SC-200 flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Sentinel Reader role

Azure RBAC role granting read-only access to Sentinel data, incidents, and workbooks in a workspace. It cannot create or edit analytics rules or change incident status.

Sentinel Responder role

Role that can view and manage incidents, including changing status, assigning owners, and adding comments. It cannot create or modify analytics rules or automation rules.

Sentinel Automation Contributor

Role scoped to a resource group that permits Sentinel automation rules and playbooks to run against the workspace. It is required for playbook identities to act on incidents.

Query frequency vs lookback

Query frequency is how often an analytics rule runs; lookback is how far back each run searches. Lookback must be at least the frequency to avoid unexamined gaps.

Alert grouping by entities

Analytics rule setting that bundles alerts sharing selected mapped entities into one incident. Reduces incident noise when one actor generates repeated alerts across the same host or account.

Entity mapping in analytics

Maps query output columns to entity types such as Account, Host, or IP. Enables entity pages, entity-based grouping, and the investigation graph.

Automation rule order

Numeric sequence determining execution order when multiple automation rules match one incident trigger. Lower numbers run first, and later rules see prior changes.

Playbook region requirement

A Sentinel playbook is a Logic App that must reside in the same Azure region as the workspace. Cross-region playbooks cannot be attached to automation rules.

Watchlist alias function

KQL function _GetWatchlist('alias') returns rows from an uploaded CSV watchlist. Used to enrich queries with VIP lists, asset inventories, or known-bad indicators.

Data Collection Rule

Azure resource defining which data sources the Azure Monitor Agent collects and where it sends them. Used to route security events into a Sentinel workspace.

Incident close classifications

Options when closing an incident: True Positive, False Positive, Benign, and Undetermined. True Positive and False Positive require a written close reason.

Incident task purpose

Checklist item attached to an incident to track response steps with Open, Completed, or Deleted status. Records analyst actions rather than triggering automation.

Device isolation modes

Full isolation blocks all network traffic except the Defender service. Selective isolation additionally permits Outlook and Teams communication while blocking other traffic.

Live response basic commands

Commands available in a standard live response session, including cd, dir, getfile, putfile, and run. Advanced commands like remediate require the advanced capability enabled.

Mark user compromised

Defender XDR response action flagging an identity as high risk. It triggers additional detections for that account and can inform conditional access risk policies.

Force password reset action

Identity response action requiring the user to change their password at next sign-in. Used when credential compromise is suspected during incident triage.

Action center approvals

Defender XDR queue where pending automated investigation actions await analyst approval or rejection. Approving executes the remediation on the affected entity.

Evidence remediation status

Each entity in an automated investigation carries a verdict of Remediated, Not remediated, or Pending action. Pending action items require analyst approval in the Action center.

Custom detection rule

Defender XDR rule built from an advanced hunting query. Runs on a schedule, generates alerts, and can take automatic response actions on matching entities.

Restrict app execution

Endpoint response action limiting execution to Microsoft-signed binaries only. Blocks malware while allowing the operating system and Defender components to run.

Incident alert correlation

Process where Defender XDR merges alerts sharing entities or attack story into a single incident. Analysts can also manually merge related incidents.

Investigation package collection

Endpoint action gathering logs, registry keys, and memory artifacts into a downloadable archive. Used for offline forensic analysis after a suspected compromise.

KQL where operator

Filters a table to rows matching a boolean expression. Typically the first operator after the table reference to reduce data before projection or aggregation.

KQL summarize operator

Groups rows by one or more columns and computes aggregates such as count, dcount, make_set, or arg_max. Produces one output row per group.

KQL arg_max function

Aggregate returning the row with the maximum value of a column within each group. arg_max(TimeGenerated, *) retrieves the most recent row per entity.

KQL leftanti join

Join flavor returning left-side rows with no match on the right. Common hunting pattern for finding hosts or users absent from an expected baseline.

KQL innerunique default

Default join kind that deduplicates the left side on the join key before matching. Can silently drop rows; use inner when every left row must be preserved.

Hunting bookmarks

Saved rows or result sets from a hunting query in Sentinel. Bookmarks can be promoted into a new incident or linked to an existing one.

Livestream query

Sentinel hunting rule that runs continuously and creates an alert when results appear. Used to convert a validated hunting query into ongoing detection.

Defender XDR table prefixes

Advanced hunting tables are named by source: Device* for endpoint, Email* for mail, Identity* for identity, CloudApp* for SaaS, and Alert* for alert records.

TAXII threat intelligence feed

Standard protocol for importing STIX indicators into Sentinel via the Threat Intelligence solution. Imported indicators can match logs through TI matching rules.

MSTICPy notebooks

Python library used in Jupyter notebooks for hunting, enrichment, and visualization. Connects to Log Analytics and threat intelligence providers for investigation workflows.

UEBA behavior profiles

Sentinel feature building baseline behavior for users and hosts from logs and watchlists. Deviations appear as anomalies in entity pages and can drive custom detections.