# Become a Microsoft Defender for Endpoint Ninja **[techcommunity.microsoft.com/t5/microsoft-defender-atp/become-a-microsoft-defender-atp-ninja/ba-p/1515647](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/become-a-microsoft-defender-atp-ninja/ba-p/1515647)** July 13, 2020 Jul 13 2020 09:59 AM **Last updated: May 18th 2022** Do you want to become a ninja for Microsoft Defender for Endpoint? We can help you get there! We collected content for two roles: “Security Operations (SecOps)” and “Security Administrator (SecAdmin)”. The content is structured into three different knowledge levels, with multiple modules: Fundamentals, Intermediate, and Expert. Some topics can be relevant for SecOps as well as for SecAdmins and are listed for both roles. We will keep updating this training on a regular basis and highlight new resources. In addition, after each level, we offer you a knowledge check based on the training material you have just finished! Since there’s a lot of content, the goal of the knowledge checks is to help ensure understanding of the key concepts that were covered. Lastly, there’ll be a fun certificate issued at the end of the training: Disclaimer: This is not an official Microsoft **certification and only acts as a way of recognizing your participation in this training** **content.** ``` If you already did the training, you can focus on the latest updates (August 2021 update) ``` **Table of Contents** **Security Operations Fundamentals** Module 1. Technical overview ----- Module 2. Getting started Module 3. Threat and vulnerability management Module 4. Attack surface reduction Module 5. Next generation protection Module 6. Investigation – Incident Module 7. Alert handling Module 8. Automated investigation and remediation Module 9. Microsoft Threat Experts Module 10. Reporting Module 11. Evaluation Lab **Security Operations Intermediate** Module 1. Architecture Module 2. Threat and vulnerability management Module 3. Next generation protection. Module 4. Advanced hunting Module 5. Automated investigation and remediation Module 6. Threat analytics Module 7. Unified indicators of compromise (IOCs) Module 8. Evaluation lab Module 9. Community (blogs, webinars, GitHub) **Security Operations Expert** Module 1. Responding to threats Module 2. Alert handling Module 3. File analysis Module 4. Advanced hunting ----- Module 5. Unified indicators of compromise IOCs Module 6. Custom reporting Module 7. Community (blogs, webinars, GitHub) **Security Administrator Fundamentals** Module 1. Architecture Module 2. Onboarding Module 3. Grant and control access Module 4. Security configuration Module 5. Reporting Module 6. SIEM Integration **Security Administrator Intermediate** Module 1. Threat and vulnerability management (TVM) Module 2. Attack surface reduction Module 3. Next generation protection Module 4. Advanced hunting Module 5. Conditional access Module 6. Microsoft Cloud App Security (MCAS) Module 7. Community (blogs, webinars, GitHub) Module 8. Migration **Security Administrator Expert** Module 1. Custom reporting (PowerBI) Module 2. Advanced hunting Module 3. Custom Integrations, APIs Learn about our partner integrations Legend: ----- Product videos Webcast recordings Tech Community Docs on Microsoft Blogs on Microsoft GitHub ⤴ External Interactive guides Security Operations Fundamentals ## Module 1. Technical overview [Short overview “What is Microsoft Defender for Endpoint"](https://www.microsoft.com/en-us/videoplayer/embed/RE4wDob) [End-to-end security for your endpoints](https://www.youtube.com/watch?v=U7jWbXx_bmE&feature=youtu.be) ## Module 2. Getting started [Portal overview](https://docs.microsoft.com/en-us/microsoft-365/security/defender/microsoft-365-security-center-mde?wt.mc_id=SecNinja_mdeninja) [Welcome to Microsoft 365 Defender!](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/welcome-to-microsoft-365-defender/ba-p/2436618) [Use basic permissions to access the portal](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/basic-permissions?wt.mc_id=SecNinja_mdeninja) [How to use RBAC](https://www.microsoft.com/en-us/videoplayer/embed/RE4bJ2a?rel=0) [Device Inventory](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/device-inventory-the-evolution-of-the-endpoint-view/ba-p/3301557) ## Module 3. Threat and vulnerability management [What is threat and vulnerability management](https://www.microsoft.com/en-us/videoplayer/embed/RE4r1nv) "Bringing IT & security together: How Microsoft is reinventing threat and vulnerability management" [Reduce organizational risk with threat and vulnerability management](https://mslearn.cloudguides.com/en-us/guides/Reduce%20organizational%20risk%20with%20Threat%20and%20Vulnerability%20Management) ## Module 4. Attack surface reduction [Learn about all the features to help you reduce the attack surface](https://www.microsoft.com/en-us/videoplayer/embed/RE4woug) [Understand attack surface reduction rules](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/bg-p/MicrosoftDefenderATPBlog/label-name/Demystifying%20ASR%20rules) [Track and regulate access to websites with web content filtering](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/web-content-filtering) ## Module 5. Next generation protection [Microsoft Defender Antivirus: Your next generation protection](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows?wt.mc_id=SecNinja_mdeninja) ## Module 6. Investigation – Incident [Learn about the rich investigation experience](https://www.microsoft.com/en-us/videoplayer/embed/RE4qLUV) [Work with incidents](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/view-incidents-queue?wt.mc_id=SecNinja_mdeninja) ----- [MITRE ATT&CK Techniques available in the device timeline](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/mitre-att-amp-ck-techniques-now-available-in-the-device-timeline/ba-p/2136788) [Investigate and remediate threats with Microsoft Defender for Endpoint](https://mslearn.cloudguides.com/en-us/guides/Investigate%20and%20remediate%20threats%20with%20Microsoft%20Defender%20ATP) ## Module 7. Alert handling [Get the most out of an alert page](https://www.microsoft.com/en-us/videoplayer/embed/RE4yiO5) [Working with alerts](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/say-hello-to-the-new-alert-page-in-microsoft-defender-atp/ba-p/1463673) [Alert categories aligned with MITRE ATT&CK](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/microsoft-defender-atp-alert-categories-are-now-aligned-with/ba-p/732748) [How alerts are enhanced to include MITRE ATT&CK technique information](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/mitre-att-amp-ck-technique-info-in-microsoft-defender-atp-alerts/ba-p/856835) ## Module 8. Automated investigation and remediation [How automation works](https://www.microsoft.com/en-us/videoplayer/embed/RE4bOeh?rel=0) [Defining metrics for successful security operations](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/the-golden-hour-remake-defining-metrics-for-a-successful/ba-p/782014) ## Module 9. Microsoft Threat Experts [What is Microsoft Threat Experts](https://www.microsoft.com/en-us/videoplayer/embed/RE4qZ0B) [Getting started with Microsoft Threat Experts](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-microsoft-threat-experts?wt.mc_id=SecNinja_mdeninja) ## Module 10. Reporting [Out of the box reports](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/threat-protection-reports?wt.mc_id=SecNinja_mdeninja) ## Module 11. Evaluation Lab [Get started with the evaluation lab](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/evaluation-lab?wt.mc_id=SecNinja_mdeninja&view=o365-worldwide#get-started-with-the-lab) [Short walk-through the evaluation lab](https://www.microsoft.com/en-us/videoplayer/embed/RE4qLUM?rel=0) **> Ready for the** **[Fundamentals Knowledge Check?](https://forms.office.com/r/U4eVfD65sb)** Security Operations Intermediate ## Module 1.Architecture [Understand the architecture of the service](https://www.microsoft.com/en-us/videoplayer/embed/RE4vnC4) ## Module 2. Threat and vulnerability management [Discovery and remediation](https://www.microsoft.com/en-us/videoplayer/embed/RE4qLVs) [Endpoint Discovery - Navigating your way through unmanaged devices](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/endpoint-discovery-navigating-your-way-through-unmanaged-devices/ba-p/2248909) [Reduce organizational risk with threat and vulnerability management](https://mslearn.cloudguides.com/en-us/guides/Reduce%20organizational%20risk%20with%20Threat%20and%20Vulnerability%20Management) ----- [Tag your high value assets for better prioritization](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/announcing-high-value-asset-tagging-in-microsoft-defender-atp/ba-p/1521459) ## Module 3. Next generation protection [Learn about our approach to fileless threats](https://docs.microsoft.com/en-us/microsoft-365/security/intelligence/fileless-threats?wt.mc_id=SecNinja_mdeninja) [Stopping attacks in their tracks through behavioral blocking and containment](https://www.sans.org/webcasts/112820) [EDR in block mode](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/announcing-edr-in-block-mode-general-availability/ba-p/1972064) Firmware level protection with a new Unified Extensible Firmware Interface (UEFI) scanner [Enhanced antimalware engine capabilities for Linux and macOS](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/enhanced-antimalware-engine-capabilities-for-linux-and-macos/ba-p/3292003) [Enhanced Antimalware Protection for Android](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/enhanced-antimalware-protection-in-microsoft-defender-for/ba-p/3290320) ## Module 4. Advanced hunting [Quick overview & a short tutorial that will get you started fast](https://www.microsoft.com/en-us/videoplayer/embed/RE4bGqo?rel=0) ## Module 5. Automated investigation and remediation [Automate the boring for your SOC with automatic investigation and remediation!](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/automate-the-boring-for-your-soc-with-automatic-investigation/ba-p/1381038) [Default settings](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/microsoft-defender-for-endpoint-automation-defaults-are-changing/ba-p/2068744) [Configure automated investigation and remediation capabilities](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-automated-investigations-remediation?wt.mc_id=SecNinja_mdeninja) [Manage automation file uploads](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-automation-file-uploads?wt.mc_id=SecNinja_mdeninja) [Manage automation folder exclusions](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-automation-folder-exclusions?wt.mc_id=SecNinja_mdeninja) ## Module 6. Threat analytics [Get familiar with threat analytics](https://www.microsoft.com/en-us/videoplayer/embed/RE4bw1f?rel=0) [Understand the analyst report section in threat analytics](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/threat-analytics-analyst-reports?wt.mc_id=SecNinja_mdeninja) [Track and respond to emerging threats](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/threat-analytics?wt.mc_id=SecNinja_mdeninja) ## Module 7. Unified indicators of compromise (IOCs) [Working with IOCs](https://www.microsoft.com/en-us/videoplayer/embed/RE4qLVw) ## Module 8. Evaluation lab [Short walk-through the evaluation lab](https://www.microsoft.com/en-us/videoplayer/embed/RE4qLUM?rel=0) [Breach & attack simulators for the evaluation lab](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/microsoft-defender-atp-evaluation-lab-breach-amp-attack/ba-p/1406088) [Expanded OS support & Atomic Red Team simulations](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/evaluation-lab-expanded-os-support-amp-atomic-red-team/ba-p/2993927) [Request more devices](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/evaluation-lab?wt.mc_id=SecNinja_mdeninja#request-for-more-devices) ## Module 9. Community (blogs, webinars, GitHub) [Various repositories](https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries/Microsoft%20365%20Defender) ----- **> Ready for the** **[Intermediate Knowledge Check?](https://forms.office.com/r/u3vtxVUKuM)** Security Operations Expert ## Module 1. Responding to threats [Overview of live response](https://www.microsoft.com/en-us/videoplayer/embed/RE4qLUW?rel=0) [Investigate entities on devices using live response](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/live-response?wt.mc_id=SecNinja_mdeninja) [Response actions on machines](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/respond-machine-alerts?wt.mc_id=SecNinja_mdeninja) [Response actions on a file](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/respond-file-alerts?wt.mc_id=SecNinja_mdeninja) ## Module 2. Alert handling [Manage alert suppression rules](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/manage-suppression-rules?wt.mc_id=SecNinja_mdeninja) ## Module 3. File analysis [Use the built-in sandbox to detonate files](https://www.microsoft.com/en-us/videoplayer/embed/RE4aAYy?rel=0) [Submit items to Microsoft for review](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/unified-submissions-in-microsoft-365-defender-now-generally/ba-p/3270770) ## Module 4. Advanced hunting [Learn the query language](https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-query-language?wt.mc_id=SecNinja_mdeninja) [Advanced hunting schema reference](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/advanced-hunting-schema-reference?wt.mc_id=SecNinja_mdeninja) [Webinar series, episode 1: KQL fundamentals (MP4,](https://aka.ms/MTP15JUL20_MP4) [YouTube)](https://youtu.be/0D9TkGjeJwM) [Webinar series, episode 2: Joins (MP4,](https://aka.ms/MTP22JUL20_MP4) [YouTube)](https://youtu.be/LMrO6K5TWOU) [Webinar series, episode 3: Summarizing, pivoting, and visualizing Data (MP4,](https://aka.ms/MTP29JUL20_MP4) [YouTube)](https://youtu.be/UKnk9U1NH6Y) [Webinar series, episode 4: Let’s hunt! Applying KQL to incident tracking (MP4,](https://aka.ms/MTP5AUG20_MP4) [YouTube)](https://youtu.be/2EUxOc_LNd8) [Hunting for reconnaissance activities using LDAP search filters](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/hunting-for-reconnaissance-activities-using-ldap-search-filters/ba-p/824726) ⤴ [Plural sight KQL training](https://www.pluralsight.com/courses/kusto-query-language-kql-from-scratch) [Updates to threat and vulnerability management tables](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/advanced-hunting-updates-to-threat-and-vulnerability-management/ba-p/2162584) [Details about DeviceTvmSoftwareInventory](https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-devicetvmsoftwareinventory-table?wt.mc_id=SecNinja_mdeninja) [Details about DeviceTvmSoftwareVulnerabilities](https://docs.microsoft.com/en-us/microsoft-365/security/defender/advanced-hunting-devicetvmsoftwarevulnerabilities-table?wt.mc_id=SecNinja_mdeninja) [How to migrate advanced hunting to Microsoft 365 Defender](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/how-to-migrate-advanced-hunting-to-microsoft-365-defender/ba-p/2409440) ## Module 5. Unified indicators of compromise IOCs Module 6. Custom reporting [Create custom reports using Power BI](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api-power-bi?wt.mc_id=SecNinja_mdeninja) [Custom reports on GitHub](https://github.com/microsoft/MicrosoftDefenderATP-PowerBI) ----- ## Module 7. Community (blogs, webinars, GitHub) **> Ready for the** **[Expert Knowledge Check?](https://forms.office.com/r/AUz5L4nLYA)** Security Administrator Fundamentals ## Module 1. Architecture [Understand the architecture of the service](https://www.microsoft.com/en-us/videoplayer/embed/RE4vnC4) ## Module 2. Onboarding Module 3. Grant and control access [Use basic permissions to access the portal](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/basic-permissions?wt.mc_id=SecNinja_mdeninja) [How to use RBAC](https://www.microsoft.com/en-us/videoplayer/embed/RE4bJ2a?rel=0) [How to use tagging effectively (Part 1)](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/how-to-use-tagging-effectively-part-1/ba-p/1964058) [How to use tagging effectively (Part 2)](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/how-to-use-tagging-effectively-part-2/ba-p/1962008) [How to use tagging effectively (Part 3)](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/how-to-use-tagging-effectively-part-3/ba-p/1964073) [Multi-tenant access for Managed Security Service Providers](https://www.microsoft.com/en-us/videoplayer/embed/RE4BzwC) Step-by-step: [Multi-tenant access for Managed Security Service Providers](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/multi-tenant-access-for-managed-security-service-providers/ba-p/1533440) ## Module 4. Security configuration Module 5. Reporting Module 6. SIEM Integration [Management APIs](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/management-apis?wt.mc_id=SecNinja_mdeninja) **> Ready for the** **[Fundamentals Knowledge Check?](https://forms.office.com/r/w2ZAmfsmPU)** Security Administrator Intermediate ## Module 1. Threat and vulnerability management (TVM) Module 2. Attack surface reduction [Learn about all the features to help you reduce the attack surface](https://www.microsoft.com/en-us/videoplayer/embed/RE4woug) [Learn about attack surface reduction rules](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction?wt.mc_id=SecNinja_mdeninja) [Track and regulate access to websites with web content filtering](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/web-content-filtering) [Learn more about Application control](https://www.microsoft.com/en-us/videoplayer/embed/RE4qZ0c) [Get a better understanding of Network protection](https://www.microsoft.com/en-us/videoplayer/embed/RE4r4yZ) ----- [Understand attack surface reduction rules](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/demystifying-attack-surface-reduction-rules-part-1/ba-p/1306420) [How to configure attack surface reduction rules and how to use exclusions](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/demystifying-attack-surface-reduction-rules-part-2/ba-p/1326565) Details about using Microsoft Endpoint Manager [MEM OMA-URI to configure ASR](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?wt.mc_id=SecNinja_mdeninja#mem) rules [How to report and troubleshoot Microsoft Defender for Endpoint ASR Rules](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/demystifying-attack-surface-reduction-rules-part-3/ba-p/1360968) [USB device control on Mac](https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/mac-updates-control-your-usb-devices-with-microsoft-defender-for/ba-p/2224439) [Device control for MacOS](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mac-device-control-overview?wt.mc_id=SecNinja_mdeninja) [Migrate from a 3rd party HIPS solution into ASR rules](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/demystifying-attack-surface-reduction-rules-part-4/ba-p/1384425) [Reputation analysis - Microsoft Defender SmartScreen](https://www.microsoft.com/en-us/videoplayer/embed/RE4r1mV) ## Module 3. Next generation protection Module 4. Advanced hunting [Quick overview & a short tutorial that will get you started fast](https://www.microsoft.com/en-us/videoplayer/embed/RE4bGqo?rel=0) ## Module 5. Conditional access [How to configure conditional access](https://www.microsoft.com/en-us/videoplayer/embed/RE4byD1?rel=0) ## Module 6. Microsoft Defender for Cloud Apps Module 7. Community (blogs, webinars, GitHub) [Advanced hunting queries on GitHub](https://github.com/Azure/Azure-Sentinel/tree/master/Hunting%20Queries/Microsoft%20365%20Defender) ## Module 8. Migration **> Ready for the** **[Intermediate Knowledge Check?](https://forms.office.com/r/c14UdvLyf5)** Security Administrator Expert ## Module 1. Custom reporting (PowerBI) Module 2. Advanced hunting Module 3. Custom Integrations, APIs [Use Microsoft Defender for Endpoint APIs](https://www.microsoft.com/en-us/videoplayer/embed/RE4d73M?rel=0) [Available APIs](https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/exposed-apis-list) [API Explorer and Connected applications](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/new-api-explorer-and-connected-applications/ba-p/860562) [Microsoft Defender for Endpoint API Explorer](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api-explorer?wt.mc_id=SecNinja_mdeninja) ----- [Customized views with APIs](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/threat-amp-vulnerability-management-apis-are-now-generally/ba-p/1304615) [Use the official Power Automate Connector](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/api-microsoft-flow?wt.mc_id=SecNinja_mdeninja) [Raw data export](https://techcommunity.microsoft.com/t5/microsoft-defender-atp/raw-data-export-announcing-microsoft-defender-atp-streaming-api/ba-p/1235500) [Streaming API](https://www.microsoft.com/en-us/videoplayer/embed/RE4r4ga) [Threat and vulnerability management API collection Export Assessment API](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/get-assessment-methods-properties?wt.mc_id=SecNinja_mdeninja) [Threat and vulnerability management API collection Remediation Activity](https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/get-remediation-methods-properties?wt.mc_id=SecNinja_mdeninja) Learn about our partner integrations **> Ready for the** **[Expert Knowledge Check?](https://forms.office.com/r/cFfxnmAZKK)** [Once you’ve finished the training and the knowledge checks, please click here to request](https://forms.office.com/r/7Ta1k4H1uX) your certificate (you'll see it in your inbox within 3-5 business days.) -----