\/strong>, rather than asserting table columns that are not present.<\/li>\n\n\n\n<li>If tables\/functions are empty, perform a safe, approved\u00a0<strong>lab rule metadata change<\/strong>\u00a0or a controlled automation test and allow normal ingestion time; recheck. The tables may be created only after the first supported event. A zero-row result alone is not proof monitoring failed.<\/li>\n\n\n\n<li>For a data-connector issue, compare health evidence with the\u00a0<strong>last successful real source event<\/strong>. Source-health telemetry does not replace source-level event integrity checks.<\/li>\n\n\n\n<li>For an analytics-rule failure, compare health records with rule execution\/alert results. For a playbook failure, match automation-launch records with\u00a0<strong>Logic Apps > Run history<\/strong>; if diagnostic export is configured, inspect the appropriate Logic Apps diagnostic table.<\/li>\n\n\n\n<li>Define a production\u00a0<strong>monitoring rule\/runbook<\/strong>: if a critical source has not reported for an agreed interval, or a critical analytic rule fails, alert the owner and triage a ticket. Pick thresholds from measured normal behavior, not arbitrary alert counts.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Part C \u2014 Simulated outage worksheet<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Simulated symptom<\/th><th class=\"has-text-align-left\" data-align=\"left\">Evidence to collect<\/th><th class=\"has-text-align-left\" data-align=\"left\">Likely owner<\/th><th class=\"has-text-align-left\" data-align=\"left\">Action \/ PASS condition<\/th><\/tr><\/thead><tbody><tr><td>Collector silent<\/td><td>Last raw log, connector health, DCR\/AMA where relevant<\/td><td>Platform<\/td><td>Document ingestion break and restore proof<\/td><\/tr><tr><td>Analytics execution failure<\/td><td>Rule execution health and query dependencies<\/td><td>Detection engineering<\/td><td>Restore query; verify next successful run<\/td><\/tr><tr><td>Playbook launch succeeds, action fails<\/td><td>SentinelHealth + Logic Apps run history<\/td><td>SOAR engineer<\/td><td>Repair failed action; do not claim healthy merely from launch<\/td><\/tr><tr><td>Unauthorized rule edit<\/td><td>SentinelAudit change record and repository drift<\/td><td>Release owner<\/td><td>Reconcile Git, tighten RBAC<\/td><\/tr><tr><td>Monitoring functions empty<\/td><td>Settings, diagnostic categories, event existence<\/td><td>Sentinel admin<\/td><td>Generate safe event; confirm telemetry<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PASS:<\/strong>&nbsp;Monitoring enabled or a documented read-only alternative; actual health\/audit query outputs if the tenant supports them; an outage triage explanation grounded in two separate evidence sources.<br><strong>Evidence:<\/strong>&nbsp;<code>D5-L12-health-audit-report.md<\/code>, sanitized query results, runbook.<br><strong>Read:<\/strong>&nbsp;[R07\u2013R08].<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">D5-L13 \u2014 Define SOC KPIs and investigate service-level performance<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mapped:<\/strong>&nbsp;A24.&nbsp;<strong>Outcome:<\/strong>&nbsp;Build a useful scorecard while distinguishing observed facts from estimated security outcomes.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Define the scope of the SOC service: monitored environments, critical sources, response teams, case severity policy and reporting period. A KPI without a stable denominator or accountable owner invites misleading comparisons.<\/li>\n\n\n\n<li>Agree on these definitions and data sources\u00a0<strong>before<\/strong>\u00a0computing values:<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Measure<\/th><th class=\"has-text-align-left\" data-align=\"left\">Operational definition<\/th><th class=\"has-text-align-left\" data-align=\"left\">Required proof \/ limitation<\/th><\/tr><\/thead><tbody><tr><td>Ingestion availability<\/td><td>% of required source\/table intervals with delivered expected events<\/td><td>Connector health&nbsp;<strong>and<\/strong>&nbsp;source freshness; not UI green alone<\/td><\/tr><tr><td>Detection execution reliability<\/td><td>Successful scheduled evaluations \/ expected evaluations<\/td><td>Rule\/health execution evidence<\/td><\/tr><tr><td>Detection coverage<\/td><td>Threat scenarios with an observed detection and tested source<\/td><td>ATT&amp;CK label does not equal effective coverage<\/td><\/tr><tr><td>Alert precision proxy<\/td><td>Known confirmed true positives \/ all reviewed positive alerts<\/td><td>Labeling quality; misses and uninvestigated alerts bias<\/td><\/tr><tr><td>MTTD<\/td><td>Time from confirmed malicious activity onset to valid detection<\/td><td>Ground-truth starting event is often unknown<\/td><\/tr><tr><td>MTTA<\/td><td>Time from alert\/incident available to acknowledged ownership<\/td><td>Requires reliable assignment\/acknowledgment event<\/td><\/tr><tr><td>MTTR<\/td><td>Time from qualified incident open to approved closure\/recovery<\/td><td>Define clock start\/stop and exclusion rules<\/td><\/tr><tr><td>Escalation SLA<\/td><td>% of cases escalated within severity-specific policy<\/td><td>Audit timestamps and severity classification<\/td><\/tr><tr><td>Automation success<\/td><td>Completed correct workflow actions \/ attempted relevant runs<\/td><td>Must use&nbsp;<strong>Logic Apps run history<\/strong>&nbsp;for internal actions<\/td><\/tr><tr><td>Data cost per relevant detection<\/td><td>Governed telemetry\/service spend \/ actionable outcomes<\/td><td>Never optimize by suppressing incidents artificially<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li>In the appropriate Sentinel Log Analytics query context, verify that the workspace exposes the\u00a0<strong><code>SecurityIncident<\/code><\/strong>\u00a0table and schema. It may have multiple snapshots per incident; na\u00efve counting over rows inflates volume.<\/li>\n\n\n\n<li>Run a bounded latest-snapshot count\u00a0<strong>only where\u00a0<code>SecurityIncident<\/code>\u00a0is available<\/strong>:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/ D5-L13A: latest incident state, not raw row count.\nSecurityIncident\n| where TimeGenerated &gt;= ago(30d)\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| summarize Incidents=count() by Status, Severity\n| order by Incidents desc\n<\/code><\/pre>\n\n\n\n<ol start=\"5\" class=\"wp-block-list\">\n<li>Validate the\u00a0<code>CreatedTime<\/code>\u00a0and\u00a0<code>ClosedTime<\/code>\u00a0fields in your schema before estimating closed-incident duration. This is\u00a0<strong>elapsed case duration<\/strong>, not necessarily true remediation time or time to eradicate an attack:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>\/\/ D5-L13B: optional approximation only when CreatedTime\/ClosedTime exist.\nSecurityIncident\n| where TimeGenerated &gt;= ago(30d)\n| summarize arg_max(TimeGenerated, *) by IncidentNumber\n| extend Created=todatetime(column_ifexists('CreatedTime','')),\n         Closed=todatetime(column_ifexists('ClosedTime',''))\n| where isnotnull(Created) and isnotnull(Closed) and Closed &gt;= Created\n| extend CaseDurationHours=datetime_diff('minute', Closed, Created) \/ 60.0\n| summarize ClosedCases=count(), MeanCaseHours=round(avg(CaseDurationHours),2),\n            MedianCaseHours=round(percentile(CaseDurationHours,50),2)\n<\/code><\/pre>\n\n\n\n<ol start=\"6\" class=\"wp-block-list\">\n<li>Compare the above metrics to three\u00a0<strong>fictional historical monthly periods<\/strong>\u00a0supplied by the instructor. Decide whether the SOC is improving and identify confounders: severity mix, source onboarding, policy changes, case grouping, staff shifts and improved detection (which can temporarily\u00a0<strong>increase<\/strong>\u00a0alert counts).<\/li>\n\n\n\n<li>Build a small scorecard covering: source freshness, high-risk rule execution, critical incident escalation, approval-workflow failures, ingestion cost trend and improvement backlog. Assign owner, target, observation interval and action threshold to each.<\/li>\n\n\n\n<li>In Defender,\u00a0<strong>read-only<\/strong>, inspect any available\u00a0<strong>SOC optimization<\/strong>\u00a0recommendations. Compare the recommended coverage\/data-value improvements with your actual source and rule inventory; a recommendation or coverage tag\u00a0<strong>does not<\/strong>\u00a0prove detection effectiveness. Record the limitations of this signal [R16].<\/li>\n\n\n\n<li>Produce a sample\u00a0<strong>monthly SOC operating review<\/strong>: three verified findings, two suspected drivers, one measurable corrective action and a date\/owner to validate success.<\/li>\n\n\n\n<li>Do not use a synthetic D4 event as evidence of real MTTD\/MTTR. Make confidence and missing data explicit.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PASS:<\/strong>&nbsp;A metric dictionary with owners\/denominators, latest-snapshot incident KQL if available, at least one caution about biased KPIs, and an actionable review.<br><strong>Evidence:<\/strong>&nbsp;<code>D5-L13-soc-kpi-dictionary.md<\/code>,&nbsp;<code>D5-L13-review.md<\/code>.&nbsp;<strong>Read:<\/strong>&nbsp;[R07\u2013R08], [R16].<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">D5-L14 \u2014 Prepare the Sentinel-to-Defender portal modernization plan<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mapped:<\/strong>&nbsp;A25.&nbsp;<strong>Outcome:<\/strong>&nbsp;Inventory actual features, role gaps and workflows ahead of the Azure-portal cutoff.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Record the\u00a0<strong>official target<\/strong>: Microsoft says the Sentinel Azure portal experience stops being supported\u00a0<strong>after March 31, 2027<\/strong>; use Defender as the standard training portal [R01]. Do not interpret this as Azure portal being retired for Azure resources generally.<\/li>\n\n\n\n<li>Inventory the existing SOC functions: incident queue, hunting, workbooks, content hub, analytics, automation, connectors, data management, entity pages, TI, repository connections and integrations with ticketing.<\/li>\n\n\n\n<li>Verify where\u00a0<strong>each<\/strong>\u00a0feature is available in the\u00a0<em>actual tenant<\/em>. Microsoft publishes a portal navigation mapping;\u00a0<strong>do not invent<\/strong>\u00a0new UI paths for features not shown or not licensed.<\/li>\n\n\n\n<li>Record permissions separately: Azure RBAC, Defender unified RBAC and roles used by a connector or playbook. A user may be able to query logs without being allowed to manage a detection or run a workflow.<\/li>\n\n\n\n<li>Create a\u00a0<strong>migration\/modernization acceptance matrix<\/strong>:<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Workflow<\/th><th class=\"has-text-align-left\" data-align=\"left\">Current path<\/th><th class=\"has-text-align-left\" data-align=\"left\">Defender path tested?<\/th><th class=\"has-text-align-left\" data-align=\"left\">Permission impact<\/th><th class=\"has-text-align-left\" data-align=\"left\">Gap\/owner<\/th><\/tr><\/thead><tbody><tr><td>Incident triage<\/td><td>Prior team practice<\/td><td>Yes\/No<\/td><td>Sentinel\/Defender response roles<\/td><td><\/td><\/tr><tr><td>Hunting queries<\/td><td>Old query surface<\/td><td>Yes\/No<\/td><td>Workspace scope \/ license<\/td><td><\/td><\/tr><tr><td>ASIM parser queries<\/td><td>Workspace Log Analytics<\/td><td>Yes\/No<\/td><td>Query context and function visibility<\/td><td><\/td><\/tr><tr><td>Automation\/playbooks<\/td><td>Portal and Logic Apps<\/td><td>Yes\/No<\/td><td>Trigger, case vs incident, service account<\/td><td><\/td><\/tr><tr><td>Workbooks<\/td><td>Azure resource<\/td><td>Yes\/No<\/td><td>Workbook reader\/contributor<\/td><td><\/td><\/tr><tr><td>Content-as-code<\/td><td>Repository connection<\/td><td>Yes\/No<\/td><td>Home-tenant and repo scopes<\/td><td><\/td><\/tr><tr><td>Data lake<\/td><td>No old equivalent \/ current support<\/td><td>Yes\/No<\/td><td>Onboarding\/roles\/region<\/td><td><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<ol start=\"6\" class=\"wp-block-list\">\n<li>Test\u00a0<strong>one<\/strong>\u00a0saved hunt and\u00a0<strong>one<\/strong>\u00a0lab incident end-to-end in the Defender portal. If a legacy feature is not available in Defender, record the supported alternative and its transition plan; for example, creation of traditional hunting bookmarks is not supported there [R01].<\/li>\n\n\n\n<li>Write a change-control plan: owner; named pilot users; training; preserved dashboards\/query links; ticket system; access review; communications; rollback\/contingency; cutover acceptance checklist.<\/li>\n\n\n\n<li>Have a SOC analyst other than the author reproduce a workflow\u00a0<strong>without instructor prompting<\/strong>. Capture navigation differences and update standard operating procedures.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PASS:<\/strong>&nbsp;Complete feature\/permission inventory, one pilot user test, at least one explicitly documented gap and signed rollout criteria.<br><strong>Evidence:<\/strong>&nbsp;<code>D5-L14-portal-modernization-plan.md<\/code>.&nbsp;<strong>Read:<\/strong>&nbsp;[R01], [R12].<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">D5-L15 \u2014 Run an operational resilience and governance game day<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mapped:<\/strong>&nbsp;A26.&nbsp;<strong>Outcome:<\/strong>&nbsp;Keep the SOC functioning during dependency failures without making unsafe changes.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Identify five critical dependencies: source telemetry, Sentinel workspace\/query availability, repository deployment system, incident\/ticket system, approval provider \/ Logic Apps execution.<\/li>\n\n\n\n<li>Choose\u00a0<strong>one tabletop fault<\/strong>\u00a0and one\u00a0<strong>read-only evidence exercise<\/strong>. Suggested tabletop: a high-severity identity signal appears while the Git deployment pipeline is failing and the approval connector is unavailable.<\/li>\n\n\n\n<li>Declare a fictional severity and preserve the\u00a0<strong>incident commander and approver<\/strong>\u00a0roles. Decide whether analysis continues manually, whether additional containment is authorized, and what evidence must be saved.<\/li>\n\n\n\n<li>Review the runbooks to locate: backup SOC contacts, permission break-glass process, safe manual-only response, evidence custody, query\/access audit, last validated detection version and ticket recovery procedures.<\/li>\n\n\n\n<li>Run a\u00a0<strong>read-only<\/strong>\u00a0health or incident query if access is available. Do\u00a0<strong>not<\/strong>\u00a0disable real connectors, deny network traffic, corrupt logs or break service availability to manufacture the failure.<\/li>\n\n\n\n<li>Write a chronology with UTC checkpoints: simulated outage start, first detection, escalation, manual workaround, dependency restored and after-action owner. Label timestamps as exercise values.<\/li>\n\n\n\n<li>Define preservation rules: query text and scope, event IDs, redacted incident evidence, chain-of-custody owner and applicable retention\/legal hold.\u00a0<strong>Retention periods are organization-specific<\/strong>; get legal signoff before stating numeric periods.<\/li>\n\n\n\n<li>Inspect a sample IAM access-review sheet: identify a departed engineer with retained write rights and an automation connection tied to a personal account. Design least-privilege remediation and approval;\u00a0<strong>do not modify real access<\/strong>\u00a0in this exercise.<\/li>\n\n\n\n<li>Conduct an after-action review and capture\u00a0<strong>three concrete improvements<\/strong>\u00a0with owner, validation evidence and target date. One must improve recovery from a missing telemetry source, and one must improve change\/approval resiliency.<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Inject<\/th><th class=\"has-text-align-left\" data-align=\"left\">Expected safe behavior<\/th><th class=\"has-text-align-left\" data-align=\"left\">Evidence<\/th><\/tr><\/thead><tbody><tr><td>Connector stops<\/td><td>Mark visibility gap, notify source owner, use retained evidence<\/td><td>Last log timestamp + owner ticket<\/td><\/tr><tr><td>Repository pipeline fails<\/td><td>Freeze promotion, use last known good, review PR\/log<\/td><td>Git run and rule version<\/td><\/tr><tr><td>Approval provider unavailable<\/td><td>No automated disruptive action; manual authorization policy<\/td><td>Stop\/timeout run record<\/td><\/tr><tr><td>Region\/tenant access restricted<\/td><td>Follow legal + operations boundaries<\/td><td>Access matrix \/ escalation<\/td><\/tr><tr><td>Cost spike<\/td><td>Investigate volume and source before dropping data<\/td><td>Usage and business impact<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PASS:<\/strong>&nbsp;Tabletop incident log, safe decision record, access-review worksheet, three action items and an owner for each.<br><strong>Evidence:<\/strong>&nbsp;<code>D5-L15-resilience-exercise.md<\/code>,&nbsp;<code>D5-L15-improvement-backlog.md<\/code>.&nbsp;<strong>Read:<\/strong>&nbsp;[R07\u2013R09], [R16].<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">D5-L16 \u2014 Present and defend the integrated enterprise capstone<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Mapped:<\/strong>&nbsp;A27; uses A15\u2013A26 decisions and Day 4 validated detection\/playbook as&nbsp;<strong>prerequisites<\/strong>.&nbsp;<strong>No reteaching<\/strong>&nbsp;of earlier modules.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Capstone problem<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Aster Retail has a central SOC, regional subsidiaries, long-term evidence requirements and limited logging budgets. A fictional high-privilege identity incident has already been investigated in prior labs. Leadership wants a proposal that provides reasonable source visibility, defensible residency boundaries, controlled detections, approved response, auditable releases, historical investigation, meaningful SOC KPIs and a tested fallback when a dependency is unavailable.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Required final deliverables<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">ID<\/th><th class=\"has-text-align-left\" data-align=\"left\">Deliverable<\/th><th class=\"has-text-align-left\" data-align=\"left\">Must explicitly answer<\/th><\/tr><\/thead><tbody><tr><td>C01<\/td><td>Architecture decision record and diagram<\/td><td>Why this many workspaces\/tenants; who owns each boundary?<\/td><\/tr><tr><td>C02<\/td><td>Telemetry classification and tier matrix<\/td><td>Which sources need real-time analytics; how long and why?<\/td><\/tr><tr><td>C03<\/td><td>Historical-investigation plan<\/td><td>Which lake job, permission, cost and destination?<\/td><\/tr><tr><td>C04<\/td><td>Telemetry cost model<\/td><td>Rates\/assumptions, alternative scenarios, detection impact and guardrails<\/td><\/tr><tr><td>C05<\/td><td>Detection-as-code PR and test evidence<\/td><td>Source format, validated rule, commit, review, test deploy or disclosure of no deploy<\/td><\/tr><tr><td>C06<\/td><td>Change and rollback record<\/td><td>Who may approve, who deploys, how to observe\/undo?<\/td><\/tr><tr><td>C07<\/td><td>Health and incident-quality evidence<\/td><td>Source\/rule\/automation health and responsible KPIs<\/td><\/tr><tr><td>C08<\/td><td>Portal and resilience action plan<\/td><td>Feature gaps, 2027 transition, dependency failures and runbooks<\/td><\/tr><tr><td>C09<\/td><td>Day 4 artifact handoff<\/td><td>Validated hunt\/detection and guarded playbook\u2014reference, do not reproduce course<\/td><\/tr><tr><td>C10<\/td><td>Executive-style conclusion<\/td><td>Tradeoffs, remaining risks, owner, next verification<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Capstone presentation and challenge questions<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Explain\u00a0<em>why the design does not unnecessarily multiply workspaces<\/em>; cite residency, tenure, ownership and query constraints.<\/li>\n\n\n\n<li>Defend which security-sensitive event table\u00a0<strong>must not be lake-only<\/strong>\u00a0because an active detection needs it.<\/li>\n\n\n\n<li>Explain how a lake job&#8217;s result is consumed and what role\/charge applies; do not claim lake-only data powers NRT rules.<\/li>\n\n\n\n<li>Demonstrate a Git commit, PR checks and deployment\/audit trail\u2014or label the demonstration\u00a0<em>design-only<\/em>\u00a0and state the missing gate.<\/li>\n\n\n\n<li>Explain how to roll back a noisy detection without deleting an entire workspace, suppressing evidence or silently losing source logs.<\/li>\n\n\n\n<li>Compare the\u00a0<em>predicted<\/em>\u00a0cost change with the\u00a0<em>measured<\/em>\u00a0source usage, and disclose uncertainty in pricing assumptions.<\/li>\n\n\n\n<li>Walk through the simulated failure of the approval system: who can act manually and which actions must stop?<\/li>\n\n\n\n<li>Present one KPI that\u00a0<strong>improves actual detection quality<\/strong>\u00a0and one KPI that can be misleading if reported alone.<\/li>\n\n\n\n<li>Identify the three highest unresolved risks and a named validation owner for each.<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Scoring rubric (100 points)<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Competency<\/th><th class=\"has-text-align-right\" data-align=\"right\">Points<\/th><th class=\"has-text-align-left\" data-align=\"left\">Minimum acceptable evidence<\/th><\/tr><\/thead><tbody><tr><td>Workspace, tenant and trust-boundary architecture (A15\u2013A16)<\/td><td class=\"has-text-align-right\" data-align=\"right\">15<\/td><td>Regional\/data\/identity constraints and owned decision record<\/td><\/tr><tr><td>Data tiers, historical jobs and retention (A17\u2013A18)<\/td><td class=\"has-text-align-right\" data-align=\"right\">15<\/td><td>Live-detection dependency protected; historical method\/cost specified<\/td><\/tr><tr><td>Economics and optimization (A19\u2013A20)<\/td><td class=\"has-text-align-right\" data-align=\"right\">15<\/td><td>Reproducible model; actual vs illustrative rates distinguished; no coverage loss<\/td><\/tr><tr><td>Detection-as-code \/ release governance (A21\u2013A22)<\/td><td class=\"has-text-align-right\" data-align=\"right\">20<\/td><td>Reviewed artifact, test deployment evidence or truthful blocked status, rollback<\/td><\/tr><tr><td>Health, audit and SOC operating metrics (A23\u2013A24)<\/td><td class=\"has-text-align-right\" data-align=\"right\">15<\/td><td>Health and workflow-run distinction; metrics with definitions\/owners<\/td><\/tr><tr><td>Portal modernization and resilience (A25\u2013A26)<\/td><td class=\"has-text-align-right\" data-align=\"right\">10<\/td><td>Defender readiness plan and non-destructive failure exercise<\/td><\/tr><tr><td>Integrated capstone defense and evidence integrity (A27)<\/td><td class=\"has-text-align-right\" data-align=\"right\">10<\/td><td>Traceable decisions, open risks and transparent limitations<\/td><\/tr><tr><td><strong>Total<\/strong><\/td><td class=\"has-text-align-right\" data-align=\"right\"><strong>100<\/strong><\/td><td><\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Suggested program completion:<\/strong>&nbsp;At least&nbsp;<strong>80\/100<\/strong>, with&nbsp;<strong>mandatory safety PASS<\/strong>&nbsp;for scope control, no unapproved tenant-wide\/production changes, no retention changes that break active detections, documented repo rollback and truthful deployment status. This is a&nbsp;<strong>course-defined assessment<\/strong>, not a Microsoft-issued credential. Allow a supervised remedial attempt and document the re-test.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Day 5 operator checklists and templates<\/h1>\n\n\n\n<h2 class=\"wp-block-heading\">Final 5W1H oral assessment<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ask each learner to answer the following with reference to their own artifacts:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>What<\/strong>\u00a0production services and data tiers actually exist in the chosen architecture?<\/li>\n\n\n\n<li><strong>Why<\/strong>\u00a0is the workspace split justified, and what cost\/complexity does it add?<\/li>\n\n\n\n<li><strong>Who<\/strong>\u00a0owns source collection, detection changes, cost, incident triage and governance?<\/li>\n\n\n\n<li><strong>When<\/strong>\u00a0may a table become lake-only, and when must it remain detection-ready?<\/li>\n\n\n\n<li><strong>Where<\/strong>\u00a0do billing decisions, code changes, incidents, logs and approvals live?<\/li>\n\n\n\n<li><strong>How<\/strong>\u00a0would you validate a new rule, recover from a failed deployment and investigate a missing high-priority log source?<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Syllabus coverage audit \u2014 Day 5 only<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Each capability below is&nbsp;<strong>new instruction on Day 5<\/strong>. Previously validated detections and playbooks are reused as inputs, not retaught.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Syllabus ID<\/th><th class=\"has-text-align-left\" data-align=\"left\">New advanced competency<\/th><th class=\"has-text-align-left\" data-align=\"left\">Primary hands-on evidence<\/th><\/tr><\/thead><tbody><tr><td>A15<\/td><td>Multiworkspace and tenant choices<\/td><td>D5-L01 workspace ADR<\/td><\/tr><tr><td>A16<\/td><td>Production reference architecture<\/td><td>D5-L02 topology, RACI and boundaries<\/td><\/tr><tr><td>A17<\/td><td>Analytics\/data lake tier tradeoffs<\/td><td>D5-L03\u2013L04 retention\/onboarding evidence<\/td><\/tr><tr><td>A18<\/td><td>Historical analytics and KQL jobs<\/td><td>D5-L05 job specification or observed run<\/td><\/tr><tr><td>A19<\/td><td>Security-data economics<\/td><td>D5-L06\u2013L07 baseline and rate model<\/td><\/tr><tr><td>A20<\/td><td>Optimization versus security coverage<\/td><td>D5-L07\u2013L08 alternatives<\/td><\/tr><tr><td>A21<\/td><td>Detections\/content as code<\/td><td>D5-L09\u2013L10 exported rule and Git evidence<\/td><\/tr><tr><td>A22<\/td><td>Change\/promotion governance<\/td><td>D5-L10\u2013L11 PR and approval record<\/td><\/tr><tr><td>A23<\/td><td>Health and audit<\/td><td>D5-L12&nbsp;<code>SentinelHealth<\/code>\/<code>SentinelAudit<\/code>&nbsp;checks<\/td><\/tr><tr><td>A24<\/td><td>SOC metrics and SLAs<\/td><td>D5-L13 KPI review<\/td><\/tr><tr><td>A25<\/td><td>Defender portal modernization<\/td><td>D5-L14 inventory and pilot<\/td><\/tr><tr><td>A26<\/td><td>Governance and resilience<\/td><td>D5-L15 game-day and runbooks<\/td><\/tr><tr><td>A27<\/td><td>Final enterprise capstone<\/td><td>D5-L16 final presentation and rubric<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Instructor oral-check answer guide<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Analytics vs lake-only:<\/strong>\u00a0Keep active-detection dependencies in a supported interactive tier. Lake-only historical storage alone does not supply the same NRT\/interactive features.<\/li>\n\n\n\n<li><strong>Workspace design:<\/strong>\u00a0Split for defensible residency, ownership, tenancy or RBAC needs; minimize fragmentation otherwise.<\/li>\n\n\n\n<li><strong>Repository truth:<\/strong>\u00a0A successful Git commit is not a successful deployed rule. Verify the pipeline and actual workspace rule; Git deletion does not automatically delete deployed content.<\/li>\n\n\n\n<li><strong>Costs:<\/strong>\u00a0Use a current region\/contract rate card, identify free sources, commitment, retention and workflow costs, and distinguish forecast from invoice.<\/li>\n\n\n\n<li><strong>Monitoring:<\/strong>\u00a0<code>SentinelHealth<\/code>\u00a0launch success does not prove every Logic Apps action succeeded. Query a supported health event and inspect actual run history.<\/li>\n\n\n\n<li><strong>MTTD:<\/strong>\u00a0Cannot reliably compute true attacker onset without independent ground-truth data. Incident creation is not automatically the same as first malicious action.<\/li>\n\n\n\n<li><strong>Resilience:<\/strong>\u00a0If approval or telemetry dependency fails, stop unsafe automatic actions and use documented escalation\/incident commander authorization.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Final evidence checklist<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>[ ] D5-L00 preflight, authorized tenant\/workspace and disabled unsafe automation<\/li>\n\n\n\n<li>[ ] D5-L01 workspace\/tenant ADR<\/li>\n\n\n\n<li>[ ] D5-L02 production reference architecture, RACI and boundaries<\/li>\n\n\n\n<li>[ ] D5-L03 retention\/tier dependency matrix<\/li>\n\n\n\n<li>[ ] D5-L04 lake eligibility + approved setup status\u00a0<strong>or read-only alternative<\/strong><\/li>\n\n\n\n<li>[ ] D5-L05 historical query + job output\u00a0<strong>or honest no-submit substitute<\/strong><\/li>\n\n\n\n<li>[ ] D5-L06 source usage and billing-scope baseline<\/li>\n\n\n\n<li>[ ] D5-L07 reproducible cost scenarios with illustrative-rate disclaimer<\/li>\n\n\n\n<li>[ ] D5-L08 detection-quality-preserving optimization recommendations<\/li>\n\n\n\n<li>[ ] D5-L09 exported rule \/ valid source artifact + test specification<\/li>\n\n\n\n<li>[ ] D5-L10 Git PR, test pipeline\/rollback evidence\u00a0<strong>or explicitly blocked status<\/strong><\/li>\n\n\n\n<li>[ ] D5-L11 change-control record and release\/rollback plan<\/li>\n\n\n\n<li>[ ] D5-L12\u00a0<code>_SentinelHealth()<\/code>\u00a0\/\u00a0<code>_SentinelAudit()<\/code>\u00a0evidence\u00a0<strong>or documented missing data<\/strong><\/li>\n\n\n\n<li>[ ] D5-L13 metric definitions, owners, and a bounded operational review<\/li>\n\n\n\n<li>[ ] D5-L14 Defender portal transition and permission inventory<\/li>\n\n\n\n<li>[ ] D5-L15 resilience tabletop and after-action backlog<\/li>\n\n\n\n<li>[ ] D5-L16 enterprise capstone score and safety signoff<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Cleanup (do not delete shared workspace, lake billing resources or Git history)<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Confirm all\u00a0<strong>automatic lab responses remain disabled<\/strong>\u00a0and no scheduled test playbooks or KQL jobs will continue incurring costs unexpectedly.<\/li>\n\n\n\n<li>Disable or remove only\u00a0<strong>owned, temporary<\/strong>\u00a0analytics rules in the dedicated training workspace; preserve intentionally reused rule versions for instructor review.<\/li>\n\n\n\n<li>Disconnect a\u00a0<strong>sandbox repository connection<\/strong>\u00a0only if the workspace\/repository owner authorizes it.\u00a0<strong>Content already deployed is not automatically removed<\/strong>\u00a0when you disconnect or delete a repo file.<\/li>\n\n\n\n<li>Disable temporary test KQL jobs or schedules, then remove temporary output tables\u00a0<strong>only with the data owner and retention approval<\/strong>. Deleting a historical table may destroy evidence.<\/li>\n\n\n\n<li>Preserve the\u00a0<strong>tenant&#8217;s data lake and billing resource group<\/strong>\u00a0unless a separate supported decommission plan exists.\u00a0<strong>Do not delete a data-lake resource group as a classroom cleanup shortcut<\/strong>.<\/li>\n\n\n\n<li>Remove temporary principal role assignments via the actual IAM owner. Do not remove inherited access or break shared alerting.<\/li>\n\n\n\n<li>Reconcile Azure Cost Management, table ingestion trends, Logic Apps run costs, repository workflow consumption and any new storage\/job charges once they become billable\/visible.<\/li>\n\n\n\n<li>Save sanitized final artifacts in an approved repository or training evidence store; respect confidentiality and organization-specific retention\/hold requirements.<\/li>\n\n\n\n<li>Write a signed\u00a0<strong>final state<\/strong>\u00a0record with every retained resource, disabled feature, outstanding cost\/permission risk, owner and next review date.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Common failure patterns \u2014 triage without guessing<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Symptom<\/th><th class=\"has-text-align-left\" data-align=\"left\">What it means&nbsp;<em>may<\/em>&nbsp;be wrong<\/th><th class=\"has-text-align-left\" data-align=\"left\">Required investigation<\/th><th class=\"has-text-align-left\" data-align=\"left\">Safe alternate<\/th><\/tr><\/thead><tbody><tr><td>Secondary workspace absent in Defender<\/td><td>Workspace\/feature integration or permissions<\/td><td>Primary\/secondary workspace support, tenant and RBAC<\/td><td>Architecture worksheet<\/td><\/tr><tr><td>Lake onboarding unavailable<\/td><td>Wrong primary workspace, role, region or already onboarded<\/td><td>Data lake settings and official prerequisites<\/td><td>Read-only tier study<\/td><\/tr><tr><td>Lake query returns 0<\/td><td>Data absent, not mirrored, time filter or lake availability<\/td><td>Source table, tier configuration and time window<\/td><td>Instructor-supplied fixture<\/td><\/tr><tr><td>KQL job won&#8217;t write table<\/td><td>Data lake identity\/workspace contributor or schema mismatch<\/td><td>Destination and job error details<\/td><td>Job design spec<\/td><\/tr><tr><td>Costs differ from estimate<\/td><td>Incorrect rates, dates, currency or data chargeability<\/td><td>Billing export, commitment, free sources<\/td><td>Show assumptions, no fabricated invoice<\/td><\/tr><tr><td>Analytics rule disabled after deployment<\/td><td>Template parameters, mismatch or deliberate safety state<\/td><td>Git\/ARM file, release record, rule status<\/td><td>Do not force-enable<\/td><\/tr><tr><td>Git commit doesn&#8217;t deploy<\/td><td>Branch, content type, workflow or authorization<\/td><td>Actions\/Pipelines logs \u2192 deployment details<\/td><td>Review-only PR<\/td><\/tr><tr><td>Repo file deletion leaves rule<\/td><td>Intended repository behavior<\/td><td>Controlled Sentinel rule removal<\/td><td>Document the limitation<\/td><\/tr><tr><td>Health table empty<\/td><td>No event, monitoring disabled or wrong scope<\/td><td>Settings and safe event generation<\/td><td>Monitoring runbook design<\/td><\/tr><tr><td>SOC metric counts too high<\/td><td>Multiple SecurityIncident snapshots<\/td><td><code>arg_max()<\/code>&nbsp;latest state per incident<\/td><td>Offline fixture with proper denominator<\/td><\/tr><tr><td>Playbook launch says success but action failed<\/td><td>SentinelHealth \u2260 full Logic Apps execution<\/td><td>Inspect Logic Apps run history<\/td><td>Fault-analysis case study<\/td><\/tr><tr><td>Unauthorized cross-tenant view<\/td><td>Insufficient or overly broad delegation<\/td><td>Review actual role\/trust boundary with IAM<\/td><td>RACI \/ legal review<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\">Explicit verification ledger \u2014 no invented cloud PASS claims<\/h1>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th class=\"has-text-align-left\" data-align=\"left\">Review area<\/th><th class=\"has-text-align-left\" data-align=\"left\">Checked for this manual<\/th><th class=\"has-text-align-left\" data-align=\"left\">Requires live tenant test<\/th><\/tr><\/thead><tbody><tr><td>Source agenda scope A15\u2013A27<\/td><td>Mapped all competencies to labs<\/td><td>Instructor confirms delivery focus<\/td><\/tr><tr><td>Current documentation<\/td><td>Cross-checked official Microsoft Learn in November 2026<\/td><td>Refresh before class as docs evolve<\/td><\/tr><tr><td>Markdown structure and static examples<\/td><td>Validated locally<\/td><td>Learner reproduces environment-specific commands<\/td><\/tr><tr><td>Illustration\/cost arithmetic<\/td><td>Deterministic example; not actual pricing<\/td><td>Replace with contract\/region rates<\/td><\/tr><tr><td>Enterprise workspace selection<\/td><td>Design exercises grounded in documented constraints<\/td><td>Actual tenant\/region\/RBAC verification<\/td><\/tr><tr><td>Data-lake onboarding<\/td><td>Documented procedural path only<\/td><td><strong>Not executed<\/strong>&nbsp;\u2014 requires approval<\/td><\/tr><tr><td>KQL jobs and output table<\/td><td>Documented steps and sample query<\/td><td><strong>Not executed<\/strong>&nbsp;\u2014 requires data and roles<\/td><\/tr><tr><td>Repository-based deployment<\/td><td>Documented workflow, JSON syntax check example<\/td><td><strong>Not executed<\/strong>&nbsp;\u2014 requires approved repo and auth<\/td><\/tr><tr><td>Health\/audit KQL<\/td><td>Uses Microsoft-supported compatibility functions<\/td><td><strong>Not executed<\/strong>&nbsp;\u2014 enable and generate real event<\/td><\/tr><tr><td>PowerPoint\/course integration<\/td><td>Prior training artifacts are stated prerequisites<\/td><td>Verify continuity from instructors&#8217; actual Day 4 outputs<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Source register \u2014 official Microsoft documentation<\/h2>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Source labels correspond to references cited in individual labs. Accessed for research on&nbsp;<strong>1 November 2026<\/strong>. Feature status, licensing, menu labels, costs, regions and APIs must be rechecked before a live class.<\/p>\n<\/blockquote>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>[R01]<\/strong>\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/microsoft-sentinel-defender-portal\">Microsoft Sentinel in the Microsoft Defender portal and 2027 transition<\/a><\/li>\n\n\n\n<li><strong>[R02]<\/strong>\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/manage-data-overview\">Manage Analytics\/Data Lake tiers and retention<\/a><\/li>\n\n\n\n<li><strong>[R03]<\/strong>\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/datalake\/sentinel-lake-overview\">Microsoft Sentinel data lake overview<\/a><\/li>\n\n\n\n<li><strong>[R04]<\/strong>\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/datalake\/sentinel-lake-onboard-defender\">Onboard to the Microsoft Sentinel data lake from Defender<\/a><\/li>\n\n\n\n<li><strong>[R05]<\/strong>\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/ci-cd\">Deploy content as code from a Sentinel repository<\/a><\/li>\n\n\n\n<li><strong>[R06]<\/strong>\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/ci-cd-custom-content\">Manage source-controlled custom content; ARM\/Bicep formats<\/a><\/li>\n\n\n\n<li><strong>[R07]<\/strong>\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/enable-monitoring\">Enable Sentinel auditing and health monitoring<\/a><\/li>\n\n\n\n<li><strong>[R08]<\/strong>\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/health-audit\">SentinelHealth\/SentinelAudit interpretation<\/a><\/li>\n\n\n\n<li><strong>[R09]<\/strong>\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/prepare-multiple-workspaces\">Plan multiple workspaces and tenants<\/a><\/li>\n\n\n\n<li><strong>[R10]<\/strong>\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/billing\">Sentinel pricing and billing<\/a><\/li>\n\n\n\n<li><strong>[R11]<\/strong>\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/billing-reduce-costs\">Reduce Microsoft Sentinel costs<\/a><\/li>\n\n\n\n<li><strong>[R12]<\/strong>\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/use-multiple-workspaces\">Set up multiple workspaces and tenants<\/a><\/li>\n\n\n\n<li><strong>[R13]<\/strong>\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/geographical-availability-data-residency\">Data lake geographical availability and residency<\/a><\/li>\n\n\n\n<li><strong>[R14]<\/strong>\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/datalake\/kql-jobs\">Create KQL jobs in Microsoft Sentinel data lake<\/a><\/li>\n\n\n\n<li><strong>[R15]<\/strong>\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/import-export-analytics-rules\">Import and export Sentinel analytics rules<\/a><\/li>\n\n\n\n<li><strong>[R16]<\/strong>\u00a0<a href=\"https:\/\/learn.microsoft.com\/en-us\/azure\/sentinel\/soc-optimization\/soc-optimization-access\">Optimize security operations (SOC optimization dashboard and recommendations)<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>End of standalone Day 5 manual.<\/strong>&nbsp;The program&#8217;s advanced completion gate is an&nbsp;<strong>evidence-backed enterprise capstone<\/strong>, not attendance or unverified portal screenshots.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Module 3: Advanced |&nbsp;Day 5 only&nbsp;| Enterprise Architecture, Data Lake, DevSecOps and SOC Governance Edition:&nbsp;1 November 2026Training path:&nbsp;Day 5 of the five-day progressive Microsoft Sentinel programThis manual:&nbsp;Day&#8230; <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1262","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1262","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=1262"}],"version-history":[{"count":2,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1262\/revisions"}],"predecessor-version":[{"id":1272,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/1262\/revisions\/1272"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=1262"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=1262"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=1262"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}