SC-200 key terms

A cloud-native security information and event management service in Azure that collects logs, detects threats with analytics rules, and supports investigation and automated response.

The Azure storage and query container that holds ingested security data, where Sentinel stores tables and runs Kusto queries against them.

A Sentinel configuration that pulls logs from a source such as Microsoft 365, Azure activity, or a third-party product into the workspace for analysis.

The read-only query language used to search, filter, summarize, and join tables in Log Analytics, forming the basis of detections and hunting queries.

A scheduled or near-real-time Sentinel rule that runs a query on a schedule and raises an alert when results match defined conditions.

A single detection event produced when an analytics rule, custom detection, or built-in protection matches suspicious activity in collected data.

A grouped collection of related alerts and evidence in Microsoft Sentinel or Defender that represents one case an analyst investigates and resolves.

A classification such as High, Medium, Low, or Informational that indicates the potential impact of an incident and drives triage priority.

The initial review of an alert or incident to decide whether it is a true positive, its urgency, and what response steps are required.

A detection result that correctly identifies real malicious or policy-violating activity, as opposed to a false positive or benign anomaly.

An alert raised on activity that is actually benign, often caused by overly broad logic, missing exclusions, or expected administrative behavior.

The process of adjusting detection logic, thresholds, and exclusions so rules produce fewer false positives while still catching real threats.

Configuration in an analytics rule that tells Sentinel which fields represent accounts, hosts, IP addresses, or URLs so they become linked entities in incidents.

A discrete object in an investigation, such as a user account, device, IP address, file hash, or mailbox, that can be linked and explored.

A visual map in Microsoft Sentinel or Defender that shows entities and their relationships to help analysts explore how an incident unfolded.

An Azure Logic Apps workflow triggered manually or automatically from an incident to perform response actions such as notifications, blocking, or ticket creation.

A Sentinel rule that automatically responds to created incidents by assigning owners, changing severity, adding tags, or running playbooks.

A saved KQL query used proactively to search for suspicious patterns that no current analytics rule detects, often run before promoting results to a detection.

A saved record in Microsoft Sentinel that preserves query results or evidence so an analyst can revisit them or attach them to an incident.

The integrated suite that correlates signals across endpoints, identities, email, and cloud apps and produces unified incidents and advanced hunting data.

The KQL-based query interface in Microsoft Defender XDR that lets analysts search raw, near-real-time telemetry across the suite's workloads.

A Defender XDR rule built from an advanced hunting query that runs on a schedule and generates alerts or incidents when results are found.

Automatic containment capability in Microsoft Defender XDR that blocks observed attacker activity in progress, such as disabling a compromised account or containing a device.

A Defender capability that examines alerts and entities, determines verdicts, and can apply remediation actions with or without analyst approval.

A public knowledge base of adversary tactics and techniques used to categorize detections, structure threat hunting, and assess coverage gaps.

A Sentinel table of reference data such as VIP users, IP ranges, or threat indicators that queries and analytics rules can join against.

An observable such as an IP address, domain, URL, or file hash with known malicious associations that can be imported and matched against logs.

A customizable Sentinel dashboard built on Azure Monitor workbooks that visualizes query results, trends, and operational metrics.

The Azure and Sentinel permission model that assigns roles such as reader, responder, or contributor to control who can view or act on data.

The configured period during which ingested security logs remain queryable in a workspace before archival or deletion, affecting investigation history.

The process of collecting and loading log data from connected sources into the workspace, where cost and latency depend on volume and method.

Risk detections from Microsoft Entra ID Protection, such as anonymous IP use or leaked credentials, that feed alerts and incidents for identity threats.

A Defender for Endpoint control that blocks specific behaviors commonly used by malware, such as Office child processes or script-based execution.

A Defender for Endpoint remote shell that lets analysts run commands, collect files, and investigate a device directly during an incident.

Artifact evidence of a security breach, such as a malicious hash, domain, or IP, used to detect and block known threats across defenses.

Behavioral evidence that an intrusion is underway, such as unusual privilege escalation or lateral movement, focused on intent rather than static artifacts.

Analytics that learn normal baseline behavior and flag statistically unusual activity, such as rare sign-ins or abnormal data volumes.