Microsoft Sentinel
Incidents from Microsoft Sentinel, plus analytics-rule coverage showing which ATT&CK techniques you can actually detect.
What CMDash reads
- Incidents & alerts
- Maturity telemetry
Syncs only read from Microsoft Sentinel. Some integrations also support write-back actions on Command and Enterprise plans, such as opening a ticket or deactivating a user.
How you connect
OAuth 2.0 through a CMDash-hosted app.
Once connected, CMDash syncs it every 4 hours by default. What it finds maps to your controls through rules you install or write.
Where this fits in your frameworks
- NIST AI Risk Management Framework 1.0 — Incidents & alerts feeds MEASURE
- NIST Cybersecurity Framework 2.0 — Incidents & alerts feeds Detect (DE)
- SOC 2 Type II — Incidents & alerts feeds Monitoring Activities
This is where Microsoft Sentinel’s data is documented as relevant on our framework pages — not a pre-built, automatic control mapping. You configure which controls it maps to inside CMDash.
Also in SIEM & Detection
Ready to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.