Defend against cyberthreats with Microsoft Defender XDR (SC-5004)

Participants should have:

• A fundamental understanding of Microsoft security, compliance, and identity technologies
• Intermediate knowledge of Microsoft Windows environments
• Familiarity with the Microsoft Defender portal and Microsoft Defender for Endpoint
• Basic understanding of Kusto Query Language (KQL)
• Experience with security operations or threat monitoring concepts is recommended

Learners preparing for the associated Microsoft Applied Skills assessment or working in a Security Operations Analyst role will benefit most from this course.

Target audience

This course is designed for:

• Security Operations Analysts responsible for threat monitoring and incident response
• Cybersecurity professionals working with Microsoft Defender technologies
• SOC teams looking to improve threat investigation and remediation capabilities
• IT professionals supporting endpoint protection and organisational security operations
• Organisations seeking to strengthen cyber resilience through applied Microsoft security skills

This course is particularly valuable for teams responsible for reducing organisational risk through faster threat detection, response, and remediation.

By the end of this course, learners will be able to:

• Mitigate security incidents using Microsoft Defender XDR tools and workflows
• Deploy and configure Microsoft Defender for Endpoint environments
• Configure alerts and detections to improve visibility into security threats
• Automate security operations tasks using Microsoft Defender for Endpoint capabilities
• Perform device investigations to identify suspicious activity and support remediation efforts
• Investigate and respond to cyberthreats using integrated Microsoft Defender XDR tools
• Apply practical threat response techniques through guided lab exercises and scenario-based learning

These learning outcomes align to the Microsoft Applied Skills assessment objectives for SC-5004 and reflect modern security operations analyst responsibilities.

Introduction to Microsoft Defender XDR

• Understanding Microsoft Defender XDR and unified threat protection
• Exploring the role of Microsoft Defender XDR within modern security operations
• Understanding how integrated security signals improve threat visibility
• Reviewing the responsibilities of a Security Operations Analyst
• Navigating the Microsoft Defender portal and associated services

Mitigating incidents using Microsoft Defender

• Understanding incident management workflows
• Investigating alerts and correlated incidents
• Analysing attack timelines and threat intelligence
• Managing incident prioritisation and remediation activities
• Using Microsoft Defender tools to reduce organisational risk
• Applying best practices for effective incident response

Deploying Microsoft Defender for Endpoint

• Understanding Microsoft Defender for Endpoint architecture
• Preparing endpoint environments for deployment
• Configuring onboarding and device management settings
• Managing endpoint security policies and compliance requirements
• Validating deployment readiness across organisational environments
• Reviewing deployment considerations for enterprise-scale environments

Configuring alerts and detections

• Understanding detection rules and alert generation
• Configuring endpoint detection and response settings
• Managing alert tuning to reduce false positives
• Reviewing automated investigation and remediation capabilities
• Analysing threat indicators and suspicious behaviour patterns
• Supporting operational monitoring through effective detection strategies

Managing automation in Microsoft Defender for Endpoint

• Understanding security automation concepts
• Configuring automated investigation and remediation workflows
• Managing automation levels and response actions
• Reviewing automation use cases for security operations teams
• Improving operational efficiency through automated security processes
• Monitoring and validating automated response activities

Performing device investigations

• Investigating compromised or suspicious devices
• Reviewing device timelines and behavioural data
• Analysing user activity and endpoint events
• Identifying indicators of compromise and lateral movement activity
• Using advanced hunting and KQL queries to investigate threats
• Supporting remediation and recovery activities following investigations

Threat hunting and operational response

• Understanding proactive threat hunting methodologies
• Using Microsoft Defender XDR to search for suspicious activity
• Correlating data across endpoints, identities, email, and applications
• Investigating attack chains and persistence mechanisms
• Supporting collaboration between security and operational teams
• Applying organisational context to threat response activities

Applied labs and cyberthreat defence exercises

• Completing guided Microsoft Defender XDR lab exercises
• Investigating simulated security incidents in controlled environments
• Practising real-world threat response workflows
• Applying endpoint investigation and mitigation techniques
• Performing alert analysis and remediation tasks
• Reinforcing practical security operations skills through hands-on learning

Best practices for security operations teams

• Strengthening organisational cyber resilience
• Improving visibility across security operations environments
• Supporting collaboration between security stakeholders
• Applying security monitoring and response best practices
• Developing scalable approaches to threat detection and remediation
• Aligning Microsoft Defender XDR capabilities to organisational security goals

Exams and assessments

This course aligns to the Microsoft Applied Skills assessment: Defend against cyberthreats with Microsoft Defender XDR.

Learners will reinforce their knowledge through:

• Knowledge checks throughout the course
• Guided practical exercises and applied labs
• Threat investigation activities and scenario-based tasks
• Hands-on Microsoft Defender XDR exercises

There is no formal QA exam included as part of the course delivery.

Hands-on learning

This course includes practical, hands-on learning throughout, helping learners apply skills directly in Microsoft Defender XDR environments.

Learners will participate in:

• Guided labs using Microsoft Defender XDR and Defender for Endpoint
• Threat investigation and remediation exercises
• Practical alert analysis and response scenarios
• Instructor-led demonstrations and operational walkthroughs
• Applied exercises using real-world security operations workflows

We believe applied learning is essential for organisations building effective cyber defence capabilities. This course combines technical instruction with practical exercises designed to support operational confidence and faster skills application.