Endpoint Security Operations

What endpoint security operations is as a job, what this course assumes is already deployed, and how to establish it. The signal you inherit, the queue that shapes your week, the four failures the course is organized around, and one week at Northgate worked end to end.

What endpoint telemetry actually is before you query it: where rows come from, what the pipeline does to them on the way, what each table can and cannot answer, and the eight properties that return a plausible wrong answer with nothing to indicate it.

Proactive threat hunting across MDE endpoint tables. 40+ annotated KQL queries for process anomalies, C2 beaconing, LOLBAS abuse, lateral movement, persistence discovery, and multi-step attack chain correlation.

Building endpoint detection rules that fire: placement, table selection, the conversion from hunt to rule, technique detections for credential access, lateral movement and persistence, indicator value, automation by measured confidence, and proving a rule is capable of firing before trusting its silence.

Decide what an investigation will be able to see, while nothing is wrong. Audit policy, script block logging, Sysmon, forwarding, on-demand collection, memory, containment that permits investigation, live state queries, and the one control whose value is entirely its coverage.

Operationalize the detection layer. Triage MDE alerts in 60 minutes, investigate using device timeline and process tree analysis, execute containment at scale, and apply incident-type-specific playbooks for ransomware, commodity malware, and living-off-the-land attacks.

Understand what attackers do to bypass the endpoint security stack, process injection, AMSI bypass, ETW tampering, EDR evasion, anti-forensics, from the defender's perspective. Build detections that survive evasion evolution and validate controls through purple team exercises.

Connect the endpoint security architecture to the broader security ecosystem. Zero-trust device signals, MDE-Sentinel integration, cross-workload detection, Logic App playbooks for automated response, MDE API for engineering, and MSSP coordination.

One estate, seven phases, and two documents somebody can be held to. Everything from EO0 to EO7 applied to Northgate as a single quarter of operations, from the telemetry nobody has audited to the runbook and detection portfolio that outlive the people who wrote them.

Subject-area sheets for endpoint operations: the question, the query that settles it, the fields that carry the decision, and what the answer does not prove.

Four procedures an endpoint operator repeats: running a hunt cycle, shipping a detection, working an alert to a closure, and collecting from a host under time pressure.

A complete operations lab: tenant, licensing, endpoints, onboarding, the activity worth hunting, and the checks that prove it works.

Worked operations investigations end to end, including the wrong turns, the queries that looked right and were not, and what would have changed each answer.

Three operations events with a procedure each: prerequisites, a pre-flight that validates the sources, a numbered sequence, tiered disposition and a worked handoff.

Where to practice the operations work in this course against populated data, and where your own lab is still the only option.

Every command, query and recurring check from the Endpoint Security Operations course, consolidated for the working moment rather than for learning.

Endpoint Security Operations end-of-course exam: a three-phase simulation testing whether you can apply the method to a situation the course did not walk through.