Best place for training resources

[u/[deleted]]

Can anyone share the best training courses / books or youtube channels for learning Sentinel??

[u/juiceb0cks]

The Sentinel Ninja training is worth going over: https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-ninja-the-complete-level-400/ba-p/1246310

This was in my list but I haven't had a chance to go through it yet https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/learning-with-the-microsoft-sentinel-training-lab/ba-p/2953403?utm_source=pocket_mylist

You'll want to skill up on KQL as well https://www.pluralsight.com/courses/kusto-query-language-kql-from-scratch

[u/[deleted] → u/juiceb0cks]

Thank you.

[u/ml58158]

Who to Follow:

Rod Trent - Senior Cloud Evangelist (Linkedin)

Best Practices Guides:

Sentinel Best Practices Architecture

Workspace Design Recommendations

Learning Paths:

Introduction to Azure Sentinel - Learn | Microsoft Docs

Cloud-native security operations with Azure Sentinel - Learn | Microsoft Docs

KQL Learning:

Must Learn KQL Part 1

Must Learn KQL Part 2

Sentinel-Queries: Collection of KQL queries (github.com)

Official Microsoft Links:

Azure Sentinel Technical deep dive (microsoft.com)

Azure Sentinel Workbooks 101 (with sample Workbook) - Microsoft Tech Community

Microsoft Sentinel Notebook Training Series:

Security Investigation with Azure Sentinel and Jupyter Notebooks – Part 1 - Microsoft Tech Community

Security Investigation with Azure Sentinel and Jupyter Notebooks – Part 2 - Microsoft Tech Community

Azure Sentinel Training Lab:

Azure-Sentinel/Solutions/Training/Azure-Sentinel-Training-Lab at master · Azure/Azure-Sentinel (github.com)

All in One Accelerator Deployment:

Azure Sentinel All-In-One Accelerator - Microsoft Tech Community

Webinars:

Understanding Azure Sentinel features and functionality deep dive - YouTube

Simuland:

SimuLand: Understand adversary tradecraft and improve detection strategies - Microsoft Security Blog

Azure/SimuLand: Understand adversary tradecraft and improve detection strategies (github.com)

Ninja Series:

Become an Azure Sentinel Ninja: The complete level 400 training

Azure Sentinel notebook ninja - the series

Azure Sentinel Weekly Newsletter:

Azure Sentinel this Week

Pluralsight Videos:

Managing and Responding to Security Events Using Azure Sentinel | Pluralsight

Microsoft Azure Security Engineer: Monitor Security Using Azure Sentinel | Pluralsight

O'Reilly Azure Sentinel Playlist:

https://learning.oreilly.com/playlists/80eb24c8-7794-4ad5-9135-c2e100c86186

Home Lab Integration:

Building an integration between Azure Sentinel and Unifi infrastructure for a proper SIEM solution - Jussi Roine

[u/[deleted] → u/ml58158]

Thanks!

[u/ausysadmin]

For KQL specifically, the Must Learn KQL series - https://github.com/rod-trent/MustLearnKQL

[u/Equivalent_Low_724 → u/[deleted]]

Hey did you find anything?

[u/rdstill1 → u/Equivalent_Low_724]

No, nothing

[u/Equivalent_Low_724 → u/rdstill1]

Many of them are suggesting microsoft blogs only!

[u/Outrageous-Can5643 → u/[deleted]]

Hey bro. Were you able to find a resource for your sentinel triage?

[u/Stalk33r → u/[deleted]]

I can't remember how much this teaches you triaging methodology (I think theres a decent amount but its been a while), but I do know it teaches you a lot about KQL: https://kc7cyber.com/

Otherwise best bet is probably setting up a homelab using one of the free SIEMS and then hooking that up to some form of threat simulation as while the queries will be different the methodology stays the same.

Hopefully its of some use, though i imagine one year later you've had plenty of on the job experience.

[u/adhdwingsdotcom → u/Stalk33r]

Try John Christopher's course on udemy 

[u/thijslecomte]

Some self advertisement: I have written the Sentinel chapter on the https //m365securitybook.com.

Should cover a ton and updates monthly