<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-malware-isolate-endpoint-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-file-encryption-table-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-zero-rows-no-matching-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-graph-lateral-movement-visualization-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-unknown-malware-asr-rules-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-brute-force-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/powershell-automated-response-quick-scan-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-rule-false-positives-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/limitations-of-externaldata-in-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cloudappevents-mailbox-access-forensics-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-response-microsoft-defender-identity-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/fix-playbook-device-id-format-mde-isolation-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-phishing-url-with-safe-links-policy-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-threat-hunting-data-sources-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/restore-account-after-automatic-containment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-personal-device-access-blocked-file-sharing-corporate-network-s-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-cost-sentinel-security-coverage-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/compromised-user-account-incident-response-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/confirm-lotl-attack-devicenetworkevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-isolation-approval-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suppress-false-positive-alerts-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-containment-action-ransomware-file-share-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mde-isolate-device-action-threat-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/forward-defender-for-cloud-apps-alerts-to-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/archive-sentinel-logs-to-reduce-costs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatic-remediation-after-auto-provisioning-defender-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/devicenetworkevents-remoteiptype-field-missing-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/querying-group-membership-changes-identitydirectoryevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-anomalous-user-behavior-ueba-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-requirements-permissions-workspace-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-privileged-role-assignments-outside-hours-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cross-workspace-incident-management-azure-lighthouse-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/action-center-approve-remediation-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/brute-force-detection-kql-join-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/action-center-automated-investigation-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/respond-suspicious-email-report-microsoft-365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-per-user-logon-baseline-anomaly-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-phishing-incident-response-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-alert-unusual-sharepoint-access-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/visualize-lateral-movement-attack-path-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-playbook-automatic-execution-conditions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-no-results-troubleshooting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/configure-user-reported-phishing-auto-investigation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshooting-duplicate-alerts-scheduled-rule-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/attackers-bypass-security-controls-techniques-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-hunting-techniques-identify-malicious-activity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/view-entities-involved-incident-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-zero-results-time-filter-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-automated-incident-response-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/disable-suspicious-oauth-app-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-dns-exfiltration-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/activity-policy-anonymous-ip-risk-score-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/filtering-known-user-agents-reduce-false-positives-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-isolated-device-live-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-hunting-program-components-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-defender-identity-lateral-movement-configuration-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-dns-queries-device-devicenetworkevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/windows-security-events-local-admin-alert-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-required-components-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ueba-behavioranalytics-anomalous-data-exfiltration-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-encrypted-files-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/phishing-credential-compromise-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identify-other-phishing-email-recipients-threat-explorer-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-user-activities-microsoft-365-defender-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-alerts-tab-consolidated-list-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-kql-threat-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/analytics-rule-no-alerts-missing-join-field-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/secure-score-dashboard-overall-security-posture-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-certutil-exe-download-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cloudappevents-table-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-process-creation-events-command-line-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/deploy-vulnerability-assessment-azure-policy-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-user-playbook-sentinel-graph-api-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-response-saas-alerts-defender-for-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-playbook-trigger-incident-evidence-collection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-hunting-hypothesis-components-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/isolate-azure-vm-just-in-time-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-xdr-alert-queue-actions-link-assign-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/finding-audit-logs-directory-role-changes-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-hunting-approaches-microsoft-defender-xdr-advanced-hunting-sc-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-automatic-attack-disruption-identity-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-compromised-user-account-m365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/legal-hold-role-microsoft-purview-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/analytics-rule-not-triggering-missing-column-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-step-incident-response-m365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-data-exfiltration-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detecting-mimikatz-process-events-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/playbook-trigger-logic-apps-alert-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-kql-join-brute-force-source-ip-mismatch-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-compromised-credentials-after-phishing-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cis-benchmark-compliance-dashboard-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/user-reported-phishing-trigger-automated-investigation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/compromised-account-investigation-first-step-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-automation-rule-trigger-incident-creation-only-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/assign-sentinel-reader-role-soc-analyst-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-scheduled-task-creation-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lateral-movement-detection-logon-events-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-overview-security-posture-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-threat-hunting-methods-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/playbook-automation-rule-permissions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-c2-communications-data-sources-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-analytics-rule-unusual-location-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/parent-process-id-column-deviceprocessevents-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-disable-hybrid-account-preservation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-response-components-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-memory-dump-live-response-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/table-level-retention-policy-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/c2-communication-detection-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ipv4-is-in-range-kql-function-for-ip-range-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/advanced-hunting-data-exfiltration-patterns-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatically-suspend-user-entra-id-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/count-failed-logons-per-ip-summarize-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rule-runquery-action-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-externaldata-kql-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-device-action-mde-ransomware-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-reader-role-read-only-access-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/initial-response-ransomware-mde-isolate-device-preserve-evidence-sc-20-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-threat-hunting-features-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-summarize-operator-count-failed-logons-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-close-old-sentinel-incidents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-automated-investigation-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/security-baseline-compliance-intune-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/best-practices-threat-hunting-queries-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/finding-url-click-events-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/isolate-device-defender-xdr-c2-communication-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-classification-categories-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/advanced-hunting-encrypted-files-ransomware-devicefileevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-playbook-trigger-type-incident-alert-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-mailbox-forwarding-rules-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-provision-log-analytics-agent-azure-vms-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rule-severityfilter-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/dns-tunneling-detection-microsoft-sentinel-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-sources-credential-theft-detection-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/stream-azure-logs-multiple-regions-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cis-benchmark-compliance-regulatory-dashboard-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/configure-azure-activity-connector-microsoft-sentinel-all-subscription-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/selective-isolation-device-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/assign-sentinel-responder-role-incident-comments-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/scheduled-task-high-frequency-lateral-movement-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lock-azure-subscription-to-stop-suspicious-deployment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/base64-decode-tostring-kql-function-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-step-sentinel-incident-response-investigate-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-explorer-email-campaign-investigation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-count-alerts-by-severity-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/compromised-device-network-connections-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mitre-attack-classification-methods-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rule-condition-status-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-data-archiving-log-analytics-policy-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-compromised-linux-vm-crypto-miner-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/integrate-microsoft-purview-sensitivity-labels-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/debug-impossible-travel-query-common-errors-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-xdr-advanced-hunting-deviceprocessevents-ransomware-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/session-policy-block-downloads-unmanaged-device-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lateral-movement-detection-smb-scheduled-task-join-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-xdr-advanced-hunting-approaches-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-defender-endpoint-alerts-missing-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/actions-contain-investigate-compromised-azure-vm-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-user-incidents-sentinel-entity-behavior-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/key-features-defender-xdr-soc-management-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-suspicious-process-live-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-sql-sql-injection-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-intelligence-taxii-connector-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-credential-theft-user-email-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-automation-rule-close-incidents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/approval-workflow-incident-response-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/query-cloudappevents-anonymous-ip-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-powershell-command-indicators-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/jit-vm-access-brute-force-protection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-details-page-actions-bookmark-add-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/isolate-device-and-block-file-hash-mde-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cloud-discovery-log-upload-steps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-automatic-remediation-deployifnotexists-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-step-brute-force-incident-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-data-exfiltration-devicefileevents-microsoft-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/revoke-session-defender-cloud-apps-force-reauthentication-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/attach-playbook-to-automation-rule-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/compromised-account-containment-steps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-alert-threshold-distinct-ip-count-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ingest-hybrid-logs-sentinel-defender-xdr-ama-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-decoded-powershell-commandline-deviceprocessevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/organize-incidents-triage-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/unified-incident-creation-sentinel-analytics-rules-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-compromised-user-account-unusual-access-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/capture-memory-dump-azure-vm-live-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-bin-summarize-time-window-detection-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/join-key-mismatch-hunting-query-troubleshooting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/triage-phishing-incident-sentinel-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/preserve-evidence-microsoft-365-litigation-hold-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-cross-workspace-kql-workspace-function-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatic-remediation-vm-misconfigurations-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/activity-policy-anonymous-ip-alert-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-sql-hybrid-protection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-sentinel-analytics-rule-2-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/anomalous-rdp-connections-lateral-movement-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-logic-error-parentheses-precedence-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-defender-xdr-incident-creation-setting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-hunting-query-best-practices-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/analytics-rule-purpose-failed-logon-detection-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/view-missing-security-updates-recommendations-defender-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/m365-defender-advanced-hunting-event-correlation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/powershell-recon-domain-controllers-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-existing-user-logon-from-new-ip-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-defender-xdr-incident-queue-unified-view-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/file-entity-page-automated-investigation-block-action-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/interpret-reverse-shell-scheduled-task-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/security-control-disablement-detect-securityevent-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/review-phishing-emails-threat-explorer-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/signinlogs-table-user-sign-in-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/remediation-actions-microsoft-365-defender-incident-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/interpreting-isolationstatus-defender-endpoint-api-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-anomaly-detection-rule-type-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-defender-for-cloud-apps-sharepoint-suspicious-activity-sc-20-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-memory-dump-forensic-analysis-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-scheduled-analytics-rule-steps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-365-brute-force-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/session-replay-lateral-movement-unusual-logins-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rule-severity-derived-from-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-copilot-for-security-license-requirements-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-password-spraying-securityevent-4625-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-response-investigate-before-containment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identify-phishing-email-recipients-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/natively-supported-security-event-sources-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-ransomware-response-isolate-device-revoke-access-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/optimize-analytics-rule-performance-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/filter-signins-by-country-location-countryorregion-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/email-investigation-threat-explorer-delivery-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-dns-tunneling-data-sources-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/aws-cloudtrail-sentinel-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identify-top-data-exfiltration-source-ips-total-bytes-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-xdr-threat-hunting-process-hypothesis-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatically-assign-incidents-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rules-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-rule-frequency-lookback-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lateral-movement-data-sources-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/choose-anomaly-rule-behavior-based-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-activity-log-vm-creation-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/single-incident-view-multiple-sentinel-workspaces-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/isolate-device-with-trusted-ips-air-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-defender-arc-servers-auto-provisioning-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cloudappevents-mailbox-access-ip-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/deviceprocessevents-devicenetworkevents-join-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-kql-column-not-found-error-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/analytics-rule-no-alerts-missing-column-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/dlp-incident-response-remove-external-access-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/jupyter-notebooks-setup-microsoft-sentinel-threat-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-cspm-plan-capabilities-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/decode-powershell-script-sentinel-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-data-connector-table-mappings-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/manage-devices-user-accounts-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ingest-linux-syslog-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-syslog-messages-azure-monitor-agent-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-isolate-device-alert-custom-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/devicenetworkevents-table-rdp-connections-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lsass-credential-dumping-security-event-id-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-federated-saas-account-compromise-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-leftanti-join-inactive-users-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-join-operator-compare-ip-baselines-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-azurehound-privilege-escalation-sentinel-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/use-lookup-operator-match-users-malicious-ip-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-sender-email-across-tenants-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/integrate-defender-cloud-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-azurehound-privilege-escalation-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-containment-playbooks-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-log-archival-methods-cost-reduction-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-graph-attack-progression-visualization-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-memory-dump-forensic-evidence-sysinternals-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-endpoint-response-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-data-exfiltration-defender-cloud-apps-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/customize-sentinel-workbook-without-affecting-original-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/multi-tenant-sentinel-azure-lighthouse-2-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/c2-detection-dns-high-entropy-short-ttl-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-threat-intelligence-taxii-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-compromised-user-account-microsoft-entra-id-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-forensic-disk-snapshot-offline-azure-vm-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/playbook-trigger-compatibility-automation-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/security-baseline-compliance-intune-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-creation-defender-xdr-sentinel-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-vulnerability-assessment-azure-vms-defender-for-cloud-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/unblock-false-positive-application-indicator-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-containers-aks-threat-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/restrict-sentinel-access-conditional-access-tag-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/c2-communication-detection-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ueba-prerequisites-microsoft-sentinel-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-rule-incident-assignment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/preserve-investigation-snapshot-sentinel-bookmarks-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-ueba-hunt-compromised-identities-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-email-notification-high-severity-incident-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sharepoint-session-control-prerequisite-entra-id-app-proxy-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/retain-incident-data-90-days-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-assign-critical-incidents-sentinel-automation-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/run-kql-query-on-sentinel-incident-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-action-phishing-campaign-block-url-threat-indicator-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/approve-analytics-rules-sentinel-cicd-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-forensic-data-offline-device-defender-for-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/connect-palo-alto-firewall-sentinel-cef-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-suspicious-sharepoint-downloads-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/understanding-secure-score-defender-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-incident-timeline-feature-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-no-results-time-range-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-malformed-data-ingestion-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/finding-recipients-using-internet-message-id-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-brute-force-attack-kql-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-incident-graph-attack-chain-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-data-exfiltration-cloud-storage-mde-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-policy-not-evaluating-resources-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-sentinel-analytics-rule-not-firing-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-dns-exfiltration-hunting-techniques-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-step-enable-ueba-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-external-user-workbook-access-azure-ad-b2b-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-kql-signinlogs-user-sign-in-events-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/respond-to-incident-microsoft-sentinel-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/pass-the-hash-incident-containment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/playbook-suspend-user-microsoft-entra-id-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-file-encryption-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-action-phishing-email-delivered-defender-office-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-brute-force-rule-not-triggering-securityevent-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/device-timeline-chronological-events-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-entity-mapping-alert-grouping-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-data-exfiltration-email-microsoft-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/session-policy-block-reauthenticate-malicious-ip-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-retention-azure-activity-logs-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/multicloud-threat-detection-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-defender-for-containers-aks-cluster-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reducing-incident-volume-brute-force-rule-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/run-playbooks-permissions-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/refine-dns-query-hunting-exclude-servers-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-remote-powershell-sessions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-action-unusual-file-download-suspend-user-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-pass-the-hash-attack-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-encoded-powershell-commands-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-rule-alert-suppression-threshold-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-365-defender-workloads-descriptions-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/building-brute-force-detection-rule-azure-sql-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sharepoint-file-download-hunting-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/anomaly-detection-policy-mass-file-download-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/logic-app-403-managed-identity-permissions-sentinel-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/living-off-the-land-attack-hunting-microsoft-sentinel-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-data-exfiltration-defender-cloud-apps-2-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/privilege-escalation-integrity-levels-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-global-administrator-assignment-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kerberoasting-detection-kql-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/dynamic-incident-assignment-based-alert-title-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunting-malicious-url-clicks-email-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-join-devicelogonevents-devicenetworkevents-lateral-movement-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/validate-defender-identity-alert-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/check-unusual-ip-storage-access-entity-timeline-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-device-ransomware-mde-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-defender-for-identity-connector-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-containment-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/entity-mapping-required-sentinel-incident-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-vms-no-recent-vulnerability-scan-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/containing-data-exfiltration-ransomware-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/disable-power-automate-flow-governance-action-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/activity-policy-threshold-alerts-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-credential-dumping-lsass-access-event-id-4656-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/prevent-duplicate-incidents-alert-suppression-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-firewall-deny-inbound-specific-ip-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-data-connector-azure-ad-sign-in-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-failed-logon-count-per-user-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-device-isolation-exclude-critical-servers-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-known-malicious-ips-watchlist-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/outbound-network-connections-specific-ip-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-missing-defender-xdr-incidents-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-intune-device-inventory-compliance-investigation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/analytics-rule-join-anti-join-threat-intelligence-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-sources-compromised-user-investigation-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/select-signinlogs-data-source-brute-force-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-forensic-data-live-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/live-response-command-blocked-constrainedlanguage-mode-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/getwatchlist-function-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-log-analytics-retention-settings-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-disabling-security-controls-securityevent-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/analytics-rule-no-alerts-troubleshooting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/escalate-incident-after-4-hours-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/playbook-block-user-sign-ins-entra-id-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-rule-not-triggering-case-sensitivity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-mfa-bypass-sign-in-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/join-emailevents-emailurlinfo-malicious-url-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enforce-just-in-time-vm-access-policy-initiative-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-rule-file-creation-process-execution-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-indicators-ms-sentinel-threat-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-portal-logon-tables-identitylogonevents-aadsigninevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-analytics-rule-not-generating-incidents-missing-table-sc-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/adaptive-network-hardening-internet-exposed-vm-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identitylogonevents-table-for-credential-theft-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-column-not-exists-sentinel-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-pass-the-hash-defender-for-identity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-find-high-severity-alert-names-many-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/get-mpthreat-threat-status-blocked-not-executed-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-classification-options-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-dll-side-loading-threat-intelligence-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-advanced-threat-protection-sql-server-azure-vms-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/consolidate-incident-investigation-add-alerts-bookmarks-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-xdr-collect-investigation-package-memory-dump-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-playbook-trigger-type-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/understanding-suppressionduration-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rules-trigger-playbooks-sentinel-incidents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identify-initial-infection-vector-kql-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/understand-sentinel-incident-assignedto-field-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-error-language-not-recognized-table-missing-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identify-process-initiating-outbound-connections-microsoft-defender-sc-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-automation-rule-vs-analytics-rule-automation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-compromised-virtual-machine-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-device-c2-communication-isolate-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/advanced-hunting-process-command-line-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/guest-configuration-security-baseline-vms-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatic-remediation-deployifnotexists-policy-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-response-steps-after-true-positive-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-duplicate-incidents-lookback-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-filter-multiple-severity-values-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/valid-incident-severity-levels-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-summarize-operator-time-binning-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/install-endpoint-protection-recommendation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-memory-dump-collection-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-management-actions-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/use-incident-investigation-graph-entities-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-rapid-file-encryption-detection-ransomware-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/set-alert-threshold-scheduled-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rule-trigger-timing-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-golden-ticket-attack-defender-identity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mde-alerts-not-correlating-incidents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/analytics-rule-no-incidents-entity-mapping-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/integrate-third-party-vulnerability-assessment-qualys-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-mimikatz-credential-dumping-deviceprocessevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-inner-join-excludes-rows-no-risky-sign-in-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-sql-query-details-defender-for-cloud-alert-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-response-playbook-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-defender-for-cloud-endpoint-protection-vm-policy-initiative-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/live-response-investigate-indicator-compromise-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ipv4-lookup-usage-error-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-device-isolation-playbook-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-device-isolation-playbook-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suspicious-sign-in-containment-disable-account-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-response-process-steps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-analytics-rule-not-firing-threshold-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/disable-oauth-app-permissions-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/network-anomaly-compromise-multiple-connections-external-ip-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/compromised-user-account-containment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/preserve-mailbox-legal-hold-purview-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/validate-suspicious-login-sentinel-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-containment-microsoft-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/malicious-oauth-app-hunting-activity-log-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/triage-phishing-incident-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-email-threat-advanced-hunting-block-indicators-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lsass-access-credential-theft-event-type-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-microsoft-sentinel-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-closure-after-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detecting-logons-new-ips-existing-users-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-suspend-user-entra-id-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/prerequisite-automatic-attack-disruption-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/validate-low-confidence-high-severity-incident-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/windows-event-id-credential-dumping-mimikatz-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/join-devicenetworkevents-to-find-devices-by-ip-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-powershell-rundll32-javascript-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-apps-anomaly-detection-policy-enabled-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/deploy-ama-agent-non-domain-joined-servers-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-device-isolation-on-incident-creation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-forensic-evidence-windows-mde-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-ueba-anomaly-response-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/dns-tunneling-detection-kql-dcount-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-trigger-type-incident-created-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/validate-impossible-travel-alert-microsoft-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-default-time-range-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-containment-steps-forensic-evidence-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-deploy-vulnerability-assessment-agent-vms-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-malicious-email-link-threat-explorer-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/bidirectional-incident-sync-defender-xdr-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/dcsync-attack-detection-event-id-4662-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/alert-anonymous-ip-access-sanctioned-app-activity-policy-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-automation-rules-actions-severity-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-multi-region-data-residency-separate-workspaces-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/upload-forensic-data-to-azure-from-linux-azcopy-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/outbound-smb-lateral-movement-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-registry-changes-by-process-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/deploy-ama-agent-non-domain-joined-servers-azure-arc-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-kerberos-golden-ticket-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-ransomware-file-creation-devices-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/session-policy-block-downloads-unmanaged-devices-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/anomaly-detection-baseline-logon-count-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/phishing-containment-first-action-custom-threat-indicator-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-syntax-failed-logon-excluding-system-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suppression-preventing-alerts-sentinel-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/missing-time-range-filter-sentinel-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-defender-for-identity-integration-sentinel-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/deviceprocessevents-table-command-line-arguments-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/conduct-post-incident-review-steps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-operators-microsoft-sentinel-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-365-defender-connector-correlate-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/email-attachment-exfiltration-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-investigation-package-after-device-isolation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-graph-lateral-movement-timeline-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/fix-resource-not-found-error-sentinel-cross-workspace-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/assign-high-severity-incidents-playbook-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/convert-cloud-apps-alerts-to-sentinel-incidents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-devices-by-file-hash-quarantined-items-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-phishing-remediation-automation-rule-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-teams-connector-playbook-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-creation-avoid-duplicate-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-workspace-network-restriction-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigating-alert-details-command-line-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/emailevents-table-internet-message-id-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-encoded-powershell-commands-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/filter-ips-against-watchlist-getwatchlist-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/restrict-ip-access-sentinel-workspace-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/trigger-playbook-incident-creation-automation-rule-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-rule-exclude-service-account-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-files-live-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/controlled-folder-access-prevent-ransomware-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-impossible-travel-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/isolate-windows-10-device-ransomware-incident-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/correlate-process-execution-file-creation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/review-user-reported-phishing-email-defender-portal-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-cross-tenant-incidents-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-incident-investigation-steps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-multiple-conditions-trigger-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-remote-powershell-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-user-activities-microsoft-365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/prevent-lateral-movement-block-malicious-domain-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-threat-hunting-best-practices-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-email-evidence-microsoft-365-ediscovery-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/approval-workflows-incident-response-playbooks-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/fix-timezone-mismatch-sentinel-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/table-level-retention-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/golden-ticket-attack-hunting-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-sql-plan-hybrid-threat-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/getwatchlist-kql-function-reference-watchlist-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-unusual-file-downloads-sharepoint-log-source-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/on-premises-server-alerts-microsoft-sentinel-azure-arc-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-response-classification-containment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-lighthouse-multi-tenant-sentinel-incidents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/handle-false-positive-sentinel-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-ueba-azure-ad-sign-in-data-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-sentinel-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suspicious-sign-in-containment-user-risk-remediation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/remote-forensic-data-collection-tools-defender-for-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-identity-pass-the-hash-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/assign-sentinel-reader-role-soc-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-ip-outside-range-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-cross-workspace-queries-workspace-expression-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-block-user-sign-ins-playbook-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/configure-dlp-alert-for-credit-card-sharing-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/rbac-roles-for-incident-management-microsoft-365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rule-trigger-type-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-cloud-apps-trusted-ip-impossible-travel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/valid-data-connectors-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-collection-rules-filter-ingestion-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ingest-cisco-asa-cef-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-step-unreported-phishing-email-report-analysis-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-log-schema-mismatch-ingestion-failure-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/missing-defender-for-office-365-incidents-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-investigation-enrichment-threat-intelligence-entity-behavior-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lateral-movement-detection-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/schedule-analytics-rule-business-hours-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-365-data-connectors-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/brute-force-detection-false-positives-corporate-ip-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/decode-base64-command-line-word-process-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-outbound-connections-internal-ip-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-detect-certutil-lolbin-downloads-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/entity-pages-user-context-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-encoded-powershell-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/adaptive-network-hardening-block-malicious-traffic-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-forensic-evidence-linux-azure-custom-script-extension-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/phishing-email-hunting-threat-explorer-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatically-assign-incidents-sentinel-automation-rules-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/windows-security-events-domain-controllers-ama-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-investigation-response-air-actions-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/arm-template-saved-search-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-air-defender-for-identity-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-analytics-rule-defender-for-cloud-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/deploy-vulnerability-assessment-azure-policy-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/email-exfiltration-advanced-hunting-tables-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/forensic-image-collection-mde-live-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-user-access-preserve-session-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/querying-azure-storage-access-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/parent-child-process-alert-conditions-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-apps-file-policy-alert-external-sharing-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/combine-cloudappevents-devicenetworkevents-data-exfiltration-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/choose-scheduled-rule-type-for-entra-id-audit-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/zero-hour-auto-purge-remove-malicious-emails-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-alert-threshold-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-externaldata-query-no-results-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/setup-microsoft-sentinel-workspace-connect-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/assign-high-severity-incidents-tier1-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-password-spray-summarize-dcount-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/security-solutions-incident-management-microsoft-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/run-sentinel-rule-only-business-hours-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/pass-the-hash-detection-kql-query-hybrid-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/allow-indicator-block-at-first-sight-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/regulatory-compliance-dashboard-cis-benchmark-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-xdr-incidents-missing-sentinel-filter-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-phishing-campaign-block-url-microsoft-defender-cloud-apps-sc-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-response-microsoft-defender-identity-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-built-in-hunting-queries-compromised-credentials-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/use-microsoft-365-defender-connector-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-response-process-steps-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/saved-searches-arm-template-log-analytics-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-analytics-rules-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-count-incidents-by-severity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-threat-hunting-methods-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-malicious-process-custom-indicator-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-isolate-mailbox-phishing-sentinel-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-trigger-requirements-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/query-securityincident-table-incidents-per-subscription-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-grouping-settings-merge-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-cmd-exe-launches-powershell-outbound-network-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-emails-multiple-mailboxes-phishing-content-search-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/navigate-defender-for-cloud-overview-page-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/trigger-playbook-when-incident-severity-updated-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/correlate-identity-mailbox-activity-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-containment-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-mailbox-compromise-after-phishing-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/alert-threshold-reduce-false-positives-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-built-in-roles-permissions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-response-microsoft-sentinel-playbooks-automation-rul-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/optimize-kql-bag-unpack-filter-before-expand-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-external-file-sharing-exfiltration-entra-id-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/manage-security-operations-environment-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/trace-phishing-email-origin-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/isolate-multiple-endpoints-during-ransomware-mde-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-policy-azure-security-benchmark-sql-ads-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-management-capabilities-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cross-workspace-query-kql-workspace-function-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-investigation-package-device-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-custom-policy-initiative-root-management-group-sc-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/entities-array-parsing-issue-kql-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/brute-force-detection-correlate-failed-successful-logon-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/query-file-execution-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/credential-theft-detection-data-sources-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/malware-remediation-reimage-from-backup-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/interpret-automation-rule-behavior-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/devicenetworkevents-outbound-connections-forensics-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/powershell-from-office-macro-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-containment-action-ransomware-isolate-device-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-brute-force-attack-microsoft-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-data-exfiltration-microsoft-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/manage-microsoft-sentinel-roles-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-title-contains-phishing-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-graph-visualize-attack-path-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-signinlogs-user-signins-multiple-ips-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-connector-sentinel-incident-automation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-custom-analytics-rule-invalid-query-syntax-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-malicious-url-tenant-allow-block-list-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/interpret-risklevel-riskstate-sentinel-entity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-automation-prerequisites-components-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identify-users-clicked-malicious-link-email-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-alert-external-email-attachments-untrusted-domains-defender-off-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/retrieve-sentinel-data-external-analysis-api-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/group-related-incidents-different-rules-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-sentinel-analytics-rule-no-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rule-severity-condition-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/query-cloud-app-security-logs-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-isolate-mailbox-phishing-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/group-events-time-buckets-bin-function-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-sources-microsoft-sentinel-incident-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-xdr-ransomware-hunting-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshooting-powershell-sentinel-query-error-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-detect-accounts-high-suspicious-process-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/prevent-ransomware-encryption-sharepoint-onedrive-lock-account-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ueba-timeline-entity-page-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-playbook-update-incident-user-comments-phishing-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/email-notifications-high-medium-incidents-not-resolved-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/device-isolation-powershell-payload-containment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-assignment-sentinel-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/customize-sentinel-workbook-copy-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/diagnostics-json-security-events-windows-vm-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/revoke-sessions-reset-password-hybrid-compromise-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/diagnose-azure-firewall-rule-port-not-matched-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/email-events-query-mailbox-forwarding-rules-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/security-operations-environment-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-ip-address-access-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/living-off-the-land-binary-detection-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-tagging-using-watchlist-automation-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detecting-code-execution-rundll32-javascript-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-registry-changes-by-process-deviceregistryevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-user-incidents-sentinel-entity-behavior-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-valid-components-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mailbox-forwarding-rules-log-source-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ai-incident-classification-defender-xdr-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/correlate-sign-in-email-activity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-entity-account-value-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/compromised-user-service-principal-shared-ip-hunting-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunting-query-no-results-threat-intelligence-join-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/integrate-sentinel-with-purview-sensitivity-labels-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-cost-optimization-strategies-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/legal-hold-role-microsoft-purview-ediscovery-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-dcsync-attack-microsoft-defender-identity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/dns-exfiltration-domain-extraction-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-user-access-credential-theft-investigation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/emailurlinfo-table-phishing-url-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/anomaly-detection-rule-unusual-location-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-assignment-mitre-tactic-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/just-in-time-vm-access-secure-score-improvement-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-run-playbook-incident-creation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-user-reported-phishing-emails-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/arg-query-vulnerability-scan-status-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/just-in-time-vm-access-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunting-malicious-scripts-deviceprocessevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-explorer-email-headers-collection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/revoke-active-sessions-compromised-user-account-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-detection-join-devicefileevents-deviceinfo-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/alert-suppression-false-positives-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-waf-rule-block-specific-ip-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-ueba-user-entity-behavior-analytics-capabilities-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatic-attack-disruption-identity-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-device-isolation-sentinel-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-user-activities-officeactivity-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-threat-hunting-practices-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-compromised-user-account-entra-id-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/archive-logs-microsoft-sentinel-cost-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-summarize-top-alert-types-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suspending-user-compromised-account-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/missing-defender-product-incidents-sentinel-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/best-practices-threat-hunting-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-playbook-trigger-requirements-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/purview-dlp-investigate-data-exfiltration-sharepoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-kql-severity-ordering-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-trigger-type-incident-alert-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-alerts-not-incidents-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-source-ransomware-early-indicators-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/understanding-trigger-threshold-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-defender-cloud-apps-connector-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/emailevents-table-delivery-verdict-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-custom-logs-linux-app-log-collection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-log-ingestion-ama-dcr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-lateral-movement-rdp-connections-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-downloads-unmanaged-device-session-policy-defender-cloud-apps-sc-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/interpret-ueba-anomalies-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/arm-template-daily-quota-sentinel-ingestion-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/escalate-high-severity-incidents-teams-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/remediate-phishing-incident-microsoft-365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/on-premises-ad-brute-force-kql-event-4625-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/compromised-service-principal-key-vault-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/action-center-remediation-actions-review-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/missing-defender-identity-alerts-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/powershell-ad-reconnaissance-domain-controllers-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incorrect-join-condition-kql-sentinel-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-rule-file-hash-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-microsoft-365-isolate-change-passwords-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/review-remediation-actions-action-center-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-mfa-denied-incident-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-powershell-detection-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-custom-hunting-query-microsoft-sentinel-methods-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/improving-analytics-rule-precision-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lateral-movement-hunting-kql-operators-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-graph-attack-visualization-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-log-ingestion-azure-monitor-agent-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-email-detection-joinevents-attachment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/windows-security-events-ama-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/apt-hunting-lolbins-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-data-connectors-microsoft-365-audit-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/email-attachment-hash-hunting-microsoft-sentinel-datasource-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/fix-custom-detection-rule-inactive-devices-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-automation-required-components-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-jupyter-notebook-threat-hunting-setup-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/initial-ransomware-containment-steps-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-lateral-movement-rdp-interactive-logon-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-phishing-email-recipients-threat-explorer-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-duplicate-incidents-lookback-duration-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-defender-for-sql-sql-server-iaas-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/examine-sign-in-logs-compromised-token-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-dcount-distinct-destinations-outbound-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-incident-grouping-sentinel-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-automation-not-triggering-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/impossible-travel-detection-signinlogs-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/email-timeline-section-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-replication-multi-region-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-automated-incident-escalation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/trigger-playbook-on-high-severity-incident-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/minimize-false-positives-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mitre-attack-mapping-sentinel-analytics-rules-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/tune-pass-the-hash-detection-exclude-jump-boxes-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identify-top-source-ips-by-total-bytes-exfiltrated-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enrich-incidents-threat-intelligence-connectors-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-sender-email-air-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enforce-just-in-time-vm-access-policy-initiative-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/attacker-techniques-bypass-security-controls-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/configure-long-term-retention-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-custom-role-responder-base-incidents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-summarize-bin-time-window-aggregation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-disable-compromised-user-sentinel-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sharepoint-session-control-prerequisite-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-playbook-components-required-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cis-benchmark-compliance-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/centralized-incident-management-multiple-workspaces-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/unified-secure-score-multiple-subscriptions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/windows-security-events-ama-connector-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/retain-security-events-cost-optimization-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-initiative-compliance-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-defender-office-365-incident-creation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/isolate-device-forensic-preservation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/adaptive-application-controls-block-script-execution-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/viewing-email-content-attachments-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-ueba-configuration-requirements-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/log-retention-and-archiving-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-attacker-ip-all-devices-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lolbin-execution-parent-process-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-playbook-disable-user-account-incident-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-lateral-movement-rdp-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-apps-activity-policy-exfiltration-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/correlate-user-activity-across-services-identitylogonevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-dns-queries-from-device-devicenetworkevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/advanced-hunting-tables-authentication-events-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-sentinel-analytics-rule-threshold-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-not-created-defender-for-cloud-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-suspicious-ip-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-sources-lateral-movement-azure-environment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rules-close-incidents-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/remediate-missing-security-updates-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-join-operator-baseline-comparison-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/phishing-emails-delivered-defender-office-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-playbook-block-user-graph-api-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-email-not-blocked-defender-office-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-summarize-function-custom-detection-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lateral-movement-securityevent-devicenetworkevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-microsoft-sentinel-cost-while-maintaining-coverage-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/authentication-across-multiple-applications-data-source-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/consolidated-security-recommendations-across-subscriptions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-investigation-high-severity-alert-mde-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/live-response-collect-powershell-scripts-endpoints-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/query-outbound-network-connections-device-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sync-defender-xdr-incidents-to-sentinel-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suspicious-powercli-exchange-server-defender-identity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detecting-lsass-memory-access-credential-theft-event-4656-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/arm-template-saved-search-analytics-rule-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/workload-protection-supported-resources-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/upload-custom-threat-intelligence-indicators-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-automation-rule-missing-triggers-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/filter-log-ingestion-data-collection-rules-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-protection-asr-rule-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-sender-all-mailboxes-air-office-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/high-severity-incidents-blade-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/optimize-kql-bag-unpack-performance-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/deviceprocessevents-command-line-arguments-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/missing-security-updates-secure-score-category-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-built-in-roles-responder-reader-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/process-chain-detection-kql-processchain-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-data-source-on-prem-authentication-events-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-threat-intelligence-sources-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-memory-dump-collection-sentinel-mde-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/phishing-email-hunting-threat-explorer-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatic-vulnerability-assessment-deployment-azure-policy-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/brute-force-rule-not-triggering-join-order-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-investigation-device-isolation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/valid-investigation-actions-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/advanced-hunting-endpoint-alert-correlation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/global-administrator-required-actions-microsoft-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-playbook-permissions-role-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/live-response-check-malware-remnants-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/assigning-incident-ownership-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/unified-incident-creation-multiple-products-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/start-mpscan-microsoft-defender-endpoint-antivirus-scan-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-brute-force-disabled-accounts-sentinel-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azurediagnostics-table-application-gateway-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-ueba-anomalies-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-sentinel-windows-security-events-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-sign-ins-from-same-ip-aadsignineventsbeta-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/assign-azure-security-benchmark-management-group-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-trigger-type-misspelling-issue-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/c2-communication-detection-devicenetworkevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-rbac-scope-override-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-defender-cloud-connector-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-alert-fatigue-sentinel-grouping-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ueba-anomaly-privilege-escalation-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-xdr-automation-rule-incident-assignment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-components-trigger-conditions-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/copilot-for-security-in-sentinel-kql-summary-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-purview-compliance-features-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-xdr-unified-alert-queue-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/phishing-email-evidence-entity-page-mailbox-log-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-investigation-response-portals-microsoft-365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/dns-data-connector-sentinel-c2-domain-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-incident-latency-mdi-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/improving-beaconing-detection-sliding-window-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/powershellcommand-actiontype-deviceevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/increase-incident-severity-user-role-entra-id-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-defender-cloud-apps-policy-blocking-mode-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cross-domain-attack-correlation-event-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-endpoint-hacktool-threat-id-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/phishing-attack-response-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-enable-defender-plans-new-subscriptions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/purview-ediscovery-unified-investigation-m365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suppress-false-positive-alerts-defender-xdr-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-brute-force-azure-sql-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/device-process-events-table-malware-execution-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-change-incident-status-new-active-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-analyze-user-reported-phishing-incident-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/token-manipulation-detection-event-id-4672-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/anomalous-lsass-access-credential-dumping-hunt-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-join-key-mismatch-lateral-movement-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sign-in-log-authentication-requirement-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/syslog-connector-dcr-misconfiguration-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/view-vulnerability-assessment-findings-defender-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-step-incident-response-triage-m365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-365-defender-roles-permissions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-reader-cannot-run-kql-queries-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunting-query-user-service-principal-correlation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/query-email-attachment-hashes-microsoft-365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-automation-rule-assign-severity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/improve-incident-response-copilot-automation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identify-authentication-type-azure-ad-signin-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-malicious-ip-custom-network-indicator-mde-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/alert-suppression-threshold-custom-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suppressing-alert-noise-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-investigation-actions-view-entities-incidents-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-incident-management-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-indicators-threat-hunting-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-details-page-alerts-tab-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/tables-authentication-events-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-responder-role-triage-analytics-rules-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cross-tenant-advanced-hunting-multi-tenant-ioc-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatically-isolate-compromised-vm-playbook-logic-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/global-administrator-role-actions-microsoft-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/rdp-lateral-movement-detection-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/missing-time-filter-sentinel-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-threat-hunting-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/remediate-malware-after-device-isolation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/bandwidth-efficient-log-ingestion-ama-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/valid-log-ingestion-methods-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-macro-attachments-safe-attachments-policy-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-beaconing-pattern-kql-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-malformed-data-ingestion-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/air-unsupported-windows-10-ltsc-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/respond-to-compromised-device-microsoft-365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ipv4-lookup-function-error-hunting-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-suspicious-sign-in-incident-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-for-script-hash-across-devices-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/playbook-steps-automated-incident-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/manage-defender-cloud-apps-roles-entra-id-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-response-privileged-container-aks-investigate-alert-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ingest-aws-cloudtrail-logs-sentinel-s3-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-firewall-manager-global-deny-rule-block-ip-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rules-incident-trigger-playbooks-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detecting-security-log-clearing-event-id-1102-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-analytics-rule-not-generating-incidents-configuration-sc-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-hunting-steps-microsoft-365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatic-remediation-deployifnotexists-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/dcsync-attack-indicators-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/playbook-execution-microsoft-defender-xdr-incidents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-assign-incident-owner-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/using-time-window-in-kql-joins-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lateral-movement-detection-data-sources-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-operators-lateral-movement-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-investigation-package-defender-for-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/file-entity-page-microsoft-365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-join-issue-brute-force-failed-successful-logons-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ai-driven-incident-classification-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ingest-purview-dlp-alerts-into-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/deviceprocessevents-table-process-creation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/assign-roles-manage-incidents-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-consent-phishing-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-sources-for-sentinel-incident-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/set-sentinel-table-retention-powershell-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/use-incident-management-collaboration-comments-severity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-conditions-severity-unassigned-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-incident-deduplication-grouping-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-alert-grouping-configuration-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/viewing-url-click-verdict-details-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/urlclickevents-table-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-suspicious-sign-in-token-theft-review-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/interpret-kql-sentinel-analytics-rule-process-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-compromised-device-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ingest-logs-from-non-azure-vm-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-failed-signin-time-range-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-sign-ins-same-ip-aadsignineventsbeta-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/arm-template-saved-search-log-analytics-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/teams-data-exfiltration-dlp-reports-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-role-view-incidents-run-playbooks-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/query-rdp-logon-events-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-ueba-anomalies-before-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-playbook-on-incident-creation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ueba-prerequisites-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/pass-the-hash-indicator-ntlm-authentication-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-monitor-agent-security-incident-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mdi-alerts-missing-sentinel-license-issue-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-syslog-connector-connected-no-events-dcr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-365-defender-roles-permissions-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cross-workspace-queries-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-contributor-cannot-create-rule-lock-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-monitor-incident-response-times-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/modify-kql-severity-filter-include-multiple-values-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auditlogs-table-role-assignment-changes-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/email-exfiltration-investigation-tables-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/scheduled-analytics-rule-custom-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kerberoasting-detection-event-ids-4769-4624-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-ueba-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-external-file-sharing-teams-dlp-reports-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/set-azsentinelsetting-cmdlet-not-exist-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/check-known-malicious-ips-sentinel-threatintelligence-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/monitor-incident-response-times-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-golden-ticket-attacks-securityevent-4769-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/configure-auto-provisioning-log-analytics-agent-defender-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-exfiltration-activity-anomaly-defender-for-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/evidence-sources-microsoft-sentinel-incidents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-defender-for-containers-aks-acr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-summarize-count-outbound-connections-alert-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-classify-incident-true-positive-ioc-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kerberoasting-detection-identityqueryevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-lookup-and-join-operators-threat-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/deploy-microsoft-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/soft-delete-phishing-email-user-report-action-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/adjusting-time-range-for-failed-sign-in-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/remediate-phishing-emails-defender-office-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/valid-microsoft-sentinel-data-connectors-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-portal-logon-events-sentinel-aadsignineventsbeta-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-xdr-incident-queue-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/view-security-recommendations-defender-for-cloud-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-severity-high-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-compromised-azure-vm-network-isolation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-inner-join-requires-high-risk-sign-in-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-policy-enable-microsoft-defender-for-cloud-new-subscriptions-sc-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/native-incident-management-features-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-alerts-tab-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kerberoasting-detection-kql-query-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/respond-kerberos-attacks-defender-identity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cross-workspace-query-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/playbook-execution-failure-sentinel-automation-rule-permissions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-and-use-watchlist-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/scheduled-task-creation-lateral-movement-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/view-missing-security-updates-recommendations-dashboard-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/configure-device-groups-automated-investigation-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-o365-auto-remediate-bypassed-phishing-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lateral-movement-detection-failed-logon-events-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-memory-dump-sysinternals-crash-dump-tool-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-custom-hunting-queries-sentinel-methods-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-playbook-permissions-required-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-user-reported-phishing-incident-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/securityincident-table-query-incidents-per-subscription-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detecting-pass-the-hash-with-event-id-4624-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-ueba-false-positives-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-suspicious-powershell-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-purview-compliance-features-matching-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-data-connector-health-incidents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-incident-severity-highest-alert-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-incident-response-actions-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-malicious-ip-watchlist-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-script-based-c2-communication-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-investigation-response-phishing-emails-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mitre-attck-classification-automation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positive-alerts-custom-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-forensic-evidence-linux-azure-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-join-logon-rdp-lateral-movement-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/check-phishing-link-clicks-defender-office-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/validate-golden-ticket-attack-event-id-4769-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/emailevents-table-email-attachment-activities-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-endpoint-live-response-constrained-language-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-mitre-attack-hunting-framework-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-condition-unassigned-incidents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-features-purposes-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rule-trigger-configuration-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/post-incident-review-after-containment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-incident-classification-custom-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-automation-rule-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/remove-mailbox-forwarding-rule-first-step-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-automation-rule-powershell-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-action-compromised-user-account-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshooting-kql-query-no-results-non-existent-column-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-365-data-connectors-sentinel-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-join-operators-threat-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reducing-false-positives-single-logon-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-intelligence-sources-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enrich-incidents-threat-intelligence-watchlist-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-exfiltration-response-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mdi-suspicious-ldap-query-alerts-configuration-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-intelligence-indicator-types-ip-domain-hash-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/send-teams-message-incident-creation-automation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/playbook-device-id-format-issue-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-defender-for-containers-aks-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-assignment-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-provisioning-log-analytics-agent-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lateral-movement-detection-techniques-mde-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-kql-hunting-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/parent-process-id-column-deviceprocessevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/configure-incident-grouping-sentinel-scheduled-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-brute-force-attacks-sign-in-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-soar-components-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-hunting-hypothesis-components-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-ingestion-cap-basic-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-xdr-defender-for-cloud-apps-integration-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-step-data-exfiltration-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/compromised-user-account-response-microsoft-entra-id-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/fix-sentinel-automation-rule-missing-triggers-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-same-attachment-name-join-email-events-attachment-info-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/initial-ransomware-containment-disable-accounts-isolate-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mitre-attack-tactics-mapping-analytics-rules-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/securityincident-table-not-available-sentinel-logs-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/correlate-cross-source-events-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-investigation-package-after-isolation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-vulnerability-scanning-defender-for-servers-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-collection-rule-not-associated-vm-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cross-workspace-querying-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ingesting-on-premises-dns-logs-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-minimize-cross-region-data-costs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mdi-alerts-not-appearing-sentinel-connector-enabled-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lateral-movement-detection-devicenetworkevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/visualize-entity-relationships-investigation-graph-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/guest-configuration-vm-security-baselines-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-playbook-permissions-troubleshooting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-summarize-function-alert-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-compromised-user-account-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-cli-create-hunting-query-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/view-aks-security-alerts-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/extract-domain-dns-queries-kql-parse-url-function-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-log-schema-mismatch-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/fusion-technology-sentinel-multi-stage-attacks-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/encoded-powershell-false-positives-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-entity-path-ip-blocking-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/tune-analytics-rule-false-positives-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-rule-process-execution-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reducing-false-positives-hunting-queries-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-exfiltration-cloud-app-suspicious-activity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-vulnerability-assessment-azure-vms-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/exempt-vm-from-just-in-time-recommendation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cloud-apps-oauth-consent-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/email-entity-page-for-email-investigation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reference-watchlist-in-kql-query-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-defender-xdr-automated-investigation-response-capabilities-s-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/attack-surface-reduction-rule-block-executables-prevalence-age-trusted-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-sharepoint-anonymous-ip-cloudappevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-response-actions-microsoft-defender-xdr-2-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-golden-ticket-attacks-kerberos-encryption-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-emails-by-attachment-hash-emailattachmentinfo-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-condition-order-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suppress-security-recommendations-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-find-risky-users-sign-ins-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/verify-malware-remnants-live-response-session-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-ad-connector-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/quarantine-suspicious-emails-sentinel-incident-mdo-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rule-assign-owner-custom-property-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detecting-beaconing-patterns-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/use-incident-timeline-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-xdr-custom-detection-rule-multiple-devices-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ueba-not-generating-anomalies-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/valid-incident-types-microsoft-365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suppression-rules-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-severity-levels-microsoft-365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-playbook-not-triggering-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-malware-outbreak-microsoft-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mitre-attack-technique-powershell-base64-decoding-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/malware-outbreak-response-actions-endpoints-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-sharepoint-data-exfiltration-unmanaged-devices-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/entity-mapping-incident-creation-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/view-consolidated-alerts-incident-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/modify-kql-query-exclude-service-account-false-positives-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/krbtgt-password-reset-credential-theft-containment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-cost-optimization-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-empty-sentinel-query-results-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/deviceprocessevents-powershell-command-line-arguments-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-365-defender-workloads-descriptions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/modifying-analytics-rule-to-exclude-location-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-azure-ad-migration-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/unblock-false-positive-application-indicator-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/analytics-rule-not-firing-connector-issue-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/visualize-entity-relationships-investigation-graph-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-playbook-region-compliance-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-playbook-teams-connector-permissions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-office-365-air-requirements-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-summarize-count-operator-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/high-azure-resource-access-credential-theft-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-incident-investigation-graph-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/url-click-verdict-details-microsoft-365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-hunting-query-capabilities-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-rule-requirements-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatically-block-ip-address-playbook-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/unified-incident-queue-multiple-workspaces-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identifying-threat-type-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-has-operator-case-sensitivity-alertname-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-source-anomalous-outbound-traffic-azure-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-alerts-to-teams-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/minimum-role-copilot-summarize-incident-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identify-phishing-email-recipients-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/phishing-credential-harvesting-detection-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-sharepoint-data-exfiltration-baseline-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-portal-custom-rbac-incident-access-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-lolbin-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/deploy-cloud-app-security-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-analytics-rule-no-alerts-purview-information-protec-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-custom-detection-rule-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-bec-email-sign-in-correlation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-analytical-rule-alert-grouping-entities-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-analytics-rule-no-incidents-time-filter-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/respond-suspicious-kerberos-ticket-defender-identity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-waf-block-specific-ip-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-explorer-phishing-information-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/fix-playbook-teams-posting-permissions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-unusual-outbound-rdp-connections-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suspicious-logon-attempts-anonymizer-investigation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/unusual-authentication-patterns-detection-data-sources-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-custom-initiative-defender-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-features-analytics-rules-workbooks-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-incidents-from-defender-for-cloud-alerts-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/anomaly-detection-rule-type-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/disable-compromised-user-account-and-revoke-sessions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-user-suspension-cloud-apps-alert-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mde-advanced-hunting-process-execution-sha256-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-pass-the-hash-lateral-movement-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-join-logic-risk-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kerberos-golden-ticket-hunting-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-monitor-agent-vs-log-analytics-agent-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/disable-mailbox-automation-rule-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-c2-server-ip-firewall-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/monitoring-lateral-movement-azure-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rule-playbook-resource-id-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/configure-incident-grouping-to-avoid-duplicates-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/decode-powershell-script-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/live-response-collect-suspicious-file-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-severity-alert-noise-incident-creation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/configure-safe-links-policy-block-phishing-urls-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rules-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/phishing-click-chain-hunting-strategy-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-detection-rule-from-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-microsoft-defender-for-sql-advanced-threat-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/device-timeline-forensic-investigation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/allowlist-applications-adaptive-application-controls-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-playbook-teams-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-no-results-wrong-column-name-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-malicious-domain-phishing-click-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/assign-incident-owner-sentinel-automation-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-365-defender-email-notification-settings-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-management-features-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/fix-sentinel-analytics-rule-no-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-hunting-query-no-results-ti-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/preserve-evidence-m365-litigation-hold-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/successful-threat-hunting-program-components-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cross-tenant-incident-investigation-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positive-alerts-tuning-detection-logic-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-process-creation-command-line-ama-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/quarantine-suspicious-emails-incident-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigating-brute-force-attacks-sign-in-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lateral-movement-rdp-hunting-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-cloud-data-exfiltration-disable-account-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suppress-low-severity-incidents-known-ips-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/correlate-mdi-mde-alerts-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identify-attack-technique-powershell-from-office-macro-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/supported-data-sources-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/close-incident-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/linux-rsyslog-sentinel-ingestion-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-response-containment-steps-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigating-automated-incident-closure-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/advanced-hunting-table-credential-dumping-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/email-entity-page-detection-details-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-hunting-sedebugprivilege-lsass-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/using-incident-graph-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-summarize-operator-grouping-count-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-privileged-container-aks-alert-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-incident-creation-sentinel-data-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-assignment-by-tactic-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/send-custom-logs-function-app-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rule-send-email-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-enhanced-security-azure-vms-first-step-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-teams-message-incident-creation-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/aggregate-similar-powershell-commands-summarize-makelist-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-phishing-campaign-block-malicious-url-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-diagnostics-security-events-config-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/interpret-smb-connections-lateral-movement-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-intelligence-taxii-connector-sentinel-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-resource-graph-vulnerability-assessment-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-email-attachments-emailattachmentinfo-table-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-suspicious-login-kql-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-suspicious-powershell-activity-high-volume-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/use-entity-pages-user-context-investigation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/connect-non-azure-windows-server-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/dcsync-detection-query-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/deviceevents-browser-url-navigation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/secure-score-recommendation-category-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-cli-jmespath-query-syntax-error-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/scheduled-query-rule-multi-table-join-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-custom-detection-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-defender-for-sql-advanced-threat-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-detect-global-admin-role-assignment-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-data-residency-multi-region-cross-workspace-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-use-watchlist-sentinel-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/single-incident-view-across-workspaces-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-network-watcher-flow-logs-outbound-traffic-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/join-key-missing-deviceevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-explorer-phishing-data-office-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/multi-tenant-sentinel-azure-lighthouse-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/devicenetworkevents-outbound-connections-malicious-ip-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/unhealthy-agents-lookback-period-issue-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/handle-suspicious-email-attachment-report-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detecting-disabled-user-sign-ins-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-processes-live-response-defender-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-microsoft-sentinel-ingestion-cost-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-analytics-malware-campaign-reports-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/emailevents-emailpostdeliveryevents-zap-remediation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/improve-incident-response-efficiency-sentinel-automation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-ueba-prerequisites-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-leftanti-join-inactive-users-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-investigation-package-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/match-security-alert-descriptions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/isolate-compromised-azure-vm-defender-for-cloud-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-trigger-vs-alert-trigger-automation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-typo-ntlmssp-zero-results-troubleshooting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-suspicious-sharepoint-downloads-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/pass-the-hash-indicators-defender-identity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/alert-local-admin-group-changes-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/count-active-incidents-powershell-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-table-name-error-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/check-credential-compromise-after-phishing-click-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/app-governance-policy-block-suspicious-app-notify-user-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/anomalous-azure-resource-creation-detection-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ingest-threat-intelligence-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-unknown-credential-dumping-variants-lsass-patterns-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-data-exfiltration-defender-for-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-analytic-rule-anomalous-sign-in-location-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/devicefileevents-table-file-creation-events-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/customer-managed-keys-sentinel-workspace-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-credential-theft-privilege-escalation-ueba-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/prerequisites-automated-investigation-response-defender-office-365-sc-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/configure-defender-xdr-connector-incident-creation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/windows-security-events-ama-connector-domain-controller-connectivity-s-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-step-investigate-suspected-malware-mde-quick-scan-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/evidence-sources-sentinel-incident-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/use-incidents-blade-filter-high-severity-multiple-users-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ueba-required-data-source-entra-id-audit-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-grouping-configuration-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-condition-entity-type-account-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/advanced-hunting-trace-powershell-parent-process-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-id-2147723152-meaning-microsoft-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/view-entities-involved-in-sentinel-incident-entities-tab-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-alert-ingestion-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/multicloud-threat-detection-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-automation-rule-assign-defender-for-cloud-incidents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-portal-rbac-incident-access-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/full-isolation-mde-device-maintain-defender-connectivity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-rule-parent-child-network-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/supported-data-sources-microsoft-sentinel-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/required-components-automated-incident-response-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-ingestion-cost-basic-logs-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-reduce-false-positives-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-playbook-incident-trigger-evidence-collection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/retrieve-sentinel-data-external-analysis-api-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/search-child-processes-by-parent-kql-search-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-investigation-response-containment-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/advanced-hunting-tables-data-exfiltration-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-trigger-playbook-incident-creation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-action-credential-compromise-phishing-reset-password-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/nrt-rule-microsoft-sentinel-ransomware-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/advanced-hunting-table-process-events-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-policy-deploy-sentinel-data-connectors-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-ueba-user-entity-insider-threat-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-pass-the-hash-lateral-movement-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-exclude-system-account-operator-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-email-attachment-frequency-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rule-owner-permission-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-encoded-powershell-commands-process-name-variation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-investigation-graph-entities-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/remediate-compromised-email-account-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-response-malicious-emails-defender-office-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-policy-nsg-block-ips-logic-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/conditional-access-trusted-location-mfa-prompt-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-windows-security-events-ama-dcr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-incident-noise-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-user-suspension-playbook-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-email-data-exfiltration-exchange-online-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/indicators-compromise-apt-detection-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-download-acknowledgment-session-policy-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-incident-multi-view-cross-workspace-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-incident-response-playbook-contain-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-file-action-automated-investigation-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-incident-correlation-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enforce-incident-classification-closure-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/retain-incident-data-two-years-compliance-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mitre-attck-obfuscated-powershell-t1027-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/user-reported-phishing-automation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/respond-phishing-attack-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cross-workspace-incident-management-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-arm-template-nonexistent-table-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-purview-dlp-investigate-data-exfiltration-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-operator-match-ip-watchlist-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/assign-security-recommendations-owners-tags-defender-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-find-all-recipients-phishing-email-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-unusual-authentication-patterns-data-sources-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-provision-vulnerability-assessment-azure-vms-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-data-source-file-encryption-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/using-investigation-graph-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/multi-region-sentinel-cross-workspace-queries-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-malicious-commands-indicators-compromise-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-wrong-table-sentinel-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/deploy-log-analytics-agent-mde-azure-arc-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/group-alerts-into-incidents-sentinel-analytics-rules-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-golden-ticket-kerberos-attack-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/vulnerability-assessment-findings-remediation-steps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-automated-investigation-response-defender-identity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/domain-controller-smb-connections-normal-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-ueba-entity-insider-threat-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-case-function-severity-reclassification-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/dlp-external-sharing-incident-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-defender-xdr-automated-incident-response-features-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-directory-role-audit-logs-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-responder-role-permissions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ueba-azure-ad-signin-logs-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/count-active-incidents-powershell-sentinel-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suppress-false-positive-alerts-sentinel-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshooting-externaldata-sentinel-hunting-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/aggregate-failed-sign-ins-kql-summarize-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/malware-outbreak-investigation-packages-isolate-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/multi-workspace-incident-view-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-hunting-data-source-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-responder-role-permissions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/device-network-events-table-malicious-ip-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-compromised-azure-vm-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-policy-deny-sentinel-analytics-rules-based-on-role-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/credential-theft-correlation-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/conditional-access-location-include-exclude-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-dll-side-loading-threat-intelligence-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lookback-period-mismatch-sentinel-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-dns-tunneling-entropy-dga-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/analytics-rule-performance-optimization-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-ad-brute-force-multiple-users-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/pivot-entity-suspicious-sign-ins-ip-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/activity-policy-location-based-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sync-incidents-defender-xdr-sentinel-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sharepoint-file-downloads-kql-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-emails-attachment-hash-emailattachmentinfo-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sql-injection-alerts-sensitive-data-classification-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-playbook-intermittent-timeout-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/configuring-microsoft-sentinel-threat-hunting-ueba-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identitylogonevents-table-exchange-authentication-failures-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-response-defender-cloud-alerts-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/valid-ways-to-ingest-data-into-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-response-actions-microsoft-defender-xdr-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-automation-rule-close-incident-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/entity-type-lateral-movement-pass-the-hash-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/action-center-review-remediation-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-condition-business-hours-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ueba-anomalies-inactive-user-baseline-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rule-status-condition-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/bookmark-suspicious-events-sentinel-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-trigger-playbook-incident-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/session-policy-block-downloads-external-users-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-hunting-query-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-email-forwarding-rules-office-365-audit-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detecting-brute-force-attacks-kql-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-impossible-travel-cloudappevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/get-mpthreat-no-output-remediation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-microsoft-sentinel-workbook-not-displaying-data-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/dcount-function-brute-force-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-defender-for-containers-aks-steps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-copilot-for-security-minimum-license-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-response-compromised-user-playbook-graph-api-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-copilot-for-security-capabilities-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/essential-data-sources-lateral-movement-hunting-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-join-operator-azure-ad-sign-in-cloud-app-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-kerberos-alert-microsoft-defender-identity-timeline-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-apps-activity-policy-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-containment-preserve-forensic-data-microsegmentation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-severity-levels-microsoft-365-defender-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-syslog-with-azure-monitor-agent-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/dns-connector-custom-detection-c2-domain-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/copilot-security-incident-specific-details-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/handle-low-confidence-alert-defender-identity-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identify-powercli-abuse-exchange-server-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ueba-geographic-anomaly-behavioranalytics-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/pass-the-hash-indicators-microsoft-defender-identity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-sharepoint-data-exfiltration-unmanaged-device-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-device-isolation-with-approval-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshooting-externaldata-inaccessible-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rules-close-incidents-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/close-false-positive-incident-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/selective-device-isolation-microsoft-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/close-incident-false-positive-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-user-access-defender-for-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigation-graph-correlate-events-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/advanced-hunting-query-rapid-file-encryption-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-remove-phishing-email-defender-office-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ingest-non-microsoft-security-logs-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-defender-incident-sync-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-firewall-deny-inbound-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-trigger-limit-troubleshooting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/exempt-vm-from-just-in-time-recommendation-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/endpoint-protection-recommendation-purpose-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suppress-false-positive-alerts-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-exclude-system-account-operator-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/built-in-anomaly-detection-multiple-failed-logins-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/arm-template-saved-search-not-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/scr-file-smb-ransomware-pattern-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/disable-local-admin-account-guest-configuration-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/finding-rdp-connection-events-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-extendedproperties-ipaddress-key-mismatch-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/forensic-imaging-microsoft-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-entropy-dns-tunneling-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-response-credential-theft-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-365-defender-automation-level-investigation-closure-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshooting-analytics-rule-not-firing-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-exfiltration-response-microsoft-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/indicators-of-compromise-apt-detection-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/improve-secure-score-jit-vm-access-defender-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/invalid-table-reference-sentinel-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/impossible-travel-detection-signinlogs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/long-term-log-retention-sentinel-low-cost-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-alert-grouping-all-entities-match-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-process-hollowing-deviceprocessevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-automation-rule-assign-incident-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-create-permissions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automating-phishing-response-sentinel-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/emailevents-table-delivery-status-phishing-verdict-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-incident-priority-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-xdr-automation-rule-device-isolation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-lateral-movement-service-creation-network-connection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-assign-incidents-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-response-methods-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-playbook-resource-id-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/tune-analytics-rule-false-positives-exclude-ip-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/evaluate-analytics-rule-effectiveness-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/bi-directional-incident-sync-defender-xdr-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/connect-non-azure-windows-server-sentinel-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-alert-trigger-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/containment-phase-microsoft-incident-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-step-contain-privileged-account-breach-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lateral-movement-detection-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/check-anti-phishing-policy-malicious-sender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/devicenetworkevents-table-process-network-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-account-containment-playbook-on-alert-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/group-alerts-into-incidents-sentinel-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/common-threat-hunting-techniques-anomaly-detection-ioc-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatic-incident-assignment-by-tactics-severity-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-arm-template-daily-ingestion-cap-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suppress-low-severity-incidents-defender-for-cloud-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/tracing-process-outbound-connections-devicenetworkevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/assign-regulatory-compliance-initiative-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-summarize-where-sql-injection-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/email-sign-in-join-aadsigninevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/email-detection-details-section-delivery-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-apps-connector-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-basic-deployment-components-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/valid-forensic-evidence-collection-methods-microsoft-defender-xdr-sc-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-session-policy-application-automation-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatic-remediation-non-compliant-resources-deployifnotexists-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-fileless-malware-azure-arc-disable-network-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-credential-theft-krbtgt-reset-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-provision-vulnerability-assessment-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshooting-analytics-rule-not-generating-incidents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-threat-intelligence-sources-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/devicenetworkevents-network-connections-malicious-ips-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/check-credential-compromise-phishing-click-signin-events-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-ingestion-cost-basic-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-step-phishing-email-report-analysis-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-high-risk-shadow-it-app-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/devicenetworkevents-process-network-connections-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-explorer-email-campaign-management-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/allow-blocked-file-automated-investigation-indicator-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-analytics-rule-types-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-hunting-steps-advanced-hunting-microsoft-365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-detection-rule-no-alerts-filter-legitimate-services-sc-20-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/log-ingestion-methods-syslog-aws-azure-activity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/deploying-sentinel-analytics-rule-arm-template-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-investigation-microsoft-defender-xdr-three-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-defender-for-cloud-governance-rule-automatic-remediation-sc-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-sentinel-analytics-rule-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-response-first-steps-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-rule-microsoft-defender-xdr-advanced-hunting-threshol-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mailbox-forwarding-rules-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/selective-device-isolation-trusted-ips-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/invalid-automation-rule-action-type-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/view-incident-timeline-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/pass-the-hash-detection-microsoft-defender-identity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/query-directory-role-changes-m365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-watchlist-enrichment-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-ransomware-incident-preserve-forensic-evidence-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-analytics-rule-from-saved-search-arm-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/view-alerts-incident-timeline-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-provision-vulnerability-assessment-solution-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/anomalous-azure-operations-ml-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-graph-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-incident-tag-contains-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/anomaly-detection-new-country-login-make-set-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ingest-aws-cloudtrail-logs-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identify-data-exfiltration-azure-storage-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-defender-cloud-apps-monitor-mode-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatically-close-inactive-incidents-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-malicious-attachments-safe-attachments-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/emailevents-table-internet-message-id-phishing-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-unusual-ip-access-sensitive-document-cloudappevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-join-azure-ad-signin-cloud-apps-credential-theft-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mitre-attack-tactics-analytics-rule-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detecting-dns-tunneling-with-kql-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/correlate-user-activities-across-microsoft-365-services-identitylogone-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/dcsync-attack-indicators-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-sentinel-ingestion-costs-strategies-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/secure-score-dashboard-microsoft-defender-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/isolate-device-network-preserve-forensics-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/analytics-rule-invalid-column-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-hunting-process-defender-xdr-hypothesis-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-memory-dump-offline-server-mde-live-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/minimum-configuration-security-alerts-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/anomaly-detection-policy-multiple-failed-logins-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-kerberos-golden-ticket-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-apps-threat-hunting-techniques-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/jit-vm-access-rdp-alert-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/improve-low-frequency-beaconing-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-step-incident-triage-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/saved-search-to-scheduled-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rule-permissions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-policy-initiative-azure-security-benchmark-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reference-custom-log-table-kql-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ways-to-create-incidents-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lateral-movement-remote-service-creation-data-sources-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suppressing-alerts-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-microsoft-365-defender-connector-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cross-region-data-collection-sentinel-analytics-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatically-disable-user-account-sentinel-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/correlate-sharepoint-download-network-connections-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-m365-defender-data-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/view-security-recommendations-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-rule-frequency-lookback-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/air-soft-delete-user-reported-phishing-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/synchronize-defender-xdr-incidents-to-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/device-response-actions-microsoft-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kusto-query-language-operators-fundamentals-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identity-compromise-threat-hunting-data-sources-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-response-block-malicious-ip-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/analytics-rule-threshold-not-firing-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-analytics-rule-no-incidents-saved-search-misconfig-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-missing-cef-logs-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/phishing-macro-attack-identification-process-tree-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-impossible-travel-self-join-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/remediate-vulnerability-workaround-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-powershell-encoded-commands-processcommandline-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/token-manipulation-detection-event-id-4672-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-compromised-service-principal-key-vault-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-phishing-response-playbook-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/forensic-evidence-collection-tools-kape-memory-dump-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/credential-dumping-detection-event-id-table-mimikatz-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatically-assign-incidents-to-team-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-powershell-lateral-movement-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-consent-phishing-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-automation-phishing-response-exchange-online-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-rdp-connection-events-table-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/entra-id-audit-log-ingestion-requirements-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-summarize-operator-count-events-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-step-reviewing-alert-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-assignment-teams-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-apps-threat-hunting-techniques-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-missing-windows-events-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-assignment-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-network-traffic-data-sources-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/time-zone-issues-scheduled-analytics-rules-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/analytics-rule-suppression-no-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/advanced-hunting-rdp-logon-events-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/prerequisites-defender-cloud-connector-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/immediate-containment-privileged-account-compromise-disable-entra-id-s-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/correlate-defender-endpoint-office365-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-incident-user-reported-phishing-custom-tag-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/disable-user-account-containment-microsoft-entra-id-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/configure-cmk-log-analytics-workspace-before-ingestion-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reimage-malware-infected-device-backup-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/forward-defender-for-cloud-alerts-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-exfiltration-investigation-actions-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-alert-suppression-rule-test-vm-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ci-cd-for-sentinel-analytics-rules-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-unauthorized-access-unusual-workstation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-sentinel-hunting-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-xdr-rdp-lateral-movement-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-defender-plans-management-group-level-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/playbook-fails-microsoft-defender-xdr-incident-provider-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-investigation-package-mde-forensic-evidence-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatic-suspension-mass-download-anomaly-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-incident-escalation-automation-rule-sla-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-copilot-for-security-sentinel-requirements-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-automation-no-trigger-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-provision-vulnerability-assessment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/valid-incident-severity-levels-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ueba-data-processing-delay-sentinel-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-policy-not-evaluating-scope-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/unified-incident-queue-cross-workspace-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-memory-dump-live-response-memdump-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lateral-movement-detection-techniques-microsoft-defender-endpoint-sc-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/responding-sharepoint-data-exfiltration-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/just-in-time-adaptive-application-controls-fim-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/assign-nist-sp-800-53-initiative-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/log-retention-archiving-azure-storage-data-export-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/query-auditlogs-for-role-assignments-entra-id-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-set-severity-assign-owner-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/devicetvmsoftwarevulnerabilities-table-cve-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/scheduled-analytics-rule-event-grouping-alert-per-result-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-entity-mapping-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-dlp-incidents-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-mde-alerts-not-in-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-data-exfiltration-storage-account-azureactivity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-suspicious-kerberos-authentication-defender-identity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/playbook-missing-sentinel-trigger-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-condition-evaluation-creation-time-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-kerberos-golden-ticket-identitydirectoryevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identify-sensitive-data-access-purview-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-lateral-movement-smb-scheduled-task-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/malicious-oauth-app-hunting-cloud-app-security-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-compromised-exchange-server-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-incident-response-playbook-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-built-in-vulnerability-assessment-azure-vms-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-summarize-alerts-by-entity-severity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mde-alerts-not-appearing-sentinel-troubleshoot-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-management-features-microsoft-sentinel-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/close-sentinel-incident-true-positive-classification-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ingest-defender-cloud-apps-alerts-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/dcsync-attack-hunting-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mde-advanced-hunting-file-hash-all-locations-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collecting-file-via-live-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/containment-privileged-account-compromise-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/send-defender-cloud-incidents-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/isolate-compromised-azure-vm-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-policy-nsg-rule-denial-logic-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-indicators-block-urls-ips-mde-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/app-governance-policy-block-suspicious-app-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/deploy-sentinel-analytics-rule-arm-template-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-compromised-user-account-first-step-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mitre-attack-framework-hunting-actions-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-lateral-movement-service-creation-network-connection-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatically-block-user-microsoft-sentinel-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/securityincident-table-not-available-sentinel-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-365-defender-threat-explorer-phishing-investigation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-threat-hunting-essential-configuration-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lolbins-hunting-false-positives-certutil-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-access-from-banned-country-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/privilege-escalation-detection-kql-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-devices-by-process-hash-microsoft-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/syslog-ingestion-methods-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kerberoasting-detection-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/archive-logs-microsoft-sentinel-cost-reduction-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/tag-incidents-using-watchlist-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ingest-defender-for-cloud-alerts-to-sentinel-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/fix-defender-for-cloud-alerts-not-ingested-sentinel-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/group-alerts-into-incidents-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-management-roles-security-administrator-contributor-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-ransomware-incident-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-rule-no-incidents-devicetable-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-data-connectors-matching-data-sources-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-apps-integration-defender-xdr-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-native-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-dns-tunneling-mde-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-data-connector-logs-not-appearing-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-tables-azure-ad-role-assignment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/time-based-analysis-kql-operators-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/submitting-files-analysis-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/disable-suspicious-power-automate-flow-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-hunting-methods-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/anomalous-rdp-connections-lateral-movement-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/querying-lsass-handle-access-deviceevents-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/querying-alert-table-for-ip-history-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-summarize-operator-failed-logon-events-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-apps-activity-policy-block-ip-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/essential-elements-custom-incident-response-playbook-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-xdr-features-soc-management-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/common-iocs-threat-intelligence-feed-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-brute-force-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/add-soc-2-regulatory-compliance-defender-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatically-assign-incidents-automation-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-incident-priority-from-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-pass-the-hash-detection-exclude-jump-boxes-sc-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-vulnerability-assessment-azure-vms-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/visualize-attack-chain-incident-graph-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/zero-hour-auto-purge-zap-office-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/isolate-device-preserving-forensic-data-live-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-make-set-function-alert-correlation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/alert-grouping-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-sentinel-playbook-block-ip-failure-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-scheduled-analytics-rule-steps-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/tune-custom-analytics-rule-false-positives-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suspend-compromised-user-account-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-new-scheduled-tasks-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/isolate-compromised-azure-vm-network-security-group-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/persist-findings-as-iocs-threat-intelligence-feed-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-query-anomalous-azure-resource-creation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-defender-xdr-connector-incident-sync-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ueba-hunting-compromised-identities-three-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-compromised-user-account-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/immediate-containment-email-data-exfiltration-purview-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-unauthorized-cloud-storage-cloud-discovery-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/attack-simulation-training-phishing-prevention-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-playbook-trigger-conditions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ingest-defender-for-cloud-alerts-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/fix-auto-closing-incidents-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-advanced-hunting-query-zero-results-powershell-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-identity-view-only-role-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-cloud-apps-activity-policy-different-count-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-phishing-email-recipients-microsoft-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-log-ingestion-methods-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-runquery-action-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/revoke-compromised-session-token-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-step-investigate-suspected-malware-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/isolate-device-ransomware-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/correlate-endpoint-events-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-close-stale-incidents-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-creation-latency-mdi-to-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/valid-microsoft-sentinel-data-connectors-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azurehound-detection-data-source-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/filter-windows-events-dcr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detecting-kerberoasting-attacks-methods-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-mv-expand-case-sensitive-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kerberos-golden-ticket-hunting-kql-find-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/devicefileevents-query-created-deleted-files-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/session-policy-block-download-unmanaged-device-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-kql-logonprocessname-case-sensitive-ntlmssp-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/golden-ticket-detection-mdi-sentinel-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-rbac-override-resource-group-contributor-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identify-sensitive-data-access-microsoft-purview-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-response-investigate-before-contain-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshooting-kql-query-no-results-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-exfiltration-email-response-block-domain-legal-hold-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-cryptominer-linux-vm-azure-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-compromised-hybrid-account-immediate-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-country-ip-session-policy-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-remediate-vm-misconfigurations-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-suspicious-sign-in-entra-id-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-entra-id-protection-risk-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-operators-azure-ad-privilege-escalation-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/commonsecuritylog-malicious-ip-communication-threat-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-union-operator-combining-schemas-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-automation-sentinel-incidents-logic-apps-functions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/air-automated-actions-malicious-email-office-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/email-forwarding-exfiltration-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/filter-windows-events-xpath-ama-data-collection-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/playbook-ip-block-fault-incorrect-field-extraction-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identify-exposed-data-google-dorking-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ueba-privilege-escalation-anomaly-mass-role-assignment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/log-ingestion-bandwidth-azure-monitor-agent-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-service-creation-detection-rule-no-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/actions-from-incident-page-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enrich-ip-investigation-threat-intelligence-ueba-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-brute-force-high-risk-signins-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-incidents-from-defender-for-cloud-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-subquery-table-not-scalar-error-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-missing-incident-provider-condition-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/types-of-analytics-rules-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/match-defender-cloud-features-purposes-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/playbook-incident-assignment-teams-message-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-encoded-powershell-commands-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-from-defender-for-cloud-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-dcsync-attack-disable-compromised-account-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-rule-process-network-connections-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/deviceevents-powershellcommand-action-type-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunting-powershell-encoded-commands-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-analytics-rule-threshold-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/disable-compromised-user-automatically-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-specific-pua-custom-ioc-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-log-ingestion-cost-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/adaptive-application-controls-allowlist-apps-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/emailevents-emailpostdeliveryevents-zap-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-incident-escalation-teams-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-condition-status-new-active-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/confirm-lolbins-attack-advanced-hunting-devicenetworkevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-xdr-data-connector-incident-synchronization-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/compromised-user-account-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-process-hollowing-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/lateral-movement-remote-service-creation-data-sources-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-compliance-initiative-defender-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cef-connector-ama-generic-firewall-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/valid-syslog-ingestion-methods-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/analytics-rule-entities-array-parsing-failure-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/forward-legacy-firewall-logs-logstash-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/force-password-reset-revoke-sessions-microsoft-365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/valid-incident-types-microsoft-365-defender-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/isolate-compromised-device-c2-microsoft-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/correlate-defender-cloud-apps-endpoint-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/devicenetworkevents-columns-dns-tunneling-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-monitor-agent-sentinel-incident-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detecting-azurehound-usage-microsoft-sentinel-datasource-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-email-notifications-auto-resolved-filter-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suspicious-ldap-query-detection-mdi-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-dcsync-attacks-identitydirectoryevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-workload-protection-resource-types-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-automation-rule-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-features-incident-response-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-analytics-malware-campaign-report-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suspend-risky-user-activities-session-policy-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-ad-brute-force-data-sources-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mimikatz-credential-dumping-defender-identity-alert-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-missing-mdo-incidents-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-provision-log-analytics-agent-defender-for-cloud-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-enable-defender-plans-new-subscriptions-azure-policy-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/configure-mdi-sensor-domain-controller-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-enable-defender-plans-new-subscriptions-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-azure-vm-alert-live-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/entra-id-audit-logs-ingestion-requirements-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/earliest-malicious-file-detection-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-missing-mde-alerts-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/unified-compliance-score-custom-initiative-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-severity-filter-exclusions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/monitor-lateral-movement-pass-the-hash-mdi-account-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detecting-powershell-download-cradles-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-ransomware-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/restrict-compromised-user-sending-email-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-sentinel-anomalies-powershell-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-suspicious-scheduled-tasks-deviceevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-provision-log-analytics-agent-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-defender-advanced-hunting-email-events-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-cost-reduction-daily-cap-basic-logs-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-emails-by-sender-using-emailevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-insider-risk-data-deletion-retention-hold-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/non-microsoft-log-ingestion-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-severity-high-entity-user-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/escalate-incident-severity-privileged-role-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-threat-hunting-techniques-jupyter-livb-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-join-signinlogs-auditlogs-credential-theft-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cross-domain-attack-correlation-server-cloud-signins-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/add-trusted-ip-range-impossible-travel-false-positive-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-response-sentinel-logic-apps-functions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/signinlogs-table-ip-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-microsoft-sentinel-data-ingestion-cost-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-sources-lateral-movement-detection-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-exfiltration-file-transfers-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/analytics-rule-incident-creation-toggle-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-management-collaboration-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-alert-suppression-rule-defender-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-join-time-window-missing-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/respond-vulnerability-alert-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suppress-low-severity-recommendations-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/apply-defender-cloud-policy-all-subscriptions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-365-data-connectors-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mde-advanced-hunting-network-table-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/phishing-click-details-email-entity-page-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-data-exfiltration-sharepoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/security-reader-role-view-alerts-defender-for-identity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-workbook-triage-time-report-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/join-devicenetworkevents-to-see-ip-communication-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-detection-rule-file-process-cross-device-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-asr-rule-audit-mode-blocking-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-high-risk-shadow-it-app-first-step-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/watchlist-ipv4-is-in-range-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/emailevents-table-email-metadata-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-in-operator-microsoft-sentinel-watchlists-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/optimize-sentinel-workbook-query-performance-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-escalation-teams-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-subquery-returns-table-instead-of-scalar-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-ueba-baseline-requirement-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-threat-intelligence-indicator-table-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/triage-low-confidence-alerts-defender-identity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatically-close-alerts-when-incident-resolved-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rule-condition-order-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/close-incident-properly-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/deviceevents-browser-url-tracking-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-containment-action-live-response-mde-isolate-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshooting-false-positives-powershell-rule-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-lateral-movement-compromised-account-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/custom-initiative-regulatory-compliance-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/non-azure-vm-log-ingestion-methods-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/device-groups-air-scoping-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-cloud-alerts-missing-sentinel-plan-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/join-emailevents-aadsignineventsbeta-sender-ip-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/using-activity-log-login-anomalies-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/alert-rule-arm-template-microsoft-sentinel-purpose-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-enrichment-with-playbook-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-lateral-movement-compromised-credentials-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/filter-kql-query-by-severity-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-executables-desktop-smb-spread-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-playbook-not-triggering-ransomware-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-device-isolation-tampering-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-connectors-to-table-names-mapping-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/get-mpthreat-threat-status-blocked-execution-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/dcsync-detection-event-id-4662-mdi-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-sentinel-workbook-not-displaying-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cross-workspace-analytics-rules-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-hunting-process-sentinel-custom-queries-bookmarks-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/phishing-email-investigation-threat-explorer-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-summarize-identify-high-frequency-attack-ips-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-ueba-prerequisites-entra-id-p2-securityinsights-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-lighthouse-cross-workspace-incidents-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kerberoasting-hunt-kql-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-operators-time-series-anomaly-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-null-owner-no-results-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-sensitive-document-access-multiple-ips-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-vs-fusion-rule-incident-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/interpret-kql-query-alert-frequency-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-fileless-malware-azure-arc-server-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/purpose-alert-rule-sentinel-arm-template-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-compromised-account-disable-entra-id-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-scheduled-query-rule-cross-domain-correlation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/decode-base64-powershell-command-threat-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/phishing-email-investigation-first-steps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/credential-dumping-mimikatz-process-events-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/event-grouping-reopen-window-incident-suppression-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/on-premises-brute-force-detection-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/logic-app-403-managed-identity-permissions-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-dcount-distinct-ips-per-user-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-playbook-block-ip-azure-firewall-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-analytic-rule-brute-force-attack-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-user-added-sensitive-ad-group-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/key-considerations-threat-hunting-program-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-insider-risk-data-deletion-retention-hold-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-emails-by-sender-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/privilege-escalation-detection-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-malicious-ip-azure-firewall-all-resources-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/attack-simulation-training-phishing-prevention-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/review-entities-fusion-incident-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-just-in-time-vm-access-first-step-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-process-tree-microsoft-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-investigation-graph-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-automation-rule-trigger-limit-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigation-actions-microsoft-sentinel-incident-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/join-devicenetworkevents-deviceprocessevents-initiating-process-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detecting-encoded-powershell-commands-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-missing-mde-incidents-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automated-incident-response-features-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-session-policy-defender-cloud-apps-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/advanced-hunting-dcsync-attack-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-file-from-endpoint-live-response-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-playbooks-rules-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-azure-ad-privilege-escalation-role-assignment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/entity-pivot-from-ip-address-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/respond-ransomware-incident-microsoft-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-incident-assignment-severity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-dcsync-attack-disabling-account-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/living-off-the-land-attack-hunting-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-mailbox-compromise-phishing-remove-forwarding-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ueba-entity-type-compromised-credential-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-hunting-techniques-malicious-activity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/email-timeline-section-microsoft-365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/alert-policy-external-emails-attachments-untrusted-domains-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/device-isolation-first-action-c2-communication-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-reminders-escalation-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-kql-null-owner-field-no-results-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suspicious-kerberos-ticket-request-intent-defender-identity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-automation-rule-trigger-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-string-comparison-case-sensitive-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/minimum-role-enable-ueba-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-join-with-watchlist-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-apps-management-roles-security-administrator-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/remediate-non-compliant-resources-deployifnotexists-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/set-interactive-retention-730-days-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-oauth-app-permissions-microsoft-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-missing-windows-events-sentinel-log-analytics-agent-sc-20-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-response-actions-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-identity-sensor-installation-steps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/playbook-action-phishing-macro-block-file-hash-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/purview-ediscovery-cross-workload-security-investigation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-initial-containment-automated-investigation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-automation-rule-actions-assign-playbook-status-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sync-incident-closure-sentinel-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-anomalous-login-locations-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/adaptive-network-hardening-internet-exposure-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-impossible-travel-multiple-countries-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/advanced-hunting-table-suspicious-logon-events-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/minimum-role-copilot-security-incident-summary-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-c2-communications-data-sources-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigation-graph-pivot-ip-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-outbound-rdp-connections-devicenetworkevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-unusual-bulk-download-sharepoint-defender-cloud-apps-sc-20-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-threat-hunting-features-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/new-country-login-anomaly-kql-make-set-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cloud-discovery-log-processing-required-steps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/shadow-it-cloud-storage-exfiltration-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/session-replay-lateral-movement-azure-vms-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-join-key-mismatch-deviceid-devicename-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/respond-to-suspicious-mailbox-forwarding-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-hunting-program-design-considerations-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-brute-force-attack-azure-ad-signin-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-unknown-malware-behavioral-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/secure-score-definition-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/alert-local-admin-group-addition-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-permissions-modify-incidents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/on-premises-authentication-events-data-source-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-containment-microsoft-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-anomalous-heartbeat-count-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-sentinel-data-ingestion-cost-methods-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/user-reported-phishing-automated-analysis-mdo-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/analytics-rule-alert-per-result-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/jmespath-query-syntax-error-azure-cli-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/assign-sentinel-incident-owner-alert-title-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/group-related-alerts-incident-creation-rules-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/recover-suspended-user-account-false-positive-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/analytics-rule-change-management-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-custom-policy-initiative-azure-security-benchmark-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-ueba-microsoft-sentinel-prerequisites-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-case-sensitivity-detection-rule-troubleshoot-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/trigger-threshold-0-sentinel-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/querying-file-hash-across-devices-m365-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-incident-classification-types-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sedebugprivilege-abuse-hunting-microsoft-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/restore-user-after-playbook-false-positive-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-data-exfiltration-three-actions-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suppress-incidents-from-scanner-ips-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rule-entity-mapping-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/determine-unusual-ip-access-entity-timeline-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-investigation-graph-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-permissions-issue-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-geographic-anomalies-cloudappevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-step-unfamiliar-sign-in-incident-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-kql-top-incident-owners-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-arm-template-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/basic-kql-syntax-securityevent-filter-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identify-initial-ransomware-process-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/refine-single-logon-query-false-positives-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identify-c2-communication-devicenetworkevents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-investigation-graph-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/visualize-attack-chain-using-incident-graph-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/device-isolation-microsoft-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/preserve-mailbox-legal-hold-purview-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-ad-brute-force-data-sources-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detecting-pass-the-hash-lateral-movement-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-intelligence-indicator-types-descriptions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/forward-cloud-app-alerts-to-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/preventing-automatic-incident-closure-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/table-level-retention-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kerberoasting-spn-request-detection-query-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-trigger-creation-vs-update-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/collect-forensic-image-live-response-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-cloud-apps-revoke-session-compromised-account-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/join-devicenetworkevents-deviceprocessevents-rdp-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-obfuscated-scripts-encoded-commands-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/bec-investigation-join-emailevents-aadsignineventsbeta-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enabling-ueba-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-mimikatz-using-event-id-10-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-credential-theft-azure-resource-access-anomaly-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-hybrid-servers-azure-arc-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-lateral-movement-pass-the-hash-isolate-workstation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/configure-defender-xdr-incident-sync-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/interpret-kql-query-brute-force-detection-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-alerts-teams-automation-rule-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/set-up-microsoft-sentinel-microsoft-365-defender-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-mimikatz-process-accessed-event-id-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/adaptive-application-controls-enforce-prerequisite-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/track-average-triage-time-sentinel-workbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigating-security-alerts-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/threat-explorer-email-entity-view-office-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-dcsync-attack-disable-account-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/conditional-user-suspension-playbook-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/bookmark-suspicious-event-microsoft-sentinel-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-grouping-multiple-analytics-rules-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ransomware-incident-containment-steps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/arm-template-analytics-rule-resource-type-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-malware-outbreak-microsoft-defender-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rule-actions-execution-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-playbook-disable-user-account-graph-api-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/arm-template-apiversion-saved-search-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-time-based-operators-ago-between-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automate-incident-response-playbooks-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/conditions-automated-playbook-execution-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/live-response-command-list-processes-defender-for-endpoint-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-automatic-hunting-features-livestream-queries-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/data-exfiltration-detection-tables-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/isolate-device-defender-xdr-contain-malware-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mdi-alerts-sentinel-m365-defender-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-ad-connector-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-user-added-domain-admins-group-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/just-in-time-vm-access-rdp-alert-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mitre-attack-technique-tagging-issue-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/query-lsass-handle-access-advanced-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/debugging-kql-join-time-window-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/valid-data-ingestion-methods-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-kql-join-time-precision-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-missing-owner-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/evaluate-analytics-rule-effectiveness-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/on-premises-firewall-log-integration-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-functions-for-outlier-detection-threat-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ueba-anomaly-compromised-account-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-assignment-automation-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mde-data-source-malware-execution-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigation-graph-pivot-from-ip-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-ueba-false-positives-exclusion-list-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/common-iocs-threat-hunting-file-hashes-ip-addresses-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/refining-dns-query-hunt-exclude-internal-servers-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/golden-ticket-attack-validation-kerberos-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/trigger-conditions-scheduled-analytics-rule-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-monitor-agent-on-prem-sentinel-connector-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/vulnerability-assessment-missing-system-updates-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-self-join-for-lateral-movement-rdp-powershell-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-compromised-exchange-server-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-assign-ownership-tags-automation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/email-entity-page-phishing-investigation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/isolate-device-microsoft-defender-endpoint-threat-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/common-iocs-threat-intelligence-feeds-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/restrict-user-from-sending-email-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-limitation-delete-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-endpoint-deviceevents-scheduled-task-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/auto-classify-incidents-true-positive-ioc-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/add-indicator-allow-blocked-file-microsoft-defender-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rule-entity-path-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/disable-compromised-account-preserve-forensics-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-threat-hunting-process-custom-queries-bookmarks-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identitylogonevents-data-source-authentication-multiple-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-low-severity-incident-noise-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/understanding-kql-externaldata-limitations-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatic-incident-assignment-defender-xdr-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/activity-policy-file-download-threshold-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-failed-logins-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/mde-advanced-hunting-table-scheduled-task-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/adaptive-application-controls-enforce-prerequisites-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/contain-dcsync-attack-disable-account-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ueba-behavioranalytics-data-exfiltration-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-365-defender-incident-remediation-actions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/advanced-hunting-trace-powershell-parent-process-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/incident-response-verify-before-contain-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/failed-logon-anonymizer-ip-investigation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/synchronize-defender-for-cloud-alerts-and-assign-incidents-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-automation-rules-capabilities-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-investigation-response-ltsc-2019-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-mimikatz-credential-dumping-deviceprocessevents-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-incident-response-actions-assign-automation-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-defender-xdr-air-capabilities-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/anomalous-azure-operations-ml-analytics-rule-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/commonsecuritylog-threat-hunting-malicious-ips-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/azure-function-custom-logs-log-analytics-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/anti-phishing-policy-spoof-intelligence-office-365-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/microsoft-sentinel-arm-template-saved-search-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-automation-rule-incident-trigger-playbook-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/enable-defender-for-cloud-security-alerts-subscription-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/approve-analytics-rules-governance-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/devicelogonevents-table-rdp-logon-events-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/first-step-suspicious-sign-in-containment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/forward-on-premises-server-alerts-to-sentinel-azure-arc-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/create-dlp-policy-credit-card-alert-microsoft-purview-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/identifying-reverse-shell-scheduled-task-powershell-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/check-defender-xdr-connector-filter-settings-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-anomalous-sharepoint-downloads-officeactivity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/fix-kql-query-returns-no-results-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/optimize-sentinel-workbook-query-performance-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-suspicious-process-live-response-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/scheduled-tasks-persistence-devicetables-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-exclude-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/emailevents-table-email-delivery-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/find-rdp-connection-targets-compromised-device-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/playbook-trigger-configuration-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/multi-tenant-sentinel-azure-lighthouse-2-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/hunt-lateral-movement-custom-kql-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sql-injection-alerts-sensitive-data-defender-for-cloud-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/remove-phishing-email-threat-explorer-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/correlate-events-different-tables-join-time-window-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-anomalous-activity-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-native-tasks-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/investigate-data-exfiltration-defender-cloud-apps-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-actions-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/cloudappevents-table-file-access-events-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/correlate-phishing-click-process-execution-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/playbook-permissions-microsoft-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ensure-temporal-order-kql-join-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/valid-data-sources-microsoft-sentinel-threat-hunting-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/centrally-manage-incidents-multiple-workspaces-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-sentinel-data-connector-health-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-alert-noise-incident-creation-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/defender-for-cloud-apps-session-policy-block-downloads-unmanaged-devic-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/tables-privileged-role-assignment-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/reduce-false-positives-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/phishing-report-sentinel-incident-creation-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ingest-on-prem-dns-logs-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/suspicious-sign-in-alerts-wrong-table-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/kql-outlier-detection-functions-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ueba-data-processing-delay-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-workspace-manager-incident-replication-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-reader-role-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automated-incident-response-playbook-graph-api-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/email-notifications-high-severity-security-alerts-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/troubleshoot-playbook-permissions-managed-identity-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-arm-template-condition-syntax-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/network-traffic-threat-hunting-data-sources-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-alert-threshold-false-positives-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automatically-assign-incidents-based-on-severity-sentinel-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/search-across-multiple-sentinel-workspaces-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/detect-password-spraying-dcount-ipaddress-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/sentinel-automation-rule-change-incident-severity-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/ingest-custom-logs-microsoft-sentinel-methods-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/automation-rule-limitations-cannot-delete-analytics-rule-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/block-file-sharing-sanctioned-cloud-app-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
  <url>
    <loc>https://courseiva.com/questions/microsoft/sc-200/device-isolation-powershell-malware-containment-sc-200</loc>
    <lastmod>2026-07-10</lastmod>
    <changefreq>monthly</changefreq>
    <priority>0.80</priority>
  </url>
</urlset>