Weekend batches
October 2026
09:00–15:00 · flexible hours
$799per learner
24 Oct 2026
4 of 25 seats available
31 Oct 2026
10 of 25 seats available
Cybersecurity
Microsoft Sentinel Professional Certification Training in Hong Kong
Microsoft Sentinel Professional Certification Training in Hong Kong helps cybersecurity professionals develop practical SIEM skills in threat detection, KQL, incident investigation, analytics rules, threat hunting, and security automation. Learn to monitor cloud environments, investigate security incidents, integrate Microsoft Defender solutions, and strengthen security operations capabilities through hands-on Microsoft Sentinel training aligned with modern cybersecurity requirements and practices.
40 Hours/5 daysIntermediate3.9 · 2,900 reviews
Training calendar
Upcoming four-month course schedule
A new weekday and weekend batch starts every week. Each batch runs for 5 training days, based on the course duration of 40 Hours/5 days.
Weekend batches
November 2026
09:00–15:00 · flexible hours
$799per learner
07 Nov 2026
25 of 25 seats available
14 Nov 2026
25 of 25 seats available
21 Nov 2026
25 of 25 seats available
28 Nov 2026
25 of 25 seats available
Weekend batches
December 2026
09:00–15:00 · flexible hours
$799per learner
05 Dec 2026
25 of 25 seats available
12 Dec 2026
25 of 25 seats available
19 Dec 2026
25 of 25 seats available
26 Dec 2026
25 of 25 seats available
Weekend batches
January 2027
09:00–15:00 · flexible hours
$799per learner
02 Jan 2027
25 of 25 seats available
09 Jan 2027
25 of 25 seats available
16 Jan 2027
25 of 25 seats available
23 Jan 2027
25 of 25 seats available
30 Jan 2027
25 of 25 seats available
Course curriculum
What you’ll learn
40 Hours/5 daysIntermediate
- Module 1: Introduction to Microsoft Sentinel
- Understand Microsoft Sentinel architecture, capabilities, and role in modern SIEM and security operations.
- Explore Sentinel workspaces, security operations concepts, dashboards, incidents, and Microsoft security integrations.
- Module 2: Microsoft Sentinel Configuration and Management
- Learn how to configure Microsoft Sentinel and establish a security operations environment.
- Explore workspaces, settings, permissions, data connectors, and security monitoring configurations.
- Module 3: Data Collection and Log Management
- Learn how to connect and collect security data from Microsoft, Azure, cloud, network, and other data sources.
- Understand log ingestion, data management, normalization, and centralized security visibility.
- Module 4: Kusto Query Language (KQL) for Security
- Build practical KQL skills for searching, filtering, analyzing, and correlating security data.
- Create queries that support alert investigation, incident analysis, detection engineering, and threat hunting.
- Module 5: Threat Detection and Analytics Rules
- Learn how to identify suspicious activity using analytics rules, detection logic, and security indicators.
- Configure and understand scheduled, near-real-time, and other detection approaches within Microsoft Sentinel.
- Module 6: Security Incidents and Investigation
- Learn how to investigate alerts and incidents by examining entities, evidence, timelines, and related activities.
- Develop structured approaches for incident triage, investigation, containment, and remediation.
- Module 7: Threat Hunting with Microsoft Sentinel
- Explore proactive threat hunting using KQL, hunting queries, bookmarks, and investigation techniques.
- Learn how security analysts can search security data to identify previously undetected threats and attack patterns.
- Module 8: Microsoft Sentinel Automation and Playbooks
- Understand automation rules, playbooks, Logic Apps integration, and automated security response workflows.
- Learn how automation can streamline repetitive SOC activities and improve incident response efficiency.
- Module 9: Microsoft Defender and Cloud Security Integration
- Explore integration between Microsoft Sentinel, Microsoft Defender XDR, Defender for Cloud, and other Microsoft security solutions.
- Understand centralized visibility, cross-platform investigation, threat detection, and cloud security operations.
- Module 10: Security Operations and SC-200 Preparation
- Review security operations concepts, incident response, threat hunting, KQL, Sentinel, and Microsoft security technologies.
- Practice scenario-based questions and exam-oriented exercises aligned with the SC-200: Microsoft Security Operations Analyst certification.
Entry requirements and prerequisites
- Basic Cybersecurity Knowledge: Understanding security operations, threat detection, security alerts, monitoring, and incident response is recommended for learners in Hong Kong.
- Microsoft Azure Fundamentals: Basic experience with Azure services, subscriptions, and cloud concepts will help learners understand Microsoft Sentinel configuration and security operations.
- Microsoft Security Knowledge: Familiarity with Microsoft Defender, Microsoft Entra ID, Microsoft 365 security, and related Microsoft security solutions is beneficial.
- KQL Fundamentals: Basic familiarity with Kusto Query Language (KQL) is recommended because KQL is used to query and analyze security data within Microsoft Sentinel.
- SIEM and Logging Concepts: Knowledge of SIEM fundamentals, security logs, alerts, monitoring, and data collection can help learners understand Microsoft Sentinel more effectively.
- Networking and Cloud Computing: A general understanding of networking, cloud computing, and IT infrastructure is recommended for learners beginning Microsoft Sentinel training in Hong Kong.
- Azure Subscription for Hands-On Labs: Practical Microsoft Sentinel exercises may require an Azure subscription and appropriate permissions when learners perform deployments or configure Sentinel environments.
Career value
Reasons to choose this course
Master Microsoft Sentinel SIEM
Build practical expertise in Microsoft Sentinel, SIEM configuration, security monitoring, log management, and threat detection for cybersecurity careers in Hong Kong.
Develop KQL Security Analysis Skills
Learn Kusto Query Language (KQL) to query security data, investigate alerts, analyze threats, and perform security investigations using Microsoft Sentinel.
Strengthen Threat Detection Expertise
Learn to create analytics rules, identify suspicious activities, correlate security events, and develop detection capabilities for modern security operations.
Build Incident Investigation Skills
Develop practical skills to investigate security incidents, analyze entities and alerts, identify attack patterns, and support effective incident response workflows.
Learn Threat Hunting and Automation
Explore proactive threat hunting, automation rules, playbooks, and security orchestration to improve security operations and response capabilities.
Prepare for Microsoft Security Careers
Develop job-relevant skills aligned with Security Operations Analyst roles, including SOC Analyst, Cybersecurity Analyst, SIEM Analyst, and Security Operations Engineer.
Advantages
Turn learning into practical capability
Gain Microsoft Sentinel Expertise
Develop practical knowledge of Microsoft Sentinel architecture, workspaces, data connectors, security monitoring, analytics, incidents, and security operations workflows.
Develop Advanced KQL Capabilities
Strengthen your ability to use KQL for querying logs, analyzing security events, investigating threats, creating hunting queries, and supporting Microsoft security operations.
Strengthen SIEM and SOC Skills
Learn how SIEM technologies support centralized security monitoring, alert management, event correlation, threat detection, and incident investigation in enterprise environments.
Master Threat Hunting Techniques
Explore proactive threat hunting methodologies using Microsoft Sentinel data, KQL queries, hunting tools, and security investigation techniques to identify potential threats.
Learn Security Automation and Response
Understand automation rules, playbooks, orchestration, and response workflows that can help security teams streamline repetitive tasks and improve incident-handling processes.
Support Microsoft Security Certification Preparation
Build knowledge aligned with the SC-200: Microsoft Security Operations Analyst exam and develop practical capabilities relevant to Microsoft-focused security operations careers in Hong Kong.
Exam format & assessment
Certification: Microsoft Certified: Security Operations Analyst Associate
Exam Code: SC-200
Exam Type: Proctored, computer-based Microsoft certification examination
Question Format: Multiple-choice, scenario-based, and interactive question types may be included
Exam Duration: 100 minutes
Passing Score: 700 out of 1000
Exam Delivery: Available through Pearson VUE with proctored testing options, subject to Microsoft’s current exam policies and availability.
Key Exam Areas: Manage a security operations environment, respond to security incidents, and perform threat hunting.
Recommended Knowledge: Familiarity with Microsoft security, compliance and identity solutions, Microsoft 365, Azure cloud services, and operating systems is recommended. Practical knowledge of Microsoft Sentinel and KQL is also valuable.
Preparation: Microsoft Sentinel Professional Certification Training in Hong Kong helps learners develop practical skills in Microsoft Sentinel, KQL, security monitoring, incident investigation, threat detection, automation, and threat hunting to prepare for the SC-200 examination.
Bring your learning together
Course conclusion
Microsoft Sentinel Professional Certification Training in Hong Kong provides practical knowledge of SIEM, KQL, threat detection, incident investigation, threat hunting, security automation, and Microsoft security solutions. The course helps learners build job-ready Microsoft security operations skills while preparing for the SC-200: Microsoft Security Operations Analyst examination. With hands-on learning and scenario-based practice, participants can strengthen their cybersecurity capabilities and pursue security operations opportunities in modern cloud-focused organizations.
Target audience
- SOC Analysts
- Cybersecurity Analysts
- Security Operations Professionals
- SIEM Analysts
- Incident Response Professionals
- Threat Hunters
- Cloud Security Professionals
- Microsoft Security Professionals
- IT Professionals Moving into Cybersecurity
- Cybersecurity Beginners with Technical Foundations
Verified learning evidence
Expertise, recognition and learner outcomes
Course-specific expertise
- 10+ Years of Cybersecurity Experience
Extensive experience in SIEM, SOC operations, cloud security, threat detection, incident response, and Microsoft security technologies. - 2,500+ Hours of Professional Training Delivered
Conducted instructor-led and hands-on Microsoft Sentinel and cybersecurity training for security analysts, engineers, administrators, and IT teams. - 1,500+ Professionals Trained
Trained professionals in Sentinel monitoring, KQL, analytics rules, incident investigation, threat hunting, and security operations. - 150+ Corporate & Professional Training Sessions
Delivered SIEM and Microsoft security training programs for enterprise security and SOC teams. - 100+ Practical Labs & Security Case Studies
Covered data connectors, KQL queries, analytics rules, incidents, workbooks, threat hunting, automation, and response workflows. - 750+ Hours of Microsoft Sentinel & SIEM-Focused Training
Dedicated extensive training time to Sentinel, SIEM operations, KQL, security analytics, incident management, and threat detection. - 250+ Threat Detection & Investigation Exercises
Guided learners through suspicious login, malware, account compromise, endpoint, network, and cloud-security scenarios.
Documented learner outcomes
- Problem Statement: Banking organizations generate large volumes of security logs from users, applications, endpoints, networks, and cloud services, making threat monitoring difficult.
- How We Overcame the Problem: Learners used Microsoft Sentinel for centralized log collection, threat detection, analytics, investigation, and incident response.
- Overall Implementation: Learners implemented data connectors, log ingestion, KQL queries, analytics rules, incidents, threat hunting, and security monitoring.
- Evidence of Learning: Learners demonstrated log collection, KQL searches, alert creation, incident investigation, threat hunting, and dashboard monitoring.
- Banking Security Workflow:
Banking Data Sources → Log Collection → Microsoft Sentinel → KQL Analysis → Analytics Rules → Alerts/Incidents → Investigation → Response - Data Connector Implementation: Learners connected banking-related security sources and collected relevant events into Microsoft Sentinel.
- KQL Implementation: Learners created KQL queries to identify suspicious logins, unusual activities, and potential security threats.
- Analytics & Incident Implementation: Learners configured detection rules, generated alerts, investigated incidents, and documented response actions.
- Problem-Solving Evidence: Learners addressed suspicious logins, account compromise, abnormal transactions, malware alerts, and other security events through Sentinel investigations.
- Comparative Evidence: Learners compared security monitoring approaches based on log visibility, detection, analytics, threat hunting, incident management, and automated response.
- Overall Outcome: Learners demonstrated practical skills in using Microsoft Sentinel to monitor banking environments, detect threats, investigate incidents, and support security operations.
- Final Evidence: A working banking security scenario, connected data sources, KQL queries, analytics rules, alerts, incidents, investigation results, threat-hunting activities, and security reports provide evidence of practical competency.
Helpful answers for planning your training
Frequently asked questions
Microsoft Sentinel Professional Certification Training helps learners develop practical skills in SIEM, KQL, threat detection, incident investigation, threat hunting, automation, and Microsoft security operations in Hong Kong.
The course is suitable for SOC analysts, cybersecurity analysts, SIEM analysts, security operations professionals, threat hunters, incident responders, cloud security professionals, and IT professionals moving into cybersecurity.
Learner reviews
Rated by 2,900 learners
Rating and review totals are controlled per course in the CRM.
3.9out of 5
Popular cities in Hong Kong
Compare city information, course curriculum, exam details and ways to enquire.
Book with clarity
Clear pricing, protected approval and learner support
Approval before payment
A secure payment link is shared only after the CRM team confirms the request.
Live instructor-led delivery
Ask questions during the session and learn alongside a scheduled cohort.
Verified learner feedback
Published course feedback is linked to completed learner records and CRM approval.
Visible schedules
Review weekday and weekend dates, duration, timezone and seat availability before booking.