Attack Simulation Training, Audit Logs & Sentinel Integration
SC-200 Exam Alignment
SC-200
Security operations and threat hunting: Configure Attack Simulation Training campaigns, search the Unified Audit Log, write basic KQL queries for Advanced Hunting, and understand how Microsoft 365 Defender integrates with Microsoft Sentinel for SIEM/SOAR workflows.
- Attack Simulation Training requires Defender for Office 365 Plan 2 — it is not available in Plan 1
- The Unified Audit Log (UAL) retains data for 180 days for standard users and 365 days for users with Office 365 E5 / M365 E5 licences
- Advanced Hunting uses Kusto Query Language (KQL) — data is stored in tables like
EmailEvents,IdentitySignInEvents,DeviceProcessEvents - Microsoft Sentinel integrates with Microsoft 365 Defender via the Microsoft 365 Defender connector — syncing incidents, alerts, and raw event tables into Sentinel for SIEM-level investigation and automation
where (filter), project (select columns), summarize (aggregate), join (combine tables), top (limit results), and ago() (time filter). Also know the key M365 Defender Advanced Hunting table names: EmailEvents, EmailUrlInfo, EmailAttachmentInfo, IdentityLogonEvents, DeviceEvents, CloudAppEvents.🎯 Attack Simulation Training
Attack Simulation Training (AST) lets administrators run controlled phishing simulations against real users to measure susceptibility and automatically assign remedial training to users who fall for the simulation. It requires Defender for Office 365 Plan 2.
Simulation Types
| Technique | What It Simulates | Example Payload |
|---|---|---|
| Credential harvest | Phishing email that links to a fake login page designed to capture credentials | Fake Microsoft 365 login page asking for username/password |
| Malware attachment | Email with a simulated malicious attachment (macro-enabled Office file) | “Invoice.docm” — pretends to contain malware on open |
| Link in attachment | Attachment contains a URL that leads to a credential harvest page | PDF with embedded “Click here to sign” link |
| Link to malware | Email with a URL that simulates a malware download | Email with link to fake software update download |
| Drive-by URL | Email linking to a page that silently simulates drive-by exploitation | Fake news article link that simulates exploit kit landing page |
| OAuth consent grant | Simulates an OAuth app requesting dangerous permissions from users | Fake app requesting read mail, read contacts, and send-as permissions |
💡 Training Assignment — Automatic vs Manual
- Automatically assign training — configure specific training modules that are automatically assigned to users who click the simulated phishing link or submit credentials. Training is assigned within 24 hours of the simulation event
- Due date — set a training completion deadline (typically 30 days) after which the training is marked overdue
- Notify manager — optionally notify the user’s manager when they fall for the simulation
Key Reports
| Metric | Definition | Benchmark Target |
|---|---|---|
| Click rate | % of recipients who clicked the phishing link | Below 5% after sustained training programme |
| Credential submission rate | % who entered credentials on the fake login page | Near 0% |
| Training completion rate | % of assigned users who completed remedial training | Above 90% |
| Repeat offenders | Users who clicked in 2+ simulations — highest-risk individuals | Target for additional security awareness reinforcement |
📋 Unified Audit Log (UAL)
The Unified Audit Log records user and admin activity across Microsoft 365 services — Exchange Online, SharePoint, OneDrive, Teams, Power Platform, Entra ID, and more.
| Setting | Value |
|---|---|
| Default retention | 180 days (all users) |
| E5 / Audit Premium retention | 365 days (requires M365 E5, Office 365 E5, or Audit Premium add-on) |
| 10-year retention | Requires Microsoft Purview Audit (Premium) with the 10-year retention add-on |
| Access location | Microsoft Purview compliance portal → Audit OR security.microsoft.com → Hunting → Advanced Hunting |
Common Audit Activities to Search
| Scenario | Activity to Search | Service |
|---|---|---|
| User downloaded a sensitive file | FileDownloaded | SharePoint / OneDrive |
| Admin changed a user’s password | Change user password | Entra ID / M365 admin |
| Email forwarding rule created | New-InboxRule / Set-InboxRule with ForwardTo | Exchange Online |
| External sharing link created | SharingInvitationCreated | SharePoint |
| MFA disabled for a user | Disable Strong Authentication | Entra ID |
| New admin role assigned | Add member to role | Entra ID |
🔍 Advanced Hunting — KQL Basics
Advanced Hunting (security.microsoft.com → Hunting → Advanced Hunting) lets you query raw event data across all Microsoft 365 Defender data sources using KQL.
🔵 Microsoft Sentinel Integration
Microsoft Sentinel is a cloud-native SIEM/SOAR platform. Connecting it to Microsoft 365 Defender brings all XDR signals into Sentinel for advanced correlation, long-term retention, custom analytics rules, and automated playbooks.
| Integration Component | What It Provides |
|---|---|
| Microsoft 365 Defender connector | Syncs all M365 Defender incidents and alerts into Sentinel. Also ingests raw Advanced Hunting tables for long-term KQL querying |
| Unified incident platform | When the connector is enabled, M365 Defender incidents appear in the Sentinel incident queue — analysts work from one place |
| Analytics rules | Write custom KQL detection rules in Sentinel that run on the ingested M365 data |
| Playbooks (Logic Apps) | SOAR automation — e.g. when a High severity incident is created, automatically disable the user, send a Teams alert, and create a ServiceNow ticket |
| Workbooks | Pre-built and custom dashboards visualising M365 security data |
🔗 Unified Security Operations Platform
Microsoft has been converging the Defender portal and Sentinel into a Unified Security Operations Platform. When Sentinel is connected to the Defender portal, analysts can use a single portal (security.microsoft.com) to query Sentinel data, manage Sentinel incidents, and trigger playbooks — without switching between portals.
# Connect to Exchange Online for audit log access Connect-ExchangeOnline # Verify auditing is enabled Get-AdminAuditLogConfig | Select-Object UnifiedAuditLogIngestionEnabled # Search for inbox rule creation — BEC indicator (auto-forwarding rules) Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) -Operations New-InboxRule,Set-InboxRule | Select-Object CreationDate,UserIds,Operations,AuditData | Sort-Object CreationDate -Descending # Search for external sharing events in SharePoint last 30 days Search-UnifiedAuditLog -StartDate (Get-Date).AddDays(-30) -EndDate (Get-Date) -RecordType SharePointSharingOperation -Operations SharingInvitationCreated | Select-Object CreationDate,UserIds,AuditData
💡 Best Practices
- Run Attack Simulation Training campaigns monthly — start with broad credential harvest simulations to establish a baseline click rate, then use targeted simulations for high-risk departments (Finance, HR, IT admins)
- Always configure automatic training assignment — users who click the simulated phish should receive training within 24 hours while the experience is still fresh
- Enable Audit (Premium) for all E5 users — the 1-year retention window and additional audit events (MailItemsAccessed for BEC investigation) are critical for incident forensics
- In Advanced Hunting, create saved queries for recurring investigation scenarios (daily phishing review, high-risk sign-in review) — these become your SOC runbook
- When connecting Sentinel, use the Microsoft 365 Defender connector in “Incidents & alerts only” mode first — this is less expensive than ingesting all raw tables
🎓 Interview Q&A
Defender for Office 365 provides excellent technical controls — but no email filter is 100% effective. Sophisticated spear-phishing and BEC attacks are specifically crafted to bypass technical controls by targeting human psychology. A single successful phish that reaches a user’s Inbox represents a moment where the only protection is the user’s behaviour.
Attack Simulation Training measures and improves exactly this human layer: it quantifies the human risk (click rate, credential submission rate), automatic training assignment ensures susceptible users receive education immediately after a simulated failure, it identifies repeat offenders who need more intensive intervention, and it satisfies regulatory and cyber insurance requirements (NIST, ISO 27001, Cyber Essentials) that mandate documented security awareness training. Combined with Defender for Office 365, it creates true defence in depth.
Which Defender for Office 365 licence tier is required to run Attack Simulation Training campaigns?
During a BEC investigation, you need to check whether a compromised user created email forwarding rules in the past week. What is the correct audit activity to search?
Which KQL table in Microsoft 365 Defender Advanced Hunting would you query to find users who received phishing emails in the last 24 hours?
where ThreatTypes has 'Phish' and where Timestamp > ago(1d) to identify phishing recipients in the last 24 hours.What is the default Unified Audit Log retention period for users in a standard Microsoft 365 tenant (without E5 or Audit Premium)?
A security team wants to automatically open a ServiceNow ticket and send a Teams notification whenever a High severity incident is created in Microsoft 365 Defender. Which Microsoft tool enables this workflow?
Course Complete!
You’ve completed all 6 modules of the M365 Security Administration course. You’re now ready to tackle SC-200 exam questions and protect Microsoft 365 tenants end to end.