01Coming next
SOC Foundations
Learn the language of networks, identity, logs, alerts, and incidents.
- Networking
- Identity
- Log literacy
14 objectives
Your analyst shift starts here
Train the decisions behind confident incident response.
Investigate a realistic phishing case, connect email and identity evidence, run a safe KQL query, and write an escalation-ready verdict.
- Authorized synthetic training
- No live systems or production data
01 / PATH
Learning path
Build from SOC foundations to exam practice. Locked modules show what comes next without pretending unfinished content is available.
SC-200 skills blueprint · April 16, 2026 edition
02Available
First Shift: Phishing Triage
Investigate a suspicious invoice, correlate identity activity, and escalate clearly.
- Alert triage
- Defender for Office 365
- Entra ID
8 objectives35% exam domain
03Coming next
Manage the SecOps Environment
Configure data ingestion, automation, analytics, and security operations workflows.
- Microsoft Sentinel
- Automation
- Analytics rules
26 objectives45% exam domain
04Coming next
Respond to Security Incidents
Handle multi-domain incidents across endpoint, identity, email, and cloud.
- Defender XDR
- Endpoints
- Case management
22 objectives40% exam domain
05Coming next
Threat Hunting with KQL
Build queries, examine entity relationships, and find threats in synthetic datasets.
- KQL
- Advanced Hunting
- Entity graphs
12 objectives25% exam domain
06Coming next
Exam Sprint
Complete mixed investigations, timed drills, and full mock exams.
- Timed practice
- Weak-skill review
- Exam readiness
3 objectives100% exam domain