What's changed: Created SC-200 Chapter 2 (Domain 1 middle: Sentinel roles/data retention (Analytics, Data lake, XDR tiers)/workbooks/SOC optimization; data connector selection/Windows Security Events via AMA/Azure Monitor Agent (AMA)/data collection rules (DCR)/Windows Event Forwarding (WEF); Syslog via AMA, CEF via AMA/Azure activities (resource diagnostic settings, Azure Policy)/threat indicators (IOCs, threat intelligence connectors)/custom log tables).
2.1Sentinel roles, data retention, and SOC optimization
Understand specifying Microsoft Sentinel roles, data retention across XDR/Sentinel tables (Analytics, Data lake, XDR tiers), creating workbooks, and SOC optimization recommendations.
Microsoft Sentinel is the SOC’s central SIEM. Analysts design who can do what (roles), which tier holds logs and for how long (cost vs investigation needs), and a way to continuously improve operations.
2.1.1Roles and data-retention tiers
Assign least privilege with Sentinel roles (Reader/Responder/Contributor, etc.). Choose a tier by purpose: the Analytics tier (frequent detection/cross-investigation, short–mid retention, higher cost), the Data lake tier (low-cost long-term storage of large data with later exploration), and the XDR tier (Defender XDR tables). Use Analytics for "real-time detection," Data lake for "retain long-term cheaply for audit/compliance."
2.1.2Workbooks and SOC optimization
Workbooks are dashboards that visualize ingested data—sign-in trends, detection hits, connector health, etc. SOC optimization analyzes "wasted cost (unused ingestion)" and "coverage gaps (insufficient detection vs threats)" and recommends data/rule optimizations. Analysts use it to continuously improve cost efficiency and detection coverage.
Cues: "real-time detection/cross-investigation" = Analytics tier. "low-cost long-term storage of large logs + later exploration" = Data lake tier. "data visualization dashboard" = workbooks. "recommend cutting wasted ingestion and closing coverage gaps" = SOC optimization. Minimize permissions via Sentinel roles.
Watch the mix-ups: (1) Analytics tier (frequent detection, higher cost) vs Data lake tier (long-term, low cost). (2) Workbooks (visualization) differ from analytics rules (detection). (3) SOC optimization recommends—analysts decide what to apply.
2.1.3Section summary
- Least privilege via Sentinel roles; pick retention by purpose: Analytics (frequent detection/high cost)/Data lake (long-term/low cost)/XDR tier
- Workbooks visualize; SOC optimization recommends cutting wasted ingestion and closing coverage gaps
- Data lake is cheap long-term storage for later exploration
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to retain large logs cheaply long-term for audit/compliance and explore them later when needed. Which retention tier is best?
Q2. Which tier holds logs used for real-time detection and frequent cross-investigation?
Q3. Which Sentinel feature analyzes "unused ingestion cost" and "detection coverage gaps vs threats" and recommends optimizations?
Q4. You want a dashboard visualizing sign-in trends and connector health. Which is best?
Q5. You want to assign least privilege in Sentinel to an analyst. Which is best?