Skip to content
Quest Training

Microsoft Security Operations Analyst (SC-200) Training Course

Equips analysts to triage alerts, investigate incidents, hunt threats and respond using Microsoft security tools, in line with the SC-200 role.

MSCS · Microsoft Security & Cybersecurity TechnologiesAll Levels#2527ClassroomEnglish , Arabic
Duration
5 Days
Download BrochureView Upcoming Dates

Free substitution at any time · 30+ days' notice: full refund minus 10%. Cancellation policy

Sectors:Information Technology & CybersecurityCategories:Microsoft Security & Cybersecurity Technologies

Course Overview

This advanced practical training course develops the capabilities required to operate and support a modern security operations function using Microsoft security technologies. It focuses on threat detection, investigation, incident response, security monitoring, threat hunting, and the analysis of security signals across enterprise environments. The programme covers security operations workflows, Microsoft security monitoring capabilities, incident investigation, threat detection, security analytics, threat hunting, endpoint investigation, identity-related threats, cloud security signals, and response actions. It emphasizes the practical correlation of alerts, incidents, logs, and security telemetry to identify threats and determine appropriate response activities. Through hands-on investigation scenarios and operational exercises, participants develop the ability to analyse security alerts, investigate incidents, identify malicious activity, conduct threat hunting, respond to security events, and improve detection and response processes within a Microsoft-based security operations environment.

Learning Objectives

  • Analyse the core responsibilities and workflows of a modern security operations analyst.
  • Evaluate security alerts and distinguish meaningful threats from non-actionable activity.
  • Apply structured techniques for investigating security incidents.
  • Analyse security logs, alerts, events, and telemetry from multiple sources.
  • Identify indicators of compromise and suspicious activity across enterprise environments.
  • Apply threat hunting techniques to proactively identify potential security threats.
  • Investigate endpoint-related security events and suspicious activities.
  • Analyse identity, authentication, and access-related security signals.
  • Apply appropriate incident response and remediation actions.
  • Use security analytics and correlation techniques to improve threat detection.
  • Evaluate security operations performance and identify opportunities for improvement.
  • Develop an integrated approach to threat detection, investigation, hunting, and response.

Who Should Attend

This course is designed for security operations analysts, cybersecurity analysts, incident responders, threat hunters, security engineers, SOC professionals, and IT security specialists responsible for monitoring and responding to security threats. It is also suitable for security managers, technical leads, system administrators, identity professionals, cloud security specialists, and IT professionals working with Microsoft security technologies. The programme is particularly relevant to organizations operating security operations centers or Microsoft-based security environments and seeking to strengthen threat detection, investigation, incident response, and proactive threat hunting capabilities.

Learning Outcomes

  • Explain the role and operational responsibilities of a security operations analyst.
  • Analyse security alerts and prioritize incidents based on risk and impact.
  • Investigate security incidents using relevant logs, alerts, and telemetry.
  • Identify indicators of compromise across endpoints, identities, applications, and networks.
  • Correlate security events from multiple sources to determine potential attack activity.
  • Conduct structured threat hunting activities to identify hidden or emerging threats.
  • Investigate suspicious endpoint and user activities.
  • Analyse identity and authentication events for potential compromise.
  • Apply appropriate containment, remediation, and response actions.
  • Develop evidence-based conclusions from security investigations.
  • Improve detection and response processes using operational findings and security analytics.
  • Establish a structured workflow for continuous monitoring, threat hunting, investigation, and incident response.

Course Outline

Day 1

Security Operations & Threat Detection

  • Security operations centre functions and operating models
  • Responsibilities of the security operations analyst
  • Security monitoring principles
  • Security alerts, incidents, events, and signals
  • Threat detection lifecycle
  • Security telemetry and data sources
  • Alert prioritization and triage
  • Indicators of compromise
  • False positives and alert optimization
  • Practical Application: Analyse a set of security alerts, prioritize potential threats, and determine the appropriate investigation path
Day 2

Security Incident Investigation & Analytics

  • Incident investigation methodology
  • Security event correlation
  • Log and telemetry analysis
  • Investigation timelines
  • User and entity activity analysis
  • Identifying attack patterns
  • Investigating suspicious authentication and access activity
  • Security analytics and investigative queries
  • Evidence collection and investigation documentation
  • Practical Application: Investigate a simulated security incident by correlating alerts, logs, user activity, and system telemetry
Day 3

Threat Hunting & Endpoint Investigation

  • Threat hunting principles and methodologies
  • Proactive threat identification
  • Developing hunting hypotheses
  • Hunting for suspicious behaviours and indicators
  • Endpoint security investigation
  • Process and activity analysis
  • File, application, and system artefacts
  • Identifying malicious or abnormal endpoint behaviour
  • Connecting endpoint findings with broader security incidents
  • Practical Application: Conduct a threat hunting exercise to identify suspicious endpoint activity and develop investigation findings
Day 4

Identity, Cloud Signals & Incident Response

  • Identity-based threats and attack techniques
  • Authentication and access-related investigations
  • Suspicious account activity
  • Cloud security signals
  • Investigation across users, applications, and cloud resources
  • Incident containment principles
  • Remediation and recovery actions
  • Response prioritization and escalation
  • Coordinating technical response activities
  • Practical Application: Investigate a simulated identity and cloud security incident and develop an appropriate containment and remediation response
Day 5

Advanced Detection, Response & Security Operations Improvement

  • Advanced security event correlation
  • Improving detection accuracy
  • Threat hunting refinement
  • Incident response optimization
  • Detection and response workflows
  • Security operations metrics and performance
  • Identifying operational gaps and recurring issues
  • Improving investigation efficiency
  • Continuous improvement of security operations
  • Final Workshop: Conduct an end-to-end security operations investigation covering alert triage, incident analysis, threat hunting, evidence correlation, response actions, and operational improvement

Upcoming Dates

CityDatesPrice per ParticipantEarly Bird
Kuala LumpurScheduled
2 – 6 Nov 2026€4,700—
SelectDownload Brochure
LisbonScheduled
9 – 13 Nov 2026€6,000—
SelectDownload Brochure
LondonScheduled
16 – 20 Nov 2026€5,800—
SelectDownload Brochure
MadridScheduled
23 – 27 Nov 2026€6,000€5,400until 2 Nov
SelectDownload Brochure
MakkahScheduled
23 – 27 Nov 2026€4,800€4,320until 2 Nov
SelectDownload Brochure
ManamaScheduled
30 Nov – 4 Dec 2026€5,300€4,770until 9 Nov
SelectDownload Brochure
MarrakeshScheduled
7 – 11 Dec 2026€4,700€4,230until 16 Nov
SelectDownload Brochure
MilanScheduled
14 – 18 Dec 2026€7,000€6,300until 23 Nov
SelectDownload Brochure
MunichScheduled
21 – 25 Dec 2026€6,000€5,400until 30 Nov
SelectDownload Brochure
MuscatScheduled
28 Dec 2026 – 1 Jan 2027€6,300€5,670until 7 Dec
SelectDownload Brochure
OnlineScheduled
3 – 7 Jan 2027€2,700€2,430until 14 Dec
SelectDownload Brochure
ParisScheduled
4 – 8 Jan 2027€6,700€6,030until 14 Dec
SelectDownload Brochure
RiyadhScheduled
11 – 15 Jan 2027€4,800€4,320until 21 Dec
SelectDownload Brochure
RomeScheduled
18 – 22 Jan 2027€7,000€6,300until 28 Dec
SelectDownload Brochure
SalalahScheduled
25 – 29 Jan 2027€6,300€5,670until 4 Jan
SelectDownload Brochure
SingaporeScheduled
1 – 5 Feb 2027€8,000€7,200until 11 Jan
SelectDownload Brochure
TrabzonScheduled
8 – 12 Feb 2027€5,300€4,770until 18 Jan
SelectDownload Brochure
TunisiaScheduled
15 – 19 Feb 2027€4,300€3,870until 25 Jan
SelectDownload Brochure
ViennaScheduled
22 – 26 Feb 2027€6,400€5,760until 1 Feb
SelectDownload Brochure
AmmanScheduled
28 Feb – 4 Mar 2027€4,000€3,600until 8 Feb
SelectDownload Brochure
AmsterdamScheduled
1 – 5 Mar 2027€6,000€5,400until 8 Feb
SelectDownload Brochure
BakuScheduled
8 – 12 Mar 2027€5,300€4,770until 15 Feb
SelectDownload Brochure
BarcelonaScheduled
15 – 19 Mar 2027€6,000€5,400until 22 Feb
SelectDownload Brochure
CairoScheduled
22 – 26 Mar 2027€3,800€3,420until 1 Mar
SelectDownload Brochure
CasablancaScheduled
29 Mar – 2 Apr 2027€4,700€4,230until 8 Mar
SelectDownload Brochure
DammamScheduled
5 – 9 Apr 2027€4,800€4,320until 15 Mar
SelectDownload Brochure
DohaScheduled
12 – 16 Apr 2027€4,700€4,230until 22 Mar
SelectDownload Brochure
DubaiScheduled
18 – 22 Apr 2027€4,700€4,230until 29 Mar
SelectDownload Brochure
GenevaScheduled
19 – 23 Apr 2027€7,300€6,570until 29 Mar
SelectDownload Brochure
IstanbulScheduled
26 – 30 Apr 2027€5,300€4,770until 5 Apr
SelectDownload Brochure

Available in: Istanbul · Dubai · London · Riyadh · Doha · Amsterdam

Need more details?Chat with us on WhatsApp

Related Courses

Ready to Elevate Your Team's Capabilities?

Speak with our advisors about upcoming programmes or a bespoke corporate training plan.

Download BrochureContact Our Team