CMMC 2.0

CMMC 2.0 Compliance Dashboard

Microsoft Sentinel & Defender KQL queries aligned to CMMC 2.0 practices build 2026-02-26 03:02 UTC

DoD CIO — CMMC • NIST SP 800-171 R2 • NIST SP 800-172 • 32 CFR § 170.14
134 Practices
15/134 With KQL (11%)
107 KQL Queries
14 Families
25 Log Tables
Browse
Validate Environment
Contribute

Validate Your Sentinel Environment

Four-step closed loop: generate the check query, run it in Sentinel, paste the results back here, and get a full coverage dashboard with Power BI & CSV exports.

1

Copy the validation query

This query checks all 25 tables referenced by the framework. It reports each table as Present or Missing along with the NIST controls that depend on it.


        

      


      

        2
        
Run in Sentinel & export CSV

        
Open Microsoft Sentinel → Logs blade → paste the query → click Run.

        Once results appear, click Export (top-right of results) → Export to CSV - All columns.

      


      

        3
        
Paste your results

        
Upload the CSV file, drag-and-drop it onto the box below, or paste the contents directly.

        

          
          or paste / drag-and-drop below
        

        
        

          
          
        

      


      

        4
        
Coverage Dashboard

        
Your environment coverage report, generated from the Sentinel results.


        


          

            
What do the colors mean?

            

              
Active
The table exists and has data flowing in the last 30 days. You're good.

              
Configured
The table exists but has no recent data. The connector is set up — you may just need to trigger the right activity or check the data flow.

              
Not Found
The table doesn't exist in your workspace. You need to enable the data connector for this source.

            

            
How is coverage calculated? Active + Configured = Covered. Only "Not Found" tables count as gaps.

          


          

            

              

                
                  
                  
                
                
--

              

              
Table Coverage

              

              

                
0
Active

                
0
Configured

                
0
Not Found

                
0
Total

              

            


            

              
Coverage by CMMC Family

              

            

          


          
Practice-Level Status

          
Each row is one NIST control. Covered = at least one data source is active or configured. The columns show which tables are working and which need attention.

          

            

              
                
ControlNameFamilyStatus● Active Tables● Configured Tables● Not Found

              
              
            

          


          


          

            
            
            
          

        

      

    

  







  

    
Contribute

    
Add, edit, or remove KQL alignments. When you submit, GitHub auto-forks the repo and creates a pull request for review — all in the browser.


    

      
Add

      
Edit

      
Remove

    


    
    

      

        

          
          
        

        

          
          
        

        

          
          
        

        

          
          
        

        

          
          
          M-21-31 function category
        

        

          
          
        

        

          
          
        

        

          
          
        

        

          
          
        

      


      
Preview

      
Fill in all required fields (*) to see the YAML preview...


      

        
      

    


    
    

      

        
        
      

      
Select the alignment to edit:

      

      
      
      

        
      

    


    
    

      

        
        
      

      
Select the alignment to remove: