Microsoft SOC Detection and Response

Microsoft SOC Detection and Response: running detection and response in a Microsoft SOC, taught against a month of records from an engineering company under attack. What a SOC does and where it fails, how to judge its maturity, the pipeline an alert follows, what the course builds, how to study it, and a six-scenario check of whether it fits you.

Where a SOC's work comes from, who does which part, what automation and agents did before a person looked, how the engineer knows the operation is working, and the numbers a SOC is judged by, taught from both seats in the Defender portal.

How a SOC brings a detection into being and looks after it: choosing what to detect, choosing the rule type, writing the full specification, testing against real data, tuning, managing detections as code, and running it all as a practice.

Identity detections for a Microsoft SOC, built to the Module 2 specification on Northgate's identity data: password spray, token replay, MFA fatigue, consent abuse, privileged changes, Conditional Access and authentication methods, and service principals.

Mail and collaboration detections for a Microsoft SOC, built to the Module 2 specification on Northgate's data: delivered lures, hiding and forwarding, mailbox reads, file downloads, applications in the mailbox, delegation and mail flow rules, and sending as the victim.

Endpoint detections for a Microsoft SOC, built to the Module 2 specification on Northgate's Defender for Endpoint data: Office launching scripts, credential dumping, lateral movement, persistence, staging, ransomware preparation, attack tools and compromised servers.

Detections for a Microsoft SOC beyond the endpoint sensor, built to the Module 2 specification on Northgate's data: a VPN portal spray, a web server exploit, cron persistence on Linux, egress, DNS tunnelling matched to threat intelligence, applications reading data through Microsoft Graph, and the Azure control plane.

Investigation playbooks for a Microsoft SOC, each run on a Northgate case: the architecture, shared steps for evidence, containment, agent verdicts and closure, and playbooks for adversary-in-the-middle phishing, ransomware before encryption, and an attack from the network edge into identity and the cloud.

Incident documentation for a Microsoft SOC, written from Northgate's cases: the incident record, the technical timeline, evidence and custody, the executive summary, notification evidence, stakeholder communication, the post-incident review and the report pack.

Hardening a Microsoft environment from the detection side: Conditional Access, Exchange Online, endpoints, applications, the network edge and SharePoint, each judged by what the SOC can see, with validation checks, change management and a checklist pack with an exception register.

Automation in a Microsoft SOC: deciding what to automate, automation rules, enrichment and containment playbooks, reading and governing automatic attack disruption, Defender's built-in remediation as it stands now, testing and monitoring all of it, and keeping it in one automation pack.

Measuring a Microsoft SOC and improving it: what measurement is for, time and workload, detection quality and coverage, data cost and value, automation and agents as workers, reporting the operation, the improvement loop, and the measures pack.

Running threat intelligence in a Microsoft SOC: what intelligence is for, trusting an indicator, judging a feed, sighting quality, turning a sighting into a decision, the indicator lifecycle, actor and campaign context, and the threat intelligence pack.

Running Security Copilot and its agents in a Microsoft SOC: what they are, capacity and cost, the Phishing Triage Agent, checking an agent's verdicts against the records, Copilot's summaries and generated KQL, the other agents, and the AI operations pack.

Subject-area sheets carrying the detection in both forms this course teaches, with the fields that carry the decision and the limits on each.

Seven procedures a SOC engineer repeats: building a detection, tuning it, deploying it to both surfaces, and the cycles around them.

A complete SOC lab: tenant, workspace, Sentinel, connectors, detectable activity, and the cost controls that stop it running away.

Worked detection engineering cases end to end, including the wrong turns, the queries that looked right and were not, and what would have changed each answer.

Seven events that arrive at a SOC engineer with a decision attached, each with prerequisites, a pre-flight, a numbered sequence and a worked handoff.

Where to practice the detection engineering in this course against populated data and real deployment surfaces.

The quick reference and field manual for this course: the queries, configuration steps and procedures, organized for use during live work.

The SEC302 project: a brief for three things you build in your own environment from what the course taught, one incident investigated and reported to the course's standard, one detection specified and given a tuning review, and a review of your own operation's health and measures. No submission, no grading.

Microsoft SOC Detection and Response end-of-course exam, a simulation-based assessment testing your ability to triage, investigate, and respond to a multi-stage incident using the skills built across all 14 modules.