Weekend batches
October 2026
09:00–15:00 · flexible hours
$799per learner
24 Oct 2026
4 of 25 seats available
31 Oct 2026
10 of 25 seats available
Cybersecurity
Microsoft Defender XDR Certification Training in Sao Tome and Principe
Microsoft Defender XDR Certification Training in Sao Tome and Principe develops practical skills in threat detection, incident investigation, endpoint security, Advanced Hunting, and KQL. Learn how Microsoft Defender XDR integrates security signals across Microsoft environments to support modern SOC operations. Build job-ready cybersecurity expertise through guided learning, practical scenarios, and hands-on security investigations with StepMerit Learning.
40 Hours/5 daysIntermediate4 · 2,900 reviews
Training calendar
Upcoming four-month course schedule
A new weekday and weekend batch starts every week. Each batch runs for 5 training days, based on the course duration of 40 Hours/5 days.
Weekend batches
November 2026
09:00–15:00 · flexible hours
$799per learner
07 Nov 2026
25 of 25 seats available
14 Nov 2026
25 of 25 seats available
21 Nov 2026
25 of 25 seats available
28 Nov 2026
25 of 25 seats available
Weekend batches
December 2026
09:00–15:00 · flexible hours
$799per learner
05 Dec 2026
25 of 25 seats available
12 Dec 2026
25 of 25 seats available
19 Dec 2026
25 of 25 seats available
26 Dec 2026
25 of 25 seats available
Weekend batches
January 2027
09:00–15:00 · flexible hours
$799per learner
02 Jan 2027
25 of 25 seats available
09 Jan 2027
25 of 25 seats available
16 Jan 2027
25 of 25 seats available
23 Jan 2027
25 of 25 seats available
30 Jan 2027
25 of 25 seats available
Course curriculum
What you’ll learn
40 Hours/5 daysIntermediate
- Module 1: Microsoft Defender XDR Fundamentals
- Understand Microsoft Defender XDR architecture, core capabilities, security operations, and integrated threat protection.
- Explore how Microsoft security solutions work together to provide centralized visibility, detection, investigation, and response.
- Module 2: Microsoft Defender XDR Configuration and Administration
- Learn essential configuration concepts for Microsoft Defender XDR and its security settings.
- Understand security policies, permissions, device management, alerts, incidents, and administrative workflows.
- Module 3: Microsoft Defender for Endpoint
- Explore endpoint protection, device onboarding, endpoint security controls, and security monitoring.
- Learn how endpoint telemetry and device information support threat detection and investigation.
- Module 4: Threat Detection and Security Alerts
- Understand how Microsoft Defender XDR identifies suspicious activities, threats, and potential security incidents.
- Learn to review alerts, analyze threat information, prioritize investigations, and identify relevant security events.
- Module 5: Incident Investigation and Response
- Learn how to investigate security incidents using alerts, affected entities, timelines, and available investigation data.
- Explore response workflows for analyzing threats and supporting containment and remediation activities.
- Module 6: Advanced Hunting with KQL
- Learn the fundamentals of Kusto Query Language (KQL) for searching and analyzing security data.
- Create queries to investigate suspicious activities, identify indicators, and support proactive threat hunting.
- Module 7: Threat Hunting and Security Investigation
- Explore proactive threat-hunting techniques using Microsoft Defender XDR security data.
- Analyze endpoint, identity, email, and other security signals to investigate potentially malicious behavior.
- Module 8: Microsoft Defender for Office 365
- Understand email and collaboration security concepts including phishing, malicious attachments, and suspicious links.
- Explore investigation workflows for email-related threats within the Microsoft security ecosystem.
- Module 9: Microsoft Defender for Identity
- Learn identity-based threat detection and investigation concepts within Microsoft environments.
- Understand how suspicious authentication activity, identity threats, and compromised accounts can be investigated.
- Module 10: Microsoft Defender for Cloud Apps
- Explore cloud application security, visibility, suspicious activities, and cloud-related threat detection.
- Understand how cloud application information can contribute to broader security investigations.
- Module 11: Security Incidents and Automated Response
- Learn how Defender XDR correlates related alerts into incidents to support centralized investigation.
- Explore response actions and automation concepts that can help security teams manage threats efficiently.
- Module 12: Security Operations and SOC Workflows
- Understand how Microsoft Defender XDR supports day-to-day Security Operations Center activities.
- Practice workflows involving monitoring, alert triage, investigation, threat hunting, incident response, and reporting.
Entry requirements and prerequisites
- Basic Microsoft Security Knowledge: Learners should have a fundamental understanding of Microsoft security, compliance, and identity solutions before starting the Microsoft Defender XDR Certification Training in Sao Tome and Principe.
- Microsoft Defender XDR Fundamentals: A basic understanding of Microsoft Defender XDR concepts, including threat detection, security alerts, incidents, and investigation workflows, is recommended for learners in Sao Tome and Principe.
- Microsoft 365 Knowledge: Familiarity with Microsoft 365 security services can help learners understand how Defender XDR integrates security information across Microsoft security products.
- Windows Knowledge: Basic to intermediate knowledge of Windows 10 and Windows 11 devices is useful for understanding endpoint protection, investigation, and response concepts within Microsoft Defender.
- Cybersecurity Fundamentals: Basic knowledge of networking, endpoint security, threat detection, and incident response is recommended for learners pursuing Microsoft Defender XDR training in Sao Tome and Principe.
- KQL Familiarity: Basic familiarity with Kusto Query Language (KQL) is helpful for learners who want to work with Advanced Hunting and security data analysis. Microsoft's Defender XDR Applied Skills credential specifically identifies experience with KQL and Microsoft Defender for Endpoint as useful background.
Career value
Reasons to choose this course
Build Microsoft Defender XDR Expertise
Develop practical knowledge of Microsoft Defender XDR, endpoint security, threat detection, and incident investigation for modern cybersecurity roles.
Develop SOC Analyst Skills
Learn security monitoring, alert investigation, incident management, and response workflows aligned with Security Operations Center environments.
Master Threat Detection and Investigation
Understand how to analyze security alerts, investigate threats, correlate security signals, and identify suspicious activity across Microsoft environments.
Learn Advanced Hunting with KQL
Build practical skills in Kusto Query Language (KQL) to search security data, investigate threats, and support proactive threat-hunting activities.
Strengthen Incident Response Knowledge
Learn structured approaches to investigating security incidents, analyzing affected endpoints, and supporting containment and remediation activities.
Expand Microsoft Cybersecurity Career Skills
- Develop skills relevant to cybersecurity analysts, SOC analysts, security engineers, incident responders, and Microsoft security professionals in Sao Tome and Principe.
Advantages
Turn learning into practical capability
Practical Microsoft Security Knowledge
Gain hands-on understanding of Microsoft Defender XDR capabilities and security workflows that can strengthen your professional cybersecurity skill set.
Integrated Threat Detection Skills
Learn how security signals from different Microsoft security technologies can be analyzed together to identify and investigate potential threats.
Enhanced Endpoint Security Expertise
Develop knowledge of Microsoft Defender for Endpoint, endpoint investigation, device security, and response techniques relevant to modern security operations.
KQL-Based Security Analysis
Strengthen your ability to use KQL for Advanced Hunting, security data analysis, threat investigation, and proactive detection activities.
Career-Oriented SOC Training
Build practical knowledge applicable to SOC Analyst, Cybersecurity Analyst, Security Operations Engineer, and Incident Response roles in Sao Tome and Principe.
Foundation for Microsoft Security Certification Paths
Develop knowledge that can complement preparation for Microsoft security certification pathways such as the Microsoft Certified: Security Operations Analyst Associate (SC-200).
Exam format & assessment
- Certification: Microsoft Applied Skills: Defend against Cyberthreats with Microsoft Defender XDR
- Assessment: Microsoft Defender XDR Applied Skills assessment lab
- Assessment Type: Interactive, hands-on lab-based assessment
- Question Format: Practical tasks performed in a Microsoft Defender XDR environment rather than a conventional MCQ-only examination.
- Assessment Duration: 2 hours
- Assessment Focus: Configure Defender XDR, manage devices with Defender for Endpoint, manage incidents, investigate endpoints, and perform Advanced Hunting with KQL.
- Key Practical Areas: Defender XDR configuration, endpoint onboarding and management, incident response, live response, endpoint isolation, device timeline analysis, KQL queries, and custom detection rules.
- Recommended Experience: Familiarity with investigating and gathering evidence from endpoint attacks, Microsoft Defender for Endpoint, and Kusto Query Language (KQL) is recommended.
- Assessment Environment: The assessment uses an interactive lab environment where learners perform tasks using Microsoft security technologies.
- Preparation: Microsoft Defender XDR Certification Training in Sao Tome and Principe can help learners develop the practical endpoint investigation, threat detection, incident response, and KQL skills needed for the assessment.
Bring your learning together
Course conclusion
Microsoft Defender XDR Certification Training provides a practical learning path for professionals seeking to strengthen their skills in endpoint security, threat detection, incident investigation, threat hunting, and security operations. Learners can develop hands-on knowledge of Microsoft Defender XDR, Defender for Endpoint, Advanced Hunting, KQL, and incident response workflows.
With structured training and practical security scenarios, the course can help SOC Analysts, Cybersecurity Analysts, Security Engineers, Incident Response Professionals, and IT Security professionals build relevant Microsoft cybersecurity expertise.
Enroll in Microsoft Defender XDR Certification Training in Sao Tome and Principe to develop practical skills for modern Security Operations Center environments and strengthen your professional cybersecurity capabilities.
Target audience
- SOC Analysts
- Cybersecurity Analysts
- Security Operations Engineers
- Incident Response Professionals
- Threat Hunters
- Endpoint Security Professionals
- IT Security Administrators
- Aspiring Cybersecurity Professionals
Verified learning evidence
Expertise, recognition and learner outcomes
Course-specific expertise
- 9+ years of professional cybersecurity and Microsoft security experience.
- 2,000+ hours of instructor-led and hands-on cybersecurity training delivered.
- 1,200+ professionals trained across certification, technical, and corporate programs.
- 120+ corporate training batches delivered for IT and cybersecurity teams.
- 75+ practical security labs and case studies covering XDR, endpoint threats, identity attacks, phishing, and incident response.
- Training delivered across 8+ industries, including Banking & Financial Services, IT Services, Healthcare, Telecommunications, Government, E-commerce, Manufacturing, and Technology.
- 500+ hours of Microsoft security-focused training covering Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Office 365, and related security operations.
- Practical experience conducting 200+ threat-investigation and incident-response exercises involving alerts, endpoint telemetry, suspicious identities, phishing, and malware scenarios.
- Hands-on training includes Microsoft Defender XDR, incident investigation, Advanced Hunting, KQL, endpoint investigation, threat detection, automated response, and security monitoring. Microsoft specifically includes these capabilities in its current Defender XDR hands-on learning and assessment.
Documented learner outcomes
- Problem Statement: Banks face phishing, malware, identity attacks, endpoint threats, and suspicious activities across users, devices, email, and cloud applications.
Disconnected security tools can make it difficult for security teams to detect and investigate attacks quickly. - How We Overcame the Problem: Learners implemented a Microsoft Defender XDR workflow to correlate security signals across endpoints, identities, email, and applications.
This enabled centralized threat detection, investigation, and response for banking security scenarios. - Overall Implementation: Learners implemented an end-to-end banking security workflow covering threat detection, alert correlation, incident investigation, threat hunting, and automated response.
- Evidence of Learning: Learners demonstrated the ability to analyze incidents, investigate alerts, identify attack indicators, perform threat hunting, and recommend remediation actions.
- Banking Security Workflow:
Banking Data & Alerts → Threat Detection → Signal Correlation → Incident Investigation → Threat Hunting → Response → Remediation - Endpoint Protection: Learners investigated simulated malware and suspicious endpoint activities on banking employee devices using Microsoft Defender capabilities.
- Identity Protection: Learners analyzed suspicious sign-ins, compromised credentials, and abnormal user activities to identify potential account compromise.
- Email Threat Protection: Learners investigated simulated phishing and malicious email activities and identified indicators associated with credential theft and malware delivery.
- Problem-Solving Evidence: Learners addressed challenges such as multiple security alerts, phishing attempts, suspicious logins, endpoint compromise, and alert overload through XDR-based correlation and investigation.
- Comparative Evidence: Learners evaluated how Microsoft Defender XDR correlates signals across endpoints, identities, email, and applications to provide broader visibility than isolated security monitoring.
- Overall Outcome: Learners demonstrated practical skills in XDR monitoring, threat detection, incident investigation, threat hunting, identity protection, endpoint security, and response within banking scenarios.
- Final Evidence: Incident investigations, threat-hunting exercises, security alerts, attack indicators, investigation findings, response actions, and remediation reports provide evidence of practical competency.
Helpful answers for planning your training
Frequently asked questions
Microsoft Defender XDR Certification Training is a professional cybersecurity course focused on Microsoft Defender XDR, endpoint security, threat detection, incident investigation, threat hunting, KQL, and security response workflows.
Microsoft Defender XDR brings security signals from Microsoft security solutions together to help security teams detect, investigate, and respond to threats across endpoints, identities, email, applications, and other environments.
Learner reviews
Rated by 2,900 learners
Rating and review totals are controlled per course in the CRM.
4out of 5
Popular cities in Sao Tome and Principe
Compare city information, course curriculum, exam details and ways to enquire.
Book with clarity
Clear pricing, protected approval and learner support
Approval before payment
A secure payment link is shared only after the CRM team confirms the request.
Live instructor-led delivery
Ask questions during the session and learn alongside a scheduled cohort.
Verified learner feedback
Published course feedback is linked to completed learner records and CRM approval.
Visible schedules
Review weekday and weekend dates, duration, timezone and seat availability before booking.