Microsoft Defender XDR
Microsoft Defender XDR is an extended detection and response suite that unifies signals across endpoints, identities, email, and cloud apps. SC-200 covers responding to XDR alerts and incidents.
All SC-200 Terms
Microsoft Sentinel
Microsoft Sentinel is a cloud-native SIEM and SOAR platform for collecting, detecting, investigating, and responding to threats at scale.
Microsoft Defender XDR
Microsoft Defender XDR is an extended detection and response suite that unifies signals across endpoints, identities, email, and cloud apps.
KQL
KQL (Kusto Query Language) is the query language used to search and analyze data in Microsoft Sentinel and Defender Advanced Hunting.
Advanced Hunting
Advanced Hunting is a query-based threat-hunting tool in Microsoft Defender XDR that runs KQL against raw event tables.
Defender for Endpoint
Microsoft Defender for Endpoint is an endpoint detection and response service for detecting, investigating, and responding to device threats.
Attack surface reduction
Attack surface reduction (ASR) is a set of Defender for Endpoint rules that block risky behaviors used by malware.
Analytics rule
An analytics rule in Microsoft Sentinel defines the logic that generates alerts and incidents from ingested data.
Data connector
A data connector in Microsoft Sentinel ingests logs and events from a source such as Windows security events, Syslog, or Azure activity.
Playbook
A playbook in Microsoft Sentinel is an automated response workflow built on Azure Logic Apps, triggered by alerts or incidents.
Automation rule
An automation rule in Microsoft Sentinel orchestrates incident handling — assigning, tagging, and running playbooks.
Automatic attack disruption
Automatic attack disruption is a Microsoft Defender XDR capability that contains an in-progress attack by automatically isolating assets or accounts.
MITRE ATT&CK
MITRE ATT&CK is a knowledge base of adversary tactics and techniques used to map detection coverage.
Security Copilot
Microsoft Security Copilot is an AI assistant that helps analysts investigate and respond to incidents using natural language.