Microsoft Sentinel and Defender XDR for SC-200 | Memory and Reflex, Part 2

The same Monday, the same attack, now inside Microsoft: Sentinel is the memory, Defender XDR is the reflex, and both live in the Microsoft Defender portal. Built against the SC-200 skills measured as of 21 October 2026, one exam domain at a time. If SIEM and XDR are new to you, watch Part 1 first:    • SIEM and XDR, Explained Through One Attack...   What you'll learn • Getting data in: the Defender tables, Windows Security Events via AMA and data collection rules, why the Minimal event set misses 5145, WindowsEvent vs SecurityEvent, CEF into CommonSecurityLog, the analytics tier vs the data lake • Detections: film 1's Sigma rule rewritten in KQL, scheduled vs NRT analytics rules (and the 5-minute delay), Defender custom detections, how alerts are correlated into incidents • Automation: attack disruption, automation levels per device group, attack surface reduction, automation rules and playbooks, alert tuning • Responding in the Defender portal: the attack story, Threat Explorer, device and file actions, live response, Defender for Identity, Entra ID Protection, Security Copilot and its agents, Purview Audit • Threat hunting with KQL: choosing the table, the RunMRU hunt, the operators the exam tests (has vs contains, == vs =~, join, arg_max), Sentinel hunting, the data lake • How SC-200 asks its questions, the traps, and a four-week study plan Every preview feature is tagged on screen; the exam mostly asks about generally available ones. Six times the film stops with an exam-style question and a countdown. Chapters 0:00 The same Monday, one portal 1:59 Getting the diaries in 5:43 The rule, in KQL 10:07 Teaching the reflex 13:16 Monday in the Defender portal 17:36 Asking the data 21:06 How SC-200 asks Notes • Microsoft changes these products and the exam often. Facts checked against Microsoft's documentation in September 2026; check the official SC-200 study guide before your exam. • The Wells Registry, Ana, and every time, amount and indicator in the story are fiction; IP addresses and domains come from ranges reserved for documentation (RFC 5737, .example). • Narration: AI voice (ElevenLabs). Animation made in code. • Not affiliated with or endorsed by Microsoft. Microsoft Sentinel, Microsoft Defender XDR, Microsoft Entra and Security Copilot are trademarks of the Microsoft group of companies. MITRE ATT&CK® is a registered trademark of The MITRE Corporation. #SC200 #MicrosoftSentinel #DefenderXDR