Essential Eight AC-ML2.5 Allowed and blocked application control events are centrally logged
What it says
Allowed and blocked application control events are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure all application control events are logged in a central location for monitoring.
Imagine your computer as a secure building. This control acts like a guard keeping track of everyone allowed in or stopped at the door. By logging these events centrally, you can quickly spot if intruders are trying to get in or if something unusual is happening. Without this, dangerous software could sneak in unnoticed, putting your data and operations at risk.
Free. Save your status, tasks and notes.
Why it matters
Without central logging of application control events, suspicious activity could go unnoticed, leaving the organisation vulnerable to stealthy cyber attacks.
How to implement
The IT team should ensure that all application events, both allowed and blocked, are logged.
This can be done by configuring the application control software to send logs to a central logging system.
System administrators need to set up a central logging server.
They can do this by deploying software like a logging service on a secure server designed to collect and store logs from different systems.
IT staff should configure alert mechanisms.
They can set up the central log system to send alerts to the IT team when certain patterns, like repeated block attempts, are detected in the logs.
Security officers should review the central logs regularly for anomalies.
This involves analysing the logs to look for any unusual patterns or behaviours that might indicate a security breach.
IT support should ensure the central log storage is secure.
They can do this by setting permissions so only authorised personnel can access or modify log files, protecting them from tampering.
Keep it running
Configure application control to forward allowed/blocked events from all endpoints to a central log platform for alerting and investigation.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Can you show where application control logs are being stored centrally?
Look at
Examine the central logging server's configuration and logs collected.
Good evidence
The logs are consistently centralised on a secure server, and we can see entries for both allowed and blocked application events.
- Check 2 of 2What an auditor asks for
Ask for
How are these logs protected against unauthorised changes?
Look at
Check the access control settings on the log storage.
Good evidence
Access controls are in place, granting log access only to authorised personnel, with logs showing no unauthorised changes.
Mappings
Closest match in ASD Information Security Manual: ISM-1660, Central logging of application events, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.15.
E8-AC-ML2.5 requires organisations to centrally log allowed and blocked application control events. Annex A 8.15 requires producing, storing, protecting and analysing logs for a broad range of activities, exceptions and faults, which includes (but is not limited to) application control events. E8-AC-ML2.5 is therefore a specific subset implementation of the broader logging expectations in Annex A 8.15.
This control supports A.8.16.
E8-AC-ML2.5 requires organisations to centrally log allowed and blocked application control events. This supports ISO/IEC 27001:2022 Annex A 8.16 by providing a key telemetry source to monitor systems and applications for anomalous behaviour such as unexpected execution attempts or blocked binaries. Annex A 8.16 focuses on monitoring and response actions, whereas E8-AC-ML2.5 focuses specifically on ensuring the relevant events are centrally captured.
ASD Information Security Manual: 11 mappings
This control is equivalent to ISM-1660.
ISM-1660 requires that both allowed and blocked application control events are centrally logged. E8-AC-ML2.5 states the same requirement for central logging of allowed and blocked application control events. The scope and intent align closely, with no material differences in what must be logged or where it must be collected.
This control partially meets ISM-0670.
ISM-0670 requires security-relevant events for Cross Domain Solutions (CDSs) to be centrally logged for monitoring. E8-AC-ML2.5 relates by mandating central logging specifically for allowed and blocked application control events, which are a subset of security events a CDS environment may generate. E8-AC-ML2.5 is narrower because it is limited to application control events, while ISM-0670 is CDS-wide and not event-type specific.
This control partially overlaps ISM-1976.
ISM-1976 requires security-relevant events on Apple macOS systems to be centrally logged for monitoring. E8-AC-ML2.5 relates by requiring central logging of a specific subset of security events (allowed/blocked application control decisions) that could occur on macOS endpoints. ISM-1976 is broader and OS-specific (macOS) while E8-AC-ML2.5 is control-domain specific (application control) and not limited to macOS.
This control partially overlaps ISM-1977.
ISM-1977 requires security-relevant events for Linux operating systems to be centrally logged. E8-AC-ML2.5 specifically requires central logging of allowed and blocked application control events, which are a subset of security-relevant events that could occur on Linux hosts where application control is implemented. E8-AC-ML2.5 is event-type specific (application control) and not Linux-specific, while ISM-1977 is Linux-specific and broader across multiple Linux event categories.
This control partially overlaps ISM-1978.
E8-AC-ML2.5 requires organisations to centrally log allowed and blocked application control events. ISM-1978 requires central logging of security-relevant events for server applications on internet-facing servers, which can include application control outcomes where application control is enforced on those servers. ISM-1978 is broader on event types but narrower to a particular asset class (internet-facing servers), whereas E8-AC-ML2.5 is specific to application control events regardless of where they occur.
This control partially overlaps ISM-1979.
ISM-1979 requires security-relevant events for server applications on non-internet-facing servers to be centrally logged. E8-AC-ML2.5 relates by requiring central logging of application control allow/block events, which are a subset of security-relevant server events that may occur on servers. However, E8-AC-ML2.5 is limited to application control telemetry, while ISM-1979 is broader across server application security events on non-internet-facing servers.
This control partially overlaps ISM-1983.
ISM-1983 requires event logs to be sent to a centralised logging facility as soon as possible after they occur. E8-AC-ML2.5 requires allowed and blocked application control events to be centrally logged, and ISM-1983 supports this by ensuring those events are rapidly forwarded for monitoring and correlation. E8-AC-ML2.5 is narrower (application control events) and does not set the same explicit timeliness requirement as ISM-1983.
This control supports ISM-0580.
ISM-0580 requires an organisation to develop, implement and maintain an event logging policy to ensure events are recorded and monitored. E8-AC-ML2.5 specifies that application control allow/deny events are centrally logged, which is a concrete logging requirement that should be captured and driven by the policy in ISM-0580. ISM-0580 is broader and policy-oriented, while E8-AC-ML2.5 is a specific event source and centralisation requirement.
This control depends on ISM-0955.
ISM-0955 requires application control to be implemented using specific rule types (hash, publisher certificate, or path rules). E8-AC-ML2.5 requires centrally logging allowed and blocked application control events, which strengthens governance and monitoring of the application control implemented under ISM-0955. Logging does not implement the control mechanism itself, but it provides evidence and detection capability for the outcomes of ISM-0955 enforcement.
This control depends on ISM-0988.
E8-AC-ML2.5 requires central logging of allowed and blocked application control events to support monitoring and response. ISM-0988 requires an accurate and consistent time source for event logging, which is a prerequisite for making those centralised application control events trustworthy and correlatable during investigations. E8-AC-ML2.5 focuses on collecting specific application control events centrally, while ISM-0988 focuses on the integrity of timestamps across all logged events.
This control depends on ISM-1405.
E8-AC-ML2.5 requires allowed and blocked application control events to be centrally logged. ISM-1405 requires that a centralised event logging facility is implemented, which is the foundational capability needed to satisfy E8-AC-ML2.5 at scale. E8-AC-ML2.5 is specific to application control events, while ISM-1405 is a general prerequisite for central logging across event sources.
ASD Essentials for enterprise IT: 3 mappings
- IT.DET-01.2Forward high-value security logs and configuration changes to central log storagePartially overlaps
This control partially overlaps IT.DET-01.2.
IT.DET-01.2 requires high-value, security-relevant event logs from infrastructure, operating systems and applications to be forwarded to central log storage; E8-AC-ML2.5 requires allowed and blocked application control events to be centrally logged, a specific set of those logs.
- IT.DET-02.2Deploy detection rules for unauthorised changes, anomalous authentication and suspicious software executionPartially overlaps
This control partially overlaps IT.DET-02.2.
IT.DET-02.2 requires detection logic for unauthorised changes, anomalous authentication activity and suspicious software execution; E8-AC-ML2.5 requires allowed and blocked application control events to be centrally logged, which supports detecting suspicious software execution.
- IT.DET-04.1Continuously monitor software execution to detect malicious use of legitimate toolsPartially overlaps
This control partially overlaps IT.DET-04.1.
IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-AC-ML2.5 requires allowed and blocked application control events to be centrally logged, a source of execution data for that analysis.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.