What's changed: Created SC-100 Chapter 2 (Domain 2 first-half "Security operations": Defender XDR/Sentinel (SIEM)/XDR+SIEM integration/Defender for Endpoint, Identity, Office 365, Cloud Apps; SOAR/automation rules/playbooks (Logic Apps)/threat hunting (KQL)/UEBA; centralized logging/Microsoft Purview Audit (Standard, Premium)/multicloud monitoring/retention and isolation; MITRE ATT&CK (Enterprise/Mobile/ICS)/detection coverage/incident-response workflows).
2.2SOAR and incident-response automation
Understand SOAR (orchestration and automated response) with Microsoft Sentinel and Defender XDR, automation rules and playbooks, designing incident response/threat hunting/incident management workflows, and UEBA.
After detection comes "speed and consistency of response." Relying on analyst manual work is slow and inconsistent. SOAR (Security Orchestration, Automation and Response) turns response into automated procedures so humans can focus on judgment.
2.2.1Sentinel SOAR: rules and playbooks
Microsoft Sentinel implements SOAR via automation rules (declarative incident triage/assignment/tagging/suppression) and playbooks (automated workflows built on Azure Logic Apps). For example, automate "on a risky sign-in, disable the user, open a ticket, and notify Teams." Architects design Sentinel SOAR for "automate repetitive first-response to reduce MTTR." Defender XDR also provides automated investigation and remediation; the two split responsibilities.
2.2.2Threat hunting and UEBA
Threat hunting proactively forms "compromise hypotheses" without waiting for alerts and searches via queries (Sentinel KQL hunting queries and bookmarks). UEBA (User and Entity Behavior Analytics) uses machine learning to detect deviations from normal for users/entities, surfacing insider threats and account takeover. Architects fold hunting and UEBA into operations for "find unknown threats and insider abuse early."
Cues: "auto-run a chain of responses (disable/ticket/notify) on an incident" = Sentinel playbook (Logic Apps). "declarative triage/assignment/suppression" = automation rules. "proactively search without waiting for alerts" = hunting (KQL). "detect insider threats via deviation from normal" = UEBA.
Watch the mix-ups: (1) Distinguish playbooks (Logic Apps automated workflows) from automation rules (declarative incident-ops rules). (2) SOAR follows detection (SIEM/XDR)—it is not detection itself. (3) Design approvals/guards for high-impact automated actions (e.g., mass disable) given false-positive risk.
2.2.3Section summary
- SOAR = response automation; Sentinel uses automation rules (declarative triage) + playbooks (Logic Apps)
- Hunting = proactive KQL search without waiting for alerts; UEBA = deviation-from-normal for insider/takeover
- Split Defender XDR auto-investigation/remediation and Sentinel SOAR to reduce MTTR
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. On a risky sign-in, you want to auto-run "disable user → open ticket → notify Teams." Which is best?
Q2. To automate incident triage, assignment, and duplicate suppression declaratively without code, which is best?
Q3. To form compromise hypotheses without waiting for alerts and proactively search logs with KQL—which activity is this?
Q4. To catch a legitimate user’s "deviation from normal" via ML and detect insider threats or account takeover, which is best?
Q5. When designing SOAR automated response, which caution is most appropriate?