SC-200 decision sheets

• Sentinel analytics rule types: NRT vs Fusion vs TI vs ML Behavior
• Sentinel analytics tier vs data lake tier
• Automatic attack disruption: which product acts, by identity type
• DCR stream choice: Microsoft-CommonSecurityLog vs Microsoft-Syslog
• Sentinel data lake access: Entra roles vs Azure RBAC vs table scoping
• Defender for Endpoint response actions: isolate vs contain
• Which Defender portal surface for which response task
• KQL advanced hunting: arg_max, timespans and correlation joins
• Choosing the right Sentinel ingestion mechanism per source
• Automation rules vs playbooks for Sentinel response
• Purview Audit Standard vs Premium vs 10-year retention
• Purview investigation tools: audit log vs content vs Graph logs
• Sentinel Reader vs Responder vs Contributor vs Playbook Operator