NIST SP 800-53 Rev. 5 · Configuration Management

CM-8 on Microsoft Sentinel

Device active in the estate but absent from the inventory — a published KQL query you can run against Microsoft Sentinel / Log Analytics, with the evidence it needs, the settings you decide, and what a result does and does not establish.

Why this matters

A device operating on the network that appears on no inventory

An organization cannot protect what it does not know it has. Devices arrive without going through any process — a contractor's laptop, a replacement machine, equipment from an acquired business — and they receive no updates, no monitoring, and no attention, because as far as every system of record is concerned they do not exist.

Why this check earns its place. It works from evidence of actual activity rather than from a scan, so it finds devices that are genuinely in use rather than addresses that happen to respond. New devices are given a grace period, so ordinary onboarding does not generate findings.

What it reads: Evidence of devices actually being used, compared against the organization's own inventory.
What it reports: Devices that have been active for longer than the registration period allows and appear on no inventory.

See related public disclosures on the Signals page →

ControlCM-8 — System Component Inventory

PlatformMicrosoft Sentinel (KQL)

SeverityHigh

ValidationNot tenant-validated

What this finds

A device generated authentication or platform telemetry, has been doing so for longer than the registration grace period, and does not appear in the supplied asset inventory.

The requirement

The organization must develop and maintain an inventory of system components that accurately reflects the system, is at the level of granularity deemed necessary for tracking and reporting, and is reviewed and updated at an organization-defined frequency.
NIST SP 800-53 Rev. 5 — CM-8 (System Component Inventory).

NIST requires the inventory to be accurate. It does not say what counts as a component, how quickly a new device must be registered, or which populations are exempt. This pack finds devices that are demonstrably active — they authenticated or generated telemetry — and are not in the inventory you supplied. The registration grace period and the exempt populations are yours to define.

How this maps to the CISA performance goals

The Cross-Sector Cybersecurity Performance Goals are a voluntary baseline published by CISA — the U.S. federal agency for critical-infrastructure cybersecurity — written for organizations too small to employ security staff. This control speaks to:

3.R — Prohibit connection of unauthorized devices
The goal is preventing unauthorized devices from connecting; the pack finds devices demonstrably active in the estate that the inventory does not list.
2.A — Manage organizational assets
Managing organizational assets requires the inventory to be accurate. This pack tests that accuracy directly, from the opposite direction: it finds what the inventory is missing.

See the full coverage map, including the goals no query can answer →

Evidence this query needs

Asset inventory `asset_inventory.csv`

Declares which assets are in scope and what is required of them. A backup that never ran on an asset you did not know existed produces no alert — absence of evidence is invisible without an inventory to compare against.

Minimum fields: asset_id, environment, criticality

Three fields let you scope the checks. The backup_required and logging_required flags are what make the absence checks possible — without them the tool cannot tell an asset that should be backed up from one that should not.

The query

Published as cm-8-unmanaged-devices.azure.kql. Reads AssetInventory_CL (supplied), DeviceInfo (Defender for Endpoint), SigninLogs. Requires: Log Analytics Reader.

Before this returns anything, DeviceInfo (Defender for Endpoint), SigninLogs have to be reaching Microsoft Sentinel / Log Analytics, and AssetInventory_CL (supplied) has to be landed there. If not, the query reports nothing found — which looks exactly like nothing wrong. What has to be switched on first →

// CM-8 -- devices active in the estate that the inventory does not list
// Requires the asset_inventory contract landed as AssetInventory_CL.
let ActivityWindow = 14d;
let GraceDays = 7;
let Registered =
    AssetInventory_CL
    | where TimeGenerated > ago(2d)
    | summarize arg_max(TimeGenerated, *) by AssetId_s
    | project AssetKey = tolower(AssetId_s);
// Two independent signals of a live device. Union rather than join: a device
// missing from the inventory will usually appear in only one of them.
let Observed =
    union isfuzzy=true
        (DeviceInfo
         | where TimeGenerated > ago(ActivityWindow)
         | project DeviceKey = tolower(DeviceName), Seen = TimeGenerated,
                   Signal = "endpoint telemetry"),
        (SigninLogs
         | where TimeGenerated > ago(ActivityWindow)
         | where isnotempty(DeviceDetail.displayName)
         | project DeviceKey = tolower(tostring(DeviceDetail.displayName)), Seen = TimeGenerated,
                   Signal = "interactive sign-in")
    | summarize FirstSeen = min(Seen), LastSeen = max(Seen),
                Signals = make_set(Signal) by DeviceKey;
Observed
| join kind=leftanti Registered on $left.DeviceKey == $right.AssetKey
// A device seen for the first time yesterday is a registration backlog, not a
// finding. The grace period is what separates the two.
| where FirstSeen < ago(GraceDays * 1d)
| extend DaysUnregistered = datetime_diff('day', now(), FirstSeen)
| project DeviceKey, FirstSeen, LastSeen, Signals, DaysUnregistered
| order by DaysUnregistered desc

Open this pack on Microsoft Sentinel to adjust the settings and download it →

The interactive version opens on Microsoft Sentinel — the platform on this page — even if your environment profile does not list it.

Settings you decide

NIST states the objective and leaves these to your organization. The interactive version of this pack applies them to the query for you.

Registration grace period (days) (default 7): A device is only reported once it has been active for this many days without appearing in the inventory. Zero reports every unregistered device immediately, including ones somebody is mid-way through registering.
Activity window (days) (default 14): How far back to look for signs that the device is live. Must exceed the grace period or nothing can ever qualify.
Exclude specific devices (optional): Paste device names to exempt, one per line — guest devices or ephemeral build agents.

Running it continuously

Sentinel scheduled analytics rule

Rule type:        Scheduled query rule
Run frequency:    Every 12 hours
Lookup period:    Last 14 days
Trigger:          Number of query results > 0
Entity mapping:   Host -> DeviceKey
Severity:         Medium
MITRE tactic:     Initial Access (T1200 Hardware Additions)
Incident:         Create incident, group alerts by Host entity
Suppression:      7 days per device

Suppressed for a week rather than a day: an unregistered device is a records problem somebody has to work through, and re-alerting every morning trains people to close it unread.

What a result does not prove

An unregistered device is not evidence of an intrusion, and this is the pack most likely to report a records problem rather than a security one. Identifier mismatches between telemetry and inventory produce the same result as a genuinely unknown device, which is why the review tier is automated-with-review rather than automated.

Validation status for this platform: Not tenant-validated. Structure, query generation, and preflight are covered by the project's automated test suites. This pack has not been executed against a live tenant, account, or index. Validate it in a non-production scope before relying on any result.

Before you act on a result

Is the inventory export complete and current, or does it cover only part of the estate?
Does the device use a different identifier in telemetry than in the inventory — a hostname against an asset tag, for example?
Is this an exempt population, such as a guest network or an ephemeral build agent?
Was the device registered under a name that has since changed?
If it is genuinely unmanaged, who owns it and what does it have access to?

Common questions

How do I check for device active in the estate but absent from the inventory in Microsoft Sentinel?: Run the published KQL query on this page against Microsoft Sentinel / Log Analytics. It reads AssetInventory_CL (supplied), DeviceInfo (Defender for Endpoint), SigninLogs and reports: A device generated authentication or platform telemetry, has been doing so for longer than the registration grace period, and does not appear in the supplied asset inventory.
What permissions are needed to run this Microsoft Sentinel query?: Log Analytics Reader.
What evidence does CM-8 need that Microsoft Sentinel cannot produce?: Asset inventory (asset_inventory.csv). Declares which assets are in scope and what is required of them. A backup that never ran on an asset you did not know existed produces no alert — absence of evidence is invisible without an inventory to compare against. At minimum it must carry: asset_id, environment, criticality.
Does a result from this query mean the control has failed?: An unregistered device is not evidence of an intrusion, and this is the pack most likely to report a records problem rather than a security one. Identifier mismatches between telemetry and inventory produce the same result as a genuinely unknown device, which is why the review tier is automated-with-review rather than automated.

Terms used on this page

NIST SP 800-53the U.S. federal catalogue of security requirements: The catalogue of security and privacy requirements published by the National Institute of Standards and Technology, a U.S. federal agency. U.S. government systems are measured against it, and many private organizations adopt it voluntarily. Each requirement has an identifier such as AC-2. Official source →
CISACybersecurity and Infrastructure Security Agency: The U.S. federal agency responsible for national critical-infrastructure cybersecurity. Its publications are works of the U.S. government and are free to use. Official source →
KQLKusto Query Language: The language used to ask questions of data held in Microsoft Sentinel. A query written in it is text, like a spreadsheet formula, and can be read before it is run.
CPGCross-Sector Cybersecurity Performance Goals: A voluntary baseline of security practices published by the U.S. Cybersecurity and Infrastructure Security Agency, written specifically for organizations too small to employ security staff. It is a short, plainly written starting list rather than a full standard. Official source →
not tenant-validatednever executed against real data: The check has passed the project's automated tests for structure and syntax, but has never been run against real data anywhere. Test it in a safe scope before relying on any result.

Every term this project uses →

The same control on other platforms

CM-8 on AWS — SQL (Athena) + Lambda
CM-8 on Splunk — SPL
All platforms for CM-8