SC-200 Security Operations Analyst

Incident vs Alert: an Alert is a single detection event from one product (e.g., MDE detects suspicious PowerShell). An Incident is a correlated collection of related alerts from multiple sources that together tell the full attack story. SOC always works at the Incident level — not per-alert — to avoid missing context.

Attack Disruption: Defender XDR ML automatically interrupts human-operated attacks mid-progress. When ransomware or BEC patterns are detected with high confidence → automatically contain compromised user + isolate device — without waiting for human action. Reduces dwell time from hours to minutes.

Advanced Hunting (KQL): interactive query tool across 30+ tables (DeviceEvents, EmailEvents, IdentityLogonEvents, AlertEvidence, etc.) for proactive threat hunting and investigation. Results limited to 30 days of data. Supports custom detection rules (run on schedule → generate alerts automatically).

Threat Analytics: curated intelligence reports from Microsoft Threat Intelligence on active campaigns and CVEs. Each report includes: executive summary, MITRE ATT&CK mapping, indicators of compromise (IoCs), mitigation actions, and your organization's exposure status (which assets are vulnerable/patched).

Secure Score (Defender): distinct from Compliance Manager score. Measures active security control coverage across identities, devices, apps, data. Each recommended action has a score value. Prioritize by impact vs implementation effort. Compare with similar-sized organizations (benchmark).

Device timeline: 180-day behavioral history per device: process trees, network connections, file operations, registry changes, logon events. SOC analysts pivot from an alert → device timeline → trace attacker lateral movement step by step. Correlates with MITRE ATT&CK techniques.

Live Response: real-time shell access to an enrolled device for investigation and containment — without requiring VPN or RDP. Commands: getfile (pull suspicious file for analysis), putfile (deploy remediation script), run (execute script), remediate (kill process, quarantine file). All commands logged for forensics.

Threat & Vulnerability Management (TVM): agentless vulnerability scanning. Exposure Score + Device Exposure Score. Security recommendations linked to CVE severity + exploitability + asset criticality. "Top security recommendations" sorted by highest remediation value. Integrates with ServiceNow/Jira for ticketing.

EDR in Block mode: when third-party AV is the primary protection (e.g., Symantec), MDE EDR still operates in passive mode but can block malicious artifacts at the post-breach stage. Provides defense-in-depth even without MDE as primary AV.

Security Alerts vs Recommendations: Recommendations = configuration gaps (proactive — fix to prevent attack). Security Alerts = active threat detections from CWPP (reactive — someone is attacking right now). Alerts have severity (High/Medium/Low/Informational) and MITRE ATT&CK stage mapping. SOC responds to alerts; security engineering responds to recommendations.

Defender for Servers Plan 2: MDE integration (auto-provision to all servers), File Integrity Monitoring (FIM — track critical OS file changes: /etc/passwd, Windows SAM), Adaptive Application Controls (define allowlisted apps per server group — alert if unlisted app runs), JIT VM Access, vulnerability assessment via TVM or Qualys.

DevSecOps — Defender for DevOps: connect GitHub/Azure DevOps repositories. Scan for: secrets in code (GitHub Actions secrets, Kubernetes configs), IaC misconfigurations (Terraform, ARM, Bicep), container image vulnerabilities. Results surface in Defender for Cloud console as recommendations — link directly to the offending code line.

Multi-cloud (AWS/GCP): connect via Cloud Connector (CSPM for AWS/GCP is free in basic tier). CWPP for non-Azure resources requires Defender plans. Single Regulatory Compliance dashboard across Azure + AWS + GCP. Arc-enabled servers: on-prem Windows/Linux servers appear as Azure resources and get full CWPP protection.

Analytics rule types: Scheduled (KQL runs every N minutes — most common, fully customizable, create alerts when query returns results). NRT Near Real-Time (1-minute detection, subset of Scheduled — use for high-priority detections like admin account modifications). Anomaly (ML baseline — unusual process counts, unusual logon times — lower fidelity but catches novel attacks). Fusion (ML correlation — maps multiple low-fidelity signals to a MITRE tactic — high confidence, reduce false positives dramatically).

Watchlists: CSV-based reference data uploaded to Sentinel — enriches KQL queries at query time without storing data in Log Analytics (saves cost). Common uses: high-value asset list (VIP users, critical servers), known malicious IPs, allowed TOR exit nodes, vulnerability remediation tracking.

Threat Intelligence: STIX/TAXII feeds ingested as TI indicators (IP, URL, file hash, domain). Used in: Threat Intelligence analytics rule (auto-alert when any ingested log matches a TI indicator), Advanced Hunting (join TI table with telemetry), Dashboard visualization. Microsoft Defender TI (MDTI) provides premium curated intel.

UEBA (User and Entity Behavior Analytics): ML baseline for each user/entity. Detects: peer group anomalies (Finance Director suddenly doing DevOps actions), time anomalies (user who only works 9-5 suddenly active at 3am), resource anomalies (user downloading 100x normal data volume). Produces Entity Insights and Anomaly score per user/device.

Automation rules: lightweight automated actions triggered on incident creation or update — without requiring a Logic App. Actions: assign owner, change severity, add tag, run playbook, close incident (suppress false positive). Run before Playbooks — use for triage and routing. Example: all incidents from "Office365" data connector → auto-assign to Tier-1 SOC group.

Playbooks (Logic Apps): full workflow automation for complex response. Triggers: incident trigger (when Sentinel creates incident), alert trigger, entity trigger (manual — analyst runs against specific entity during investigation). Actions: call Azure AD APIs (disable user, revoke sessions), call MDE APIs (isolate device, collect investigation package), send Teams adaptive card (human approval), create ServiceNow ticket, call any REST API.

Investigation graph: visual entity relationship map for incident investigation. Shows: users ↔ devices ↔ IPs ↔ files ↔ alerts ↔ mailboxes connected by relationships. Click any entity → expand related entities → find the lateral movement path without writing KQL. Good for Tier-1 SOC analysts.

Incident tasks: structured SOC playbook embedded in the incident — checklist of investigation/response steps. Can be auto-assigned by automation rules or manually by lead analyst. Track completion status per task. Ensures consistent IR process regardless of which analyst handles the incident.