Azure Sentinel Course — Lesson 1: Foundations, Architecture, and Use Cases

Topics Covered

• SIEM and SOAR architecture and data onboarding
• Analytics rules, detections, incidents, and hunting
• Workbooks, watchlists, threat intelligence, and automation
• Investigation, response, playbooks, and case management
• Roles, prerequisites, terminology, and success criteria
• Business and technical requirement mapping
• Solution boundaries, dependencies, and assumptions

Practical Activity

Analyze a representative use case, document requirements, and create a solution or platform map.

• Document assumptions, selected features or services, and expected outcomes.
• Record validation evidence, risks, dependencies, and corrective actions.
• Summarize the decision in a reusable implementation or operations note.

Lesson Outcome

Learners can explain and apply the lesson topics within a realistic Microsoft Sentinel scenario.