Essential Eight AC-ML3.5 Workstation event logs are promptly analysed for security events
What it says
Event logs from workstations are analysed in a timely manner to detect cybersecurity events.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishQuickly check workstation logs to find any security events.
Event logs are like a diary for your computers, recording everything that happens on them. By checking these logs quickly, we can spot any suspicious activity, like someone trying to break in. If we don't keep an eye on these logs, bad guys could sneak in and cause damage without anyone noticing.
Free. Save your status, tasks and notes.
Why it matters
Neglecting timely workstation log analysis can leave breaches undetected, enabling persistence, lateral movement and privilege escalation.
How to implement
IT Team: Ensure event logging is turned on for all workstations by enabling logging features through the operating system settings.
System Administrator: Set up an automated system to collect and consolidate logs from all workstations daily, so nothing gets missed.
Security Officer: Review significant log entries at least once a week to identify any unusual patterns or entries that could indicate a security breach.
IT Team: Implement alerts for specific keywords or activities in the logs, such as login failures or unexpected software installations, to act promptly on potential threats.
Keep it running
Centralise workstation event logs (e.g., to SIEM), alert on key events and review/triage within 24 hours with defined escalation.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Are workstation event logs being reviewed regularly?
Look at
Examine the records of log reviews and any responses to identified issues.
Good evidence
Evidence shows logs are reviewed weekly, with documented responses to any incidents.
- Check 2 of 2What an auditor asks for
Ask for
How are significant log events tracked and responded to?
Look at
Check the log management procedures and incident response records.
Good evidence
Organisation has a procedure in place that documents actions taken for all flagged events.
Mappings
Closest match in ASD Information Security Manual: ISM-0109, Timely analysis of workstation event logs, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.15.
E8-AC-ML3.5 requires workstation event logs to be analysed promptly to detect security events. ISO/IEC 27001:2022 Annex A 8.15 requires logs of activities and events to be produced, stored, protected, and analysed across the organisation's systems. The overlap is the analysis component, with E8-AC-ML3.5 representing a specific application of Annex A 8.15 focused on workstation logs and timeliness for detection.
This control partially meets A.8.16.
E8-AC-ML3.5 requires organisations to promptly analyse workstation event logs to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.16 requires monitoring networks, systems, and applications for anomalous behaviour and taking actions to evaluate potential incidents, which includes (but is not limited to) log-based monitoring. E8-AC-ML3.5 is a specific subset of this broader monitoring requirement, focused on workstation event logs and timely analysis.
ASD Information Security Manual: 6 mappings
This control is equivalent to ISM-0109.
ISM-0109 requires event logs from workstations to be analysed in a timely manner to detect cyber security events. E8-AC-ML3.5 contains the same requirement word for word as part of Essential Eight Maturity Level Three. Implementing one satisfies the other, although E8-AC-ML3.5 sits within the application control strategy, so the analysis would be expected to cover allowed and blocked execution events.
This control partially meets ISM-1228.
E8-AC-ML3.5 requires organisations to promptly analyse workstation event logs to detect cyber security events. ISM-1228 requires timely analysis of cyber security events to determine whether they constitute incidents, which can be informed by workstation log review. The overlap is that workstation log analysis under E8-AC-ML3.5 feeds the event analysis process in ISM-1228, but ISM-1228 is broader because it covers event triage/analysis across all sources, not just workstation logs.
This control partially meets ISM-1987.
E8-AC-ML3.5 requires workstation event logs to be analysed promptly to detect cyber security events. ISM-1987 requires timely analysis of event logs from security products, which can include endpoint/workstation security tooling (e.g., EDR/AV) but is not limited to workstations. The overlap is the shared requirement for timely log analysis for event detection, while ISM-1987 is broader by source type (security products generally) and E8-AC-ML3.5 is specific to workstation logs.
This control partially overlaps ISM-2125.
ISM-2125 requires that service provider access is independently logged and analysed in a timely manner to detect anomalous or unauthorised activity. E8-AC-ML3.5 relates because timely analysis of workstation logs can detect suspicious actions performed by service provider accounts or remote support tools on endpoints. ISM-2125 adds requirements for independence and tamper-resistance against the service provider and is scoped to service provider access, while E8-AC-ML3.5 is scoped to all workstation activity regardless of who performs it.
This control depends on ISM-1889.
ISM-1889 requires that command line process creation events are centrally logged. E8-AC-ML3.5 requires timely analysis of workstation event logs to detect security events. ISM-1889 provides a critical subset of workstation-relevant telemetry (process creation from the command line) that can be analysed to meet E8-AC-ML3.5, but E8-AC-ML3.5 expects analysis across broader workstation logging sources.
This control depends on ISM-2051.
E8-AC-ML3.5 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events. ISM-2051 requires software to generate sufficient event logs to support detection, which is a prerequisite for meaningful and effective workstation log analysis. Without the log generation coverage mandated by ISM-2051, E8-AC-ML3.5 cannot be reliably achieved because there may be insufficient workstation telemetry to analyse.
ASD Essentials for enterprise IT: 2 mappings
- IT.DET-02.2Deploy detection rules for unauthorised changes, anomalous authentication and suspicious software executionPartially overlaps
This control partially overlaps IT.DET-02.2.
IT.DET-02.2 requires detection logic for unauthorised changes, anomalous authentication activity and suspicious software execution; E8-AC-ML3.5 requires workstation event logs to be analysed in a timely manner to detect cyber security events, applying detection to workstations.
This control partially overlaps IT.DET-03.1.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-AC-ML3.5 requires workstation event logs to be analysed in a timely manner to detect cyber security events, feeding workstation events into that triage.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.