Day 1
Sentinel foundations & workspace setup
New: Capsule Courses • Job-ready skills in under a week | +1 (646) 980-6267
● CAPSULE COURSE6 DAYS
Microsoft Sentinel
Cloud SIEM & SOAR, hands-on in six days
A focused, instructor-led sprint on Microsoft Sentinel. Connect real data sources, write KQL detections, investigate incidents and automate response with playbooks, all inside your own lab workspace. Built for SOC analysts and security engineers who need production-ready Sentinel skills fast.
6 days
Mon-Sat
15 hrs
Live, instructor-led
6 labs
Hands-on Project
Microsoft Sentinel . CAPSULE
Original price was: $249.00.$159.00Current price is: $159.00.
One-rime fee . full 6- day capsule
Sessions 7:00 - 9:30 PM EST . Mon - Sat
- 6 live sessions with a Microsoft security practitioner
- Dedicated Azure lab environment
- Session recordings with lifetime access
- Lab guides and KQL query pack
- Capstone review by the instructor
- Certificate of completion
WHAT IS A
CAPSULE COURSE?
CAPSULE COURSE?
5–7 days, one skill
A short live sprint on a single tool, taught to the depth employers expect.
Labs every day
Each session ends with a guided lab in your own environment.
Stackable
Combine capsules or credit the fee toward a full Job Seeker's Package.
SIX DAYS AT A GLANCE
From empty workspace to
automated SOC in one week
Who this capsule is for
- SOC analysts moving from on-prem SIEMs like Splunk or QRadar
- Azure administrators taking on security duties
- Security engineers building detection and response in Microsoft environments
- Learners preparing for the SC-200 exam
- Career switchers who have finished a cybersecurity foundation course
Before you start
- Basic understanding of networking and security concepts
- Familiarity with the Azure portal
- A laptop with a modern browser and stable internet
- 2.5 hours each evening for six days
We provide a lab subscription for the six days. No personal credit card or paid account needed.
DAY-BY-DAY PLAN
MS Sentinel Capsule Curriculum
Day 1:Sentinel foundations & workspace setup
-
What a cloud-native SIEM and SOAR does
-
Sentinel architecture: Log Analytics, data tiers, retention
-
Workspace design, RBAC and cost controls
-
Content Hub and solutions overview
-
Hands-on Lab: Deploy a Log Analytics workspace, enable Sentinel and configure roles for a SOC team
Day 2:Data connectors & ingestion
-
Microsoft connectors: Entra ID, Defender XDR, Azure Activity
-
Windows and Linux via Azure Monitor Agent and DCRs
-
Syslog and CEF from firewalls and network devices
-
Data normalisation with ASIM
-
Hands-on Lab: Connect Entra ID, a Windows VM and a Syslog source, then validate ingestion
Day 3:KQL for security analysts
-
KQL syntax: where, project, summarize, extend
-
Joins, unions and time-series analysis
-
Parsing raw logs and building functions
-
Watchlists and threat intelligence lookups
-
Hands-on Lab: Write 10 hunting queries against sign-in, process and network data
Day 4:Detections & analytics rules
-
Scheduled, NRT and Fusion rules
-
Entity mapping and alert grouping
-
MITRE ATT&CK mapping
-
Tuning to cut false positives
-
Hands-on Lab: Build detections for brute force, impossible travel and suspicious PowerShell
Day 5:Incidents, hunting & UEBA
-
Incident queue, triage and severity
-
Investigation graph and entity pages
-
Hunting queries, bookmarks and livestream
-
UEBA anomalies and workbooks for reporting
-
Format: 2.5 hrs live · 1 lab
-
Lab: Triage a multi-stage incident and publish a SOC overview workbook
Day 6:Automation & capstone
-
Automation rules vs playbooks
-
Logic Apps playbooks: enrichment, notify, contain
-
Disabling a compromised user automatically
-
Capstone review and interview prep for Sentinel roles
-
Hands-on Lab / Capstone: Simulate an attack, detect it, investigate and auto-remediate
OUTCOMES
By the end of Day 6
you will be able to
Deploy and configure a Sentinel workspace
Onboard Microsoft and third-party log sources
Write KQL queries for hunting and detection
Build and tune analytics rules mapped to MITRE ATT&CK
Investigate incidents with entities and UEBA
Automate response with Logic Apps playbooks
TOOLS & SKILLS
What you will work with
ASIM
Azure Monitor Agent
Defender XDR
Entra ID
KQL
Log Analytics
Logic Apps
Microsoft Sentinel
MITRE ATT&CK
Threat Intelligence
UEBA
Workbooks
PICK YOUR PATH
Capsule or full program?
MS Sentinel
Original price was: $249.00.$159.00Current price is: $159.00.
- Online Live Training
- In-Depth Learning
- 6 Days, 15 hrs live
- Certificate of completion
Job seeker's package
Original price was: $249.00.$159.00Current price is: $159.00.
- Online Live Training
- In-Depth Learning
- 6 Days, 15 hrs live
- Certificate of completion
Completed the capsule? Your $159 is credited toward the Job Seeker’s Package if you upgrade within 30 days.
Our Students Work at
Motivation for Thinkcloudly
★★★★★ 5/5 average learner rating
FAQ'S
Capsule FAQs
Still deciding? Our advisors answer enrollment questions seven days a week.
Capsules cover one tool or skill in depth over 5 to 7 days of live sessions. You get the same instructors and lab quality as full programs, in a shorter and more affordable format.
All six live sessions, session recordings, a dedicated Azure lab environment, lab guides, the capstone review and a Thinkcloudly certificate of completion.
No. We provide a lab subscription for the duration of the capsule so you can deploy and break things without any cost to you.
Yes. Every session is recorded and available in the LMS the same night, and you can join the matching day in the next cohort at no extra cost.
The capsule covers the Microsoft Sentinel portion of SC-200 in depth. For full exam coverage, including Defender XDR and Defender for Cloud, see the SOC Job Seeker’s Package.
Recordings and lab guides stay in your LMS account for lifetime access. The live Azure lab is available for the six days of your cohort.
We accept all major credit and debit cards from leading banks. For assistance, contact Thinkcloudly Customer Support.
