Hi everybody,
Currently, I am studying for Microsoft SC-200 and have been trying to learn how security operations are conducted in practice and not separately for every topic I encounter. As I continue learning more, I see that conducting an investigation of a security incident requires performing different activities that can be combined and having the purpose of the tool used may not be enough to determine the next step in the process. For instance, in case of the alert generation in Microsoft Sentinel, I should know the cause of the alert, related entities and whether the information provided indicates any malicious behavior or false positive and further conduct the investigation by analyzing related incidents, looking at the sign-in activity, finding related alerts in Microsoft Defender or writing KQL queries. Another topic that requires some time to master is KQL. Knowing how to write the basics of the query is quite easy but filtering the data, setting proper time range, correlating related events and understanding results requires time.
I am also trying to make sense of what is the difference between identifying a threat, conducting investigation, hunting through the activity that hasn't triggered an alert yet, and responding accordingly. In preparation, I have been looking through some of the SC 200 exam questions, in order to find out what areas require more attention from me. I try to use the questions to see if I can answer reason why a particular investigation/response is needed in the situation, rather than just remembering the. It is especially helpful when I get it wrong to go back and figure out what I have missed. I am interested in how others prepare for these types of questions. When you practice investigation scenarios, do you first look into the details of the alert, check the user/device that is being affected, or the activity associated with the alert in Sentinel? What criteria do you have to decide if the alert requires further investigation or can be dismissed? For those who have taken SC-200 before, what section was difficult to prepare for, and what would you advise people to study differently? I believe that by analyzing various methods, candidates will be able to get not only an idea of what to do but also why to do it.