1.6. Reflection Checkpoint

Key Takeaways

• Judge every SOC capability by whether it shrinks dwell time, mean time to detect, or mean time to respond. Alert volume without correlation and tuning makes things worse, and assume breach means detection and response are never optional.
• Work at the right layer: telemetry is the factual record, detections turn suspicious patterns into alerts, and correlation groups alerts and entities into incidents. Classify resolved incidents carefully, because true positive, informational expected activity, and false positive each lead to a different follow-up.
• Defender XDR delivers deep native detection and automated response for Microsoft workloads with 30-day hunting data; Sentinel brings any data source, configurable long-term retention, custom detections, and SOAR. The unified Defender portal runs both with one queue and one hunting experience.
• ATT&CK gives a shared language (tactics are goals, techniques are methods) for measuring coverage, and the detect, hunt, respond, automate loop turns every finding into a better detection or a faster automation.
• KQL is a left-to-right pipeline: pick the right table, filter by the right time column first, then shape, aggregate, and join. Know the string operators cold, especially == versus =~ and has versus contains.

Connecting Forward

Phase 2 takes the largest exam domain and builds the platform these foundations describe: configuring Sentinel roles, retention tiers, and workbooks; ingesting Windows, Syslog, CEF, Azure, and threat intelligence data; configuring Defender for Endpoint and Defender XDR automation; writing detections; and automating response with automation rules and playbooks.

Self-Check Questions

• A firewall appliance's logs are critical to detecting command-and-control traffic, and the CISO wants alerts within minutes. Which half of the platform ingests the data, which storage tier must the table use, and which rule type would you consider for low-latency alerting?
• An analyst resolves a phishing incident as a false positive because "the user didn't click anything." Was that the right classification? Explain what the classification tells the platform and what the correct one would be.
• Rewrite this requirement as a KQL pipeline outline (table, filters, aggregation): "Show the ten accounts with the most distinct devices on which psexec.exe ran in the last 24 hours."