How do I check for backup missing for assets requiring it in Microsoft Sentinel?

Run the published KQL query on this page against Microsoft Sentinel / Log Analytics. It reads AssetInventory_CL (supplied), AddonAzureBackupJobs and reports: Asset declared as requiring backup has no successful backup within twice its recovery point objective.

NIST SP 800-53 Rev. 5 · Contingency Planning

CP-9 on Microsoft Sentinel

Backup missing for assets requiring it — a published KQL query you can run against Microsoft Sentinel / Log Analytics, with the evidence it needs, the settings you decide, and what a result does and does not establish.

Why this matters

A critical system whose backups have silently been failing

Backups are usually configured once and then trusted. A backup job that begins failing does so quietly, and the failure is typically discovered at the worst possible moment — during an attempted recovery after ransomware or hardware loss.

Why this check earns its place. It checks that backups actually succeeded recently, rather than that a backup was configured at some point.

What it reads: The organization's own backup job history, compared against its inventory of systems that require backup.
What it reports: Systems that require a backup and have no recent successful one.

See related public disclosures on the Signals page →

ControlCP-9 — System Backup

PlatformMicrosoft Sentinel (KQL)

SeverityHigh

ValidationNot tenant-validated

What this finds

Asset declared as requiring backup has no successful backup within twice its recovery point objective.

The requirement

The organization must conduct backups of user-level, system-level, and system documentation information at an organization-defined frequency, and protect the confidentiality, integrity, and availability of backup information.
NIST SP 800-53 Rev. 5 — CP-9 (System Backup).

NIST requires backups at a defined frequency. Which assets require backup, the recovery point objective per asset, and what counts as a successful backup are organization-defined — supplied through the asset inventory.

How this maps to the CISA performance goals

The Cross-Sector Cybersecurity Performance Goals are a voluntary baseline published by CISA — the U.S. federal agency for critical-infrastructure cybersecurity — written for organizations too small to employ security staff. This control speaks to:

3.O — Maintain system backups & restoration ability
The goal is maintaining backups; the pack finds assets that require one and do not have it.

See the full coverage map, including the goals no query can answer →

Evidence this query needs

Asset inventory `asset_inventory.csv`

Declares which assets are in scope and what is required of them. A backup that never ran on an asset you did not know existed produces no alert — absence of evidence is invisible without an inventory to compare against.

Minimum fields: asset_id, environment, criticality

Three fields let you scope the checks. The backup_required and logging_required flags are what make the absence checks possible — without them the tool cannot tell an asset that should be backed up from one that should not.

The query

Published as cp-9-backup-coverage.azure.kql. Reads AssetInventory_CL (supplied), AddonAzureBackupJobs. Requires: Log Analytics Reader.

Before this returns anything, AddonAzureBackupJobs has to be reaching Microsoft Sentinel / Log Analytics, and AssetInventory_CL (supplied) has to be landed there. If not, the query reports nothing found — which looks exactly like nothing wrong. What has to be switched on first →

// CP-9 -- assets requiring backup with no recent successful job
let DefaultRpoHours = 24;
let InScope =
    AssetInventory_CL
    | where TimeGenerated > ago(2d)
    | summarize arg_max(TimeGenerated, *) by AssetId_s
    | where tobool(BackupRequired_b) == true
    | extend RpoHours = toint(coalesce(toint(RpoHours_d), DefaultRpoHours))
    | project AssetKey = tolower(AssetId_s), AssetName_s,
              Criticality_s, Owner_s, RpoHours;
let Successful =
    AddonAzureBackupJobs
    | where TimeGenerated > ago(7d)
    | where JobStatus =~ "Completed"
    | summarize LastGoodBackup = max(TimeGenerated)
        by AssetKey = tolower(BackupItemUniqueId);
InScope
| join kind=leftouter Successful on AssetKey
| extend HoursSinceBackup = iff(isnull(LastGoodBackup), 9999,
                                datetime_diff('hour', now(), LastGoodBackup))
// grace of one full RPO interval before alerting
| where HoursSinceBackup > (RpoHours * 2)
| project AssetKey, AssetName_s, Criticality_s, Owner_s,
          RpoHours, LastGoodBackup, HoursSinceBackup,
          SourceSystem = "Azure Backup"
| order by HoursSinceBackup desc

Open this pack on Microsoft Sentinel to adjust the settings and download it →

The interactive version opens on Microsoft Sentinel — the platform on this page — even if your environment profile does not list it.

Settings you decide

NIST states the objective and leaves these to your organization. The interactive version of this pack applies them to the query for you.

RPO breach multiplier (default 2): An asset is reported once the time since its last successful backup exceeds its RPO multiplied by this factor.
Limit to specific assets (optional): Paste asset identifiers, one per line.

Running it continuously

Sentinel scheduled analytics rule

Rule type:        Scheduled query rule
Run frequency:    Every 6 hours
Lookup period:    Last 7 days
Trigger:          Number of query results > 0
Entity mapping:   AzureResource -> AssetKey
Severity:         High
Incident:         Create incident, group by Owner
Suppression:      12 hours per asset

The per-asset RPO from the inventory drives the threshold, so a four-hour-RPO finance database and a weekly-backup file share are both evaluated correctly by one rule instead of needing separate ones.

What a result does not prove

Absence of a backup job record does not establish that data is unrecoverable. It establishes that recoverability cannot be evidenced from the queried source — which for a resilience control is the question that matters at review.

Validation status for this platform: Not tenant-validated. Structure, query generation, and preflight are covered by the project's automated test suites. This pack has not been executed against a live tenant, account, or index. Validate it in a non-production scope before relying on any result.

Before you act on a result

Is the asset genuinely in scope, or is the inventory flag stale?
Is the asset protected by a mechanism this query does not read (snapshots, replication)?
Has the backup job been failing silently, or was it never configured?
When was the last successful restore test for this asset?

Common questions

How do I check for backup missing for assets requiring it in Microsoft Sentinel?: Run the published KQL query on this page against Microsoft Sentinel / Log Analytics. It reads AssetInventory_CL (supplied), AddonAzureBackupJobs and reports: Asset declared as requiring backup has no successful backup within twice its recovery point objective.
What permissions are needed to run this Microsoft Sentinel query?: Log Analytics Reader.
What evidence does CP-9 need that Microsoft Sentinel cannot produce?: Asset inventory (asset_inventory.csv). Declares which assets are in scope and what is required of them. A backup that never ran on an asset you did not know existed produces no alert — absence of evidence is invisible without an inventory to compare against. At minimum it must carry: asset_id, environment, criticality.
Does a result from this query mean the control has failed?: Absence of a backup job record does not establish that data is unrecoverable. It establishes that recoverability cannot be evidenced from the queried source — which for a resilience control is the question that matters at review.

Terms used on this page

NIST SP 800-53the U.S. federal catalogue of security requirements: The catalogue of security and privacy requirements published by the National Institute of Standards and Technology, a U.S. federal agency. U.S. government systems are measured against it, and many private organizations adopt it voluntarily. Each requirement has an identifier such as AC-2. Official source →
CISACybersecurity and Infrastructure Security Agency: The U.S. federal agency responsible for national critical-infrastructure cybersecurity. Its publications are works of the U.S. government and are free to use. Official source →
KQLKusto Query Language: The language used to ask questions of data held in Microsoft Sentinel. A query written in it is text, like a spreadsheet formula, and can be read before it is run.
CPGCross-Sector Cybersecurity Performance Goals: A voluntary baseline of security practices published by the U.S. Cybersecurity and Infrastructure Security Agency, written specifically for organizations too small to employ security staff. It is a short, plainly written starting list rather than a full standard. Official source →
RPOrecovery point objective: How much recent work an organization has decided it can afford to lose. A four-hour objective means backups must be recent enough that no more than four hours of work would be lost.
not tenant-validatednever executed against real data: The check has passed the project's automated tests for structure and syntax, but has never been run against real data anywhere. Test it in a safe scope before relying on any result.

Every term this project uses →

The same control on other platforms

CP-9 on AWS — SQL (Athena) + Lambda
CP-9 on Splunk — SPL
All platforms for CP-9