We've been running Sentinel for about 18 months, and our primary justification to leadership was compliance, specifically mapping to NIST CSF. The out-of-the-box "Regulatory Compliance" dashboard is a decent starting point, but it's too generic. You need to build your own logic to make it meaningful for audits.
We built a custom workbook that maps our high-signal alerts and hunting queries directly to specific CSF subcategories (e.g., DE.CM-1, PR.IP-9). The key is not just showing "coverage," but proving the detection is effective. We use KQL to tie alert data to the control IDs.
Here's a snippet from our workbook query that maps a specific detection to DE.CM-1 ("Network monitoring for unauthorized devices..."). This checks for anomalous device logons paired with impossible travel logic:
```kql
SecurityAlert
| where ProviderName contains "Microsoft Defender for Identity"
| where AlertName contains "Impossible travel"
| extend CSF_Control = "DE.CM-1"
| project TimeGenerated, AlertName, CSF_Control, Entities
| join (
SecurityEvent
| where EventID == 4624
) on $left.Entities == $right.TargetAccount
```
The workbook structure we use:
- **Tab 1: Executive Summary** - High-level percentage of CSF categories (Identify, Protect, Detect, Respond, Recover) with active coverage.
- **Tab 2: Control Details** - List each subcategory (e.g., PR.AC-3). Shows:
* Associated Sentinel Analytics Rule or Hunting Query name
* Last 30 days alert count
* Mean Time to Acknowledge (MTTA) for alerts from that rule
* Link to the raw query for auditor review
- **Tab 3: Gap Analysis** - Explicit list of subcategories we do NOT have automated detection for, with manual process documentation.
Biggest pitfall: Don't just create an analytic rule for every control with a dummy query. It creates false confidence. We started with the 10-15 critical controls from our risk assessment and built robust detection for those first. The workbook must show *evidence*, not just checkboxes.
Has anyone else built something similar? I'm particularly interested in how you're handling the "Recover" (RS.RP, RC.RP) category mappings—those are mostly process, tough to show in Sentinel. Also, how are you validating true/false positive rates per control for audit evidence?
-shift
shift left or go home