Chapter 2: Manage a security operations environment-Configure settings in Microsoft Defender XDR-Configure Microsoft Defender for Endpoint advanced features
Chapter 4: Manage a security operations environment-Configure settings in Microsoft Defender XDR-Manage automated investigation and response capabilities in Microsoft Defender XDR
Chapter 5: Manage a security operations environment-Configure settings in Microsoft Defender XDR-Configure automatic attack disruption in Microsoft Defender XDR
Chapter 6: Manage a security operations environment-Manage assets and environments-Configure and manage device groups, permissions, and automation levels in Microsoft Defender for Endpoint
Chapter 9: Manage a security operations environment-Manage assets and environments-Identify and remediate devices at risk by using Microsoft Defender Vulnerability Management
Chapter 10: Manage a security operations environment-Manage assets and environments-Mitigate risk by using Exposure Management in Microsoft Defender XDR
Chapter 13: Manage a security operations environment-Design and configure a Microsoft Sentinel workspace-Specify Azure RBAC roles for Microsoft Sentinel configuration
Chapter 14: Manage a security operations environment-Design and configure a Microsoft Sentinel workspace-Design and configure Microsoft Sentinel data storage, including log types and log retention
Chapter 15: Manage a security operations environment-Ingest data sources in Microsoft Sentinel-Identify data sources to be ingested for Microsoft Sentinel
Chapter 17: Manage a security operations environment-Ingest data sources in Microsoft Sentinel-Configure and use Microsoft connectors for Azure resources, including Azure Policy and diagnostic settings
Chapter 18: Manage a security operations environment-Ingest data sources in Microsoft Sentinel-Plan and configure Syslog and Common Event Format (CEF) event collections
Chapter 19: Manage a security operations environment-Ingest data sources in Microsoft Sentinel-Plan and configure collection of Windows Security events by using data collection rules, including Windows Event Forwarding (WEF)
Chapter 20: Manage a security operations environment-Ingest data sources in Microsoft Sentinel-Create custom log tables in the workspace to store ingested data
Chapter 24: Configure protections and detections-Configure protections and detections-Configure security policies for Microsoft Defender for Endpoints, including attack surface reduction (ASR) rules
Chapter 25: Configure protections and detections-Configure protections and detections-Configure cloud workload protections in Microsoft Defender for Cloud
Chapter 27: Configure protections and detections-Configure detections in Microsoft Defender XDR-Manage alerts, including tuning, suppression, and correlation
Chapter 33: Manage incident response-Respond to alerts and incidents in the Microsoft Defender portal-Investigate and remediate threats by using Microsoft Defender for Office 365
Chapter 34: Manage incident response-Respond to alerts and incidents in the Microsoft Defender portal-Investigate and remediate ransomware and business email compromise incidents identified by automatic attack disruption
Chapter 35: Manage incident response-Respond to alerts and incidents in the Microsoft Defender portal-Investigate and remediate compromised entities identified by Microsoft Purview data loss prevention (DLP) policies
Chapter 36: Manage incident response-Respond to alerts and incidents in the Microsoft Defender portal-Investigate and remediate threats identified by Microsoft Purview insider risk policies
Chapter 37: Manage incident response-Respond to alerts and incidents in the Microsoft Defender portal-Investigate and remediate alerts and incidents identified by Microsoft Defender for Cloud workload protections
Chapter 38: Manage incident response-Respond to alerts and incidents in the Microsoft Defender portal-Investigate and remediate security risks identified by Microsoft Defender for Cloud Apps
Chapter 39: Manage incident response-Respond to alerts and incidents in the Microsoft Defender portal-Investigate and remediate compromised identities that are identified by Microsoft Entra ID
Chapter 40: Manage incident response-Respond to alerts and incidents in the Microsoft Defender portal-Investigate and remediate security alerts from Microsoft Defender for Identity
Chapter 42: Manage incident response-Respond to alerts and incidents identified by Microsoft Defender for Endpoint-Perform actions on the device, including live response and collecting investigation packages
Chapter 43: Manage incident response-Respond to alerts and incidents identified by Microsoft Defender for Endpoint-Perform evidence and entity investigation