Sentinel for Cyber Threats

Introduction:

A mid-sized company, Contoso Retail, recently migrated its IT infrastructure to Azure. Set up a small SOC team. They are concerned about increasing cyber threats, especially phishing attacks targeting their employees. They decided to implement Microsoft Sentinel to enhance their security posture.

Listen to conversation between Alice and Bob about the recent phishing attack

Knowledge Check

1. Alice received a phishing email during a drill. What tool does Bob mention their organization uses to tackle phishing issues?




2. Bob explains that the first step in using Microsoft Sentinel is to get all security data into one place. Which feature of Sentinel is used for this purpose?




3. In the scenario, Bob mentions using Analytics Rules to detect phishing attempts. What specific keywords do these rules look for?




4. Bob describes a feature that checks for Correlation in suspicious activities. Which of the following scenarios would raise a red flag according to this feature?




5. Once Sentinel detects a phishing attempt, what automated response does Bob say their organization has set up using Playbooks?




6. Bob mentions using Kusto Query Language (KQL) for proactive threat hunting. What is the primary purpose of using KQL in Microsoft Sentinel?




7. To keep track of security information, Bob says they built Workbooks. What do these Workbooks provide?




Give us your feedback about this learning resource