Essential Eight AC-ML3.4 Event logs from non-internet-facing servers are analysed
What it says
Event logs from non-internet-facing servers are analysed in a timely manner to detect cybersecurity events.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishCheck server logs regularly to find security issues early.
Regularly checking the logs from servers that don't face the internet helps catch security problems early. It's like balancing your bank account: it ensures there are no unexpected surprises or threats lurking in your business systems.
Free. Save your status, tasks and notes.
Why it matters
Without timely analysis of event logs from non-internet-facing servers, lateral movement and insider activity may go undetected, delaying containment and increasing data loss.
How to implement
System administrator should schedule regular log analysis for non-internet-facing servers, perhaps weekly, to hunt for any unusual activity.
IT team should configure monitoring tools to flag suspicious activities in server logs automatically, allowing quick identification and action on potential threats.
Security officer should train staff on what to look for in server logs that might indicate a cyber security issue, ensuring a knowledgeable review process.
System administrator should ensure logs are stored correctly and securely so they can't be altered or deleted by unauthorised individuals.
IT team should use specific software to systematically parse and visualise log data so that trends and anomalies are easily identifiable.
Keep it running
Centralise and review event logs from non-internet-facing servers daily; baseline normal admin/activity patterns and alert on failed logons, privilege changes and suspicious process/service creation.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How often are the event logs from non-internet-facing servers analysed?
Look at
Review the schedule or policy document that outlines the log analysis frequency.
Good evidence
Logs are reviewed weekly as per the documented policy, with records or reports showing regular log analysis sessions.
- Check 2 of 2What an auditor asks for
Ask for
What methods are used to analyse these logs for cyber security threats?
Look at
Check the tools or software in use and any training records for staff conducting the analyses.
Good evidence
We use [specific tool] to automatically flag anomalies, and staff have received training on this process.
Mappings
Closest match in ASD Information Security Manual: ISM-1907, Timely analysis of non-internet-server logs, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.15.
E8-AC-ML3.4 requires timely analysis of event logs specifically from non-internet-facing servers to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.15 is broader, requiring logs to be produced, stored, protected and analysed across activities, exceptions and faults. E8-AC-ML3.4 is a specific subset implementation focused on a particular asset class and emphasising timely analysis rather than the full logging lifecycle.
This control partially meets A.8.16.
E8-AC-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.16 is broader, requiring monitoring of networks, systems and applications for anomalous behaviour and taking appropriate actions to evaluate potential incidents. E8-AC-ML3.4 is one concrete monitoring/detection mechanism (server event log analysis) within the wider monitoring scope of Annex A 8.16.
ASD Information Security Manual: 11 mappings
This control is equivalent to ISM-1907.
E8-AC-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1907 states the same requirement with the same asset scope (non-internet-facing servers) and the same detection objective (timely analysis to detect events). Implementing ISM-1907 would largely satisfy E8-AC-ML3.4 and vice versa.
This control is broader than ISM-1228.
E8-AC-ML3.4 requires timely analysis of non-internet-facing server event logs to detect cyber security events. ISM-1228 is broader, requiring cyber security events to be analysed in a timely manner to identify incidents, regardless of event source. E8-AC-ML3.4 is one source for such events.
This control partially overlaps ISM-1906.
E8-AC-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1906 is closely related but applies the same log analysis expectation to internet-facing servers instead. They overlap on the practice of timely log analysis for detection, but differ materially in asset scope (internal/non-internet-facing vs internet-facing).
This control partially overlaps ISM-1960.
E8-AC-ML3.4 requires timely analysis of event logs from non-internet-facing servers for cyber security event detection. ISM-1960 involves similar monitoring activities for internet-facing network devices. They overlap in detection through log analysis but differ in both exposure and technology type.
This control partially overlaps ISM-1961.
E8-AC-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-1961 requires timely analysis of event logs from non-internet-facing network devices, applying the same detection activity to a different infrastructure layer. They overlap on the analysis process and timeliness expectation, but differ in log sources (servers vs network devices).
This control partially overlaps ISM-1986.
E8-AC-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1986 requires timely analysis of event logs from critical servers, which may include both internet-facing and non-internet-facing systems depending on how 'critical' is defined. They align on timely analysis for detection, but differ in scoping criteria (exposure-based vs criticality-based).
This control depends on ISM-0580.
E8-AC-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-0580 requires an event logging policy to be developed and maintained, which typically defines what is logged, retention, protection, review frequency and responsibilities that underpin 'timely' analysis. Without policy direction per ISM-0580, E8-AC-ML3.4 may be inconsistently implemented, though E8-AC-ML3.4 is more operational and asset-specific than the policy requirement.
This control depends on ISM-1830.
E8-AC-ML3.4 requires organisations to analyse event logs from non-internet-facing servers in a timely manner to detect cyber security events. ISM-1830 ensures security-relevant events for key identity infrastructure (AD DS/CS/FS and Entra Connect) are centrally logged, which are commonly non-internet-facing servers and high-value detection sources. Central logging per ISM-1830 is a practical prerequisite to reliably performing the timely analysis expected by E8-AC-ML3.4 at scale, although E8-AC-ML3.4 applies to non-internet-facing servers beyond these specific AD components.
This control depends on ISM-1911.
E8-AC-ML3.4 requires organisations to analyse event logs from non-internet-facing servers in a timely manner to detect cyber security events. ISM-1911 supports this by ensuring software usage, errors and crashes are centrally logged, providing the raw log data needed for meaningful analysis. Without ISM-1911-style log capture/centralisation, E8-AC-ML3.4 analysis may be incomplete or ineffective, though E8-AC-ML3.4 extends beyond software error/usage logs to broader server event logging.
This control depends on ISM-2051.
E8-AC-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-2051 requires sufficient event log generation, which is a prerequisite for meaningful log analysis.
This control depends on ISM-2129.
ISM-2129 requires WMI activity, including creation of permanent event subscriptions, to be centrally logged. E8-AC-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cybersecurity events, and centrally collected WMI telemetry is a high-value input to that analysis (e.g. remote execution and persistence via WMI).
ASD Essentials for enterprise IT: 2 mappings
This control partially overlaps IT.DET-03.1.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-AC-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events, which supplies events for that triage.
- IT.DET-04.1Continuously monitor software execution to detect malicious use of legitimate toolsPartially overlaps
This control partially overlaps IT.DET-04.1.
IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-AC-ML3.4 (application control) requires timely analysis of event logs from non-internet-facing servers, a related detection duty.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.