ASD Essentials IT.DET-01.2 Forward High-Value Security Logs and Configuration Changes to Central Log Storage
What it says
Forward high-value, security-relevant event logs and configuration changes from infrastructure, operating systems and applications to a central log storage capability.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishSends key security logs and setting changes from network gear, servers, computers and apps to one central store.
Servers, network equipment, laptops and apps keep logs of who signed in, what ran and which settings changed. The organisation sends copies of the most useful security records to one central store soon after they happen. For example, a changed firewall rule shows up there too. To meet this, every relevant system sends its records. Regular checks confirm each one is sending, and that the records still help spot current attacks.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?ASD orders the work by domain: apply this action to each ticked domain, phase by phase.
- Phase 3
Why it matters
If logs stay only on the systems that create them, an intruder can clear them or switch logging off and leave no trail. Gaps and slow sending let unapproved changes and attacker activity go unnoticed.
How to implement
The security team should list every log source, using the asset inventory.
For each system, record the infrastructure, operating system and application events to send, such as sign-ins, admin actions and scripts running.
System administrators should turn on the logging each source needs and send its events, including every settings change, to the central store.
Build this into standard builds, such as server and laptop images.
The logging platform team should send events soon after they happen and agree a maximum delay with security operations.
Measure the delay, and hold events locally during outages so none are lost.
The security operations team should regularly compare the source list with the sources actually sending.
Alert when an expected source goes silent, and track each gap until it is fixed.
Detection engineers should review every log source on a set schedule against current reports of attacker techniques and lessons from incidents and exercises.
Record each decision, then add, change or retire sources in the list.
Keep it running
The logging team watches for expected sources that go silent, drop sharply in volume or send later than the agreed delay. It treats each as a fault or possible tampering. Extend coverage in ASD's priority order: internet-facing and sign-in systems first, then critical and admin systems, then business systems and staff devices. Make log sending a standard build step, and update the log source list whenever a system is added, changed or retired.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the log source list and sample systems in every ASD domain, from firewalls to laptops.
Look at
Whether each sample's infrastructure, operating system and application events reach central storage, or stay local.
Good evidence
Every relevant source across every ASD domain sends its high-value security events centrally.
- Check 2 of 5What an auditor asks for
Ask for
Ask to see the central log events for a sample of recent approved changes.
Look at
Whether change events arrive from some platforms but not others, or only some of the time.
Good evidence
Each sampled change, on infrastructure, an operating system or an application, appears centrally.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the latest check of expected sources against those actually sending.
Look at
Whether completeness is assumed rather than tested, and whether silent sources went unnoticed.
Good evidence
Every expected source is sending, and gaps are found quickly and tracked until fixed.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the agreed maximum delay and measured delays for sources in several ASD domains.
Look at
Whether sources upload in rare batches, or no delay limit is set or measured.
Good evidence
Events reach central storage within the agreed limit, soon enough to catch attacks in time.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the log source review schedule and the findings and decisions from recent reviews.
Look at
Whether reviews ran only after incidents or tool changes, or recorded no findings, decisions or follow-up.
Good evidence
Reviews run on schedule, use current threat reports, and each gap leads to a change.
ASD indicators of good practice (10)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(2)
- NE-1Security-relevant logs from assets are not forwarded to a central logging capability.
- NE-2High-value, security-relevant event logs or configuration changes from infrastructure, operating systems or applications are not forwarded.
Partially effective(4)
- PE-1High-value, security-relevant event logs are forwarded, but coverage gaps are identified or completeness has not been validated.
- PE-2Configuration change logs are forwarded inconsistently.
- PE-3The utility of security log sources is reviewed, but on an ad hoc basis rather than according to a defined schedule.
- PE-4Log forwarding is in place but latency is excessive for effective detection.
Fully effective(4)
- FE-1High-value security-relevant event logs and configuration changes from all relevant infrastructure, operating systems and application sources are forwarded to the central logging capability.
- FE-2Security log sources are reviewed at regular intervals to ensure their continued utility in detecting and responding to changing adversary techniques.
- FE-3Log completeness has been validated against the expected log sources.
- FE-4Logs are forwarded at a frequency that enables timely detection.
Mappings
Closest match in ISO/IEC 27001: A.8.15, Logging of Activities and Events, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.15.
IT.DET-01.2 requires high-value, security-relevant event logs and configuration changes from infrastructure, operating systems and applications to be forwarded to a central log storage capability. This is a specific implementation of the production and storage elements of Annex A 8.15, which requires logs of activities, exceptions, faults and other relevant events to be produced, stored, protected and analysed. Annex A 8.15 also covers the protection and analysis of logs but does not require them to be centralised.
ASD Essential Eight: 6 mappings
This control partially overlaps E8-AC-ML2.5.
IT.DET-01.2 requires high-value, security-relevant event logs from infrastructure, operating systems and applications to be forwarded to central log storage; E8-AC-ML2.5 requires allowed and blocked application control events to be centrally logged, a specific set of those logs.
- E8-AH-ML2.11Centrally log PowerShell module, script block, and transcription eventsPartially overlaps
This control partially overlaps E8-AH-ML2.11.
IT.DET-01.2 requires high-value, security-relevant event logs to be forwarded to central log storage; E8-AH-ML2.11 requires PowerShell module logging, script block logging and transcription events to be centrally logged, a specific set of those logs.
This control partially overlaps E8-AH-ML2.12.
IT.DET-01.2 requires high-value, security-relevant event logs from infrastructure, operating systems and applications to be forwarded to central log storage; E8-AH-ML2.12 requires command line process creation events to be centrally logged, one specific event type within that.
This control partially overlaps E8-MF-ML2.6.
IT.DET-01.2 requires high-value, security-relevant event logs to be forwarded to central log storage; E8-MF-ML2.6 requires successful and unsuccessful multi-factor authentication events to be centrally logged, a specific case of that forwarding.
This control partially overlaps E8-RA-ML2.6.
IT.DET-01.2 requires high-value, security-relevant event logs from infrastructure, operating systems and applications to be forwarded to central log storage; E8-RA-ML2.6 requires privileged access events to be centrally logged, one specific type of security-relevant log.
- E8-RA-ML2.7Centrally log privileged user account and security group management eventsPartially overlaps
This control partially overlaps E8-RA-ML2.7.
IT.DET-01.2 requires high-value, security-relevant event logs and configuration changes to be forwarded to central log storage; E8-RA-ML2.7 requires privileged user account and security group management events to be centrally logged, a specific case of that forwarding.
ASD Information Security Manual: 3 mappings
This control partially overlaps ISM-0585.
IT.DET-01.2 requires high-value, security-relevant event logs and configuration changes to be forwarded to central log storage; ISM-0585 requires each logged event to capture date and time, user or process, filename, description and IT equipment involved, defining their content.
This control partially overlaps ISM-1405.
IT.DET-01.2 requires high-value, security-relevant event logs and configuration changes to be forwarded to central log storage; ISM-1405 requires a centralised event logging facility to be implemented, the destination that forwarding relies on.
This control partially overlaps ISM-1983.
IT.DET-01.2 requires high-value, security-relevant event logs and configuration changes to be forwarded to central log storage; ISM-1983 requires event logs sent to a centralised logging facility to be sent as soon as possible after they occur, adding a timeliness requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.