Essential Eight AC-ML2.7 Event logs from internet-facing servers are analysed to detect cyber security events
What it says
Event logs from internet-facing servers are analysed in a timely manner to detect cybersecurity events.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishReview logs from internet servers quickly to spot any security issues.
This control is about regularly reviewing the logs from servers that are accessible from the internet to catch any signs of cyber attacks quickly. By doing this, organisations can spot suspicious activities early and respond before they cause serious harm, like stealing sensitive data or crashing their website.
Free. Save your status, tasks and notes.
Why it matters
If logs from internet-facing servers aren't analysed promptly, intrusions can go unnoticed longer, increasing data theft and service disruption risk.
How to implement
The IT team should ensure that all internet-facing servers are configured to record detailed event logs.
This can be done by setting up the server's logging features to capture key information such as login attempts and system alerts.
System administrators should set up automated alert systems to notify them of unusual activities.
This involves using software that analyses the logs in real-time and sends alerts when suspicious patterns are detected.
Security officers should regularly review these alerts and investigate any flagged events.
They can do this by checking the logs against known signs of data breaches, such as repeated failed login attempts or irregular access times.
The IT team should hold periodic training sessions for staff handling logs to ensure they know how to interpret them effectively.
This can be done through workshops or onboarding programs for new staff.
Keep it running
Centralise internet-facing server logs in a SIEM, set anomaly alerts, and review/investigate critical events daily to ensure timely detection.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
What processes are in place to analyse event logs from internet-facing servers?
- Check 2 of 3What an auditor asks for
Ask for
To see records of log review activities, including schedules and findings.
Good evidence
A detailed schedule of regular log reviews with documented summaries of findings and actions taken in response to flagged events.
- Check 3 of 3What an auditor asks for
Ask for
How are unusual events identified and responded to?
Look at
Request to see examples of alerts triggered by the logging system.
Good evidence
Logs show specific instances where alerts were generated, reviewed, and followed by appropriate responses such as adjusting security settings or conducting a deeper investigation.
Mappings
Closest match in ASD Information Security Manual: ISM-1906, Timely analysis of internet-facing server logs, which asks for the same thing.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.15.
E8-AC-ML2.7 requires timely analysis of event logs from internet-facing servers to detect cyber security events. Annex A 8.15 is broader, requiring organisations to produce, store, protect and analyse logs for activities, exceptions and faults across systems. E8-AC-ML2.7 maps to the analysis/detection portion but is narrower in scope (internet-facing servers) and does not explicitly cover log generation, protection, or retention.
This control partially meets A.8.16.
E8-AC-ML2.7 requires timely analysis of internet-facing server event logs to detect cyber security events. Annex A 8.16 is broader, requiring monitoring of networks, systems and applications for anomalous behaviour and taking actions to evaluate potential incidents. Log analysis of internet-facing servers is one monitoring method that supports Annex A 8.16, but the ISO control extends beyond logs and beyond internet-facing servers.
This control supports A.5.25.
E8-AC-ML2.7 requires timely analysis of internet-facing server event logs to detect cyber security events. Annex A 5.25 requires organisations to assess information security events and decide whether they constitute incidents. E8-AC-ML2.7 supports Annex A 5.25 by generating identified events and evidence through log analysis, but it does not itself define triage, categorisation, or decision-making processes.
ASD Information Security Manual: 7 mappings
This control is equivalent to ISM-1906.
E8-AC-ML2.7 requires event logs from internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1906 states the same requirement for timely analysis of internet-facing server logs for detection purposes. The scope, intent, and outcome (timely detection via log analysis on internet-facing servers) align closely.
This control partially overlaps ISM-1960.
ISM-1960 requires event logs from internet-facing network devices to be analysed in a timely manner to detect cyber security events. E8-AC-ML2.7 is closely related but focuses specifically on internet-facing servers. ISM-1960 has a broader device scope, covering additional network devices like firewalls and proxies.
This control partially overlaps ISM-1986.
E8-AC-ML2.7 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1986 requires timely analysis of event logs from critical servers, which will include some internet-facing servers but may also include internal critical assets. The overlap is in timely log analysis for detection, but each control defines its scope differently (internet-facing vs criticality-based).
This control supports ISM-0580.
ISM-0580 requires an organisation to develop, implement and maintain an event logging policy to ensure events are recorded and monitored. E8-AC-ML2.7 relies on that policy foundation to define expectations for collecting and reviewing logs from internet-facing servers to detect cyber security events. ISM-0580 is policy-governance focused, while E8-AC-ML2.7 is an operational detection activity with a specific scope (internet-facing servers) and timeliness requirement.
This control depends on ISM-0120.
ISM-0120 requires cyber security personnel to have the tools and data sources needed to monitor for indicators of compromise. E8-AC-ML2.7 requires timely analysis of event logs from internet-facing servers to detect cyber security events, which depends on log access and analysis tooling being provided to cyber security staff. E8-AC-ML2.7 is specific to a log source and analysis activity, while ISM-0120 is broader enablement across monitoring capability and data sources.
This control depends on ISM-1910.
ISM-1910 requires centrally logging internet-accessible network API calls that modify data or access non-public data. E8-AC-ML2.7 depends on that type of logging being available because it requires event logs from internet-facing servers to be analysed to detect cybersecurity events. Centrally logged API call records are a key input to that analysis. E8-AC-ML2.7 focuses on timely analysis/detection, whereas ISM-1910 focuses on ensuring the relevant API activity is captured centrally in the first place.
This control depends on ISM-1978.
E8-AC-ML2.7 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1978 requires security-relevant events for server applications on internet-facing servers to be centrally logged, which ensures the logs exist, are collected, and are accessible for review. Central logging in ISM-1978 is a practical prerequisite that enables the timely analysis demanded by E8-AC-ML2.7 at scale.
ASD Essentials for enterprise IT: 1 mapping
This control partially overlaps IT.DET-03.1.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-AC-ML2.7 requires timely analysis of internet-facing server event logs to detect cyber security events, the detection step before triage.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.