From the course: Microsoft Security Operations Analyst Associate (SC-200) Cert Prep by Microsoft Press

Unlock this course with a free trial

Join today to access over 25,600 courses taught by industry experts.

Investigate threats using a unified audit log

Investigate threats using a unified audit log

From the course: Microsoft Security Operations Analyst Associate (SC-200) Cert Prep by Microsoft Press

Start my 1-month free trial Buy for my team

Investigate threats using a unified audit log

“

- [Instructor] The first topic of this lesson is to investigate threats by using unified audit log. But before we start investigating, let's have a quick overview of the unified audit log. As the name implies, the Unified Audit Log is a solution to capture, record, and retain the logs. Audit records for these events are searchable, using the Microsoft Purview or Microsoft Defender Portal audit search. Microsoft Purview, provides two auditing solutions: Audit Standard and Audit Premium. All user, and admin activities performed in Microsoft 365 services and solutions, are captured, recorded, and retained in the unified audit log. Okay? Now for the SC-200 exam, we need to focus on investigating threats by using the Unified Audit Log, which we will see shortly. But here is a quick comparison table between the key capabilities available in Audit Standard and Audit Premium. Microsoft Purview Audit…

Contents