Essential Eight AH-ML2.12 Command line process creation logging is centralised
What it says
Command line process creation events are centrally logged.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishLog all command line processes in a central location for monitoring.
This control is all about making sure that whenever something runs on a computer using a command line, a record of that action is saved in a central place. This is important because if something harmful were to happen, like a cyberattack or a virus, having these records helps us understand what's going on and how to fix it quickly.
Free. Save your status, tasks and notes.
Why it matters
Without centralised logging of command line process creation events, attacker-launched tools and scripts may not be detected or investigated in time.
How to implement
The IT team must ensure that all computers are set to log command line events.
This can be done by configuring the system to automatically send these logs to a central logging server.
System administrators should use group policy settings to enable command line process creation logging on Windows machines, making sure the settings apply to all relevant computers across the organisation.
The security officer should verify that the central logging system is capable of receiving logs from all networked computers by testing log transmission and reception regularly.
The IT team should implement automated alerts for unusual command line activities to promptly identify potential security incidents.
This can be done by setting up monitoring rules in the logging system.
Regular training sessions for the IT team are essential, focusing on identifying unusual patterns in the logs that could indicate a security threat.
This helps ensure the logs are effectively used for monitoring purposes.
Keep it running
Enable command line process creation logging on endpoints/servers and forward events to a central SIEM; validate coverage, retention and integrity (e.g. hashing) regularly.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Is command line process creation logging enabled on all computers?
Look at
Examine the group policy settings related to logging on Windows computers.
Good evidence
The group policy is set to log all command line process creation events, and these logs are being sent to the central logging system.
- Check 2 of 2What an auditor asks for
Ask for
How are the logs being reviewed for unusual activity?
Look at
Check the processes in place for monitoring log entries and the system for sending alerts.
Good evidence
Logs are automatically analysed, and the system sends alerts on detecting unusual activities, verified by recent test alerts for suspicious patterns.
Mappings
Closest match in ASD Information Security Manual: ISM-1889, Central logging of command line events, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.15.
E8-AH-ML2.12 requires that command line process creation events are centrally logged. Annex A 8.15 requires organisations to produce, store, protect and analyse logs of activities and other relevant events more generally. The primary control is a specific logging requirement that fits within the broader ISO logging control, but ISO also covers log protection and analysis beyond centralisation.
This control supports A.8.16.
E8-AH-ML2.12 requires command line process creation events to be centrally logged, providing visibility of execution behaviour across endpoints/servers. ISO/IEC 27001:2022 Annex A 8.16 requires monitoring networks, systems and applications for anomalous behaviour and taking actions to evaluate potential incidents. E8-AH-ML2.12 supports Annex A 8.16 by supplying a key telemetry stream for anomaly detection and investigation, but Annex A 8.16 includes broader monitoring and response actions beyond logging.
ASD Information Security Manual: 14 mappings
This control is equivalent to ISM-1889.
E8-AH-ML2.12 requires organisations to centrally log command line process creation events for monitoring and detection. ISM-1889 states the same requirement: that command line process creation events are centrally logged. The two controls align in scope (command line process creation) and the centralisation outcome, with no material difference in intent or depth.
This control partially meets ISM-0582.
E8-AH-ML2.12 requires centralised logging of command line process creation events to improve visibility of execution behaviour. ISM-0582 requires central logging of security-relevant events for Microsoft Windows operating systems, which commonly includes Windows process creation and command line auditing where configured. ISM-0582 provides the OS-level log source coverage that helps implement E8-AH-ML2.12 on Windows, but it is broader than command line process creation alone.
This control partially meets ISM-0670.
ISM-0670 requires central logging of security-relevant events for CDSs. E8-AH-ML2.12 relates by centralising command line process creation logs, which can be a critical security signal on CDS hosts and supporting systems. E8-AH-ML2.12 is narrower because it is limited to one telemetry type, while ISM-0670 applies broadly to CDS security events.
This control partially meets ISM-1405.
E8-AH-ML2.12 requires centralised logging specifically for command line process creation events. ISM-1405 requires implementation of a centralised event logging facility that can ingest logs from multiple sources across the environment. E8-AH-ML2.12 is a specific use case that would be implemented within the broader capability mandated by ISM-1405.
This control partially overlaps ISM-1607.
E8-AH-ML2.12 requires centralised logging of command line process creation events on hosts. ISM-1607 requires integrity monitoring and centralised event logging for the isolation mechanism and underlying operating system when using software-based isolation to share server hardware. They overlap on the centralised logging concept for the underlying OS, but ISM-1607 is context-specific to shared servers and adds integrity monitoring requirements that E8-AH-ML2.12 does not address.
This control partially overlaps ISM-1623.
E8-AH-ML2.12 requires that command line process creation events are centrally logged. ISM-1623 requires central logging of PowerShell module logging, script block logging and transcription, which captures detailed command and script execution content. They overlap because PowerShell activity is often initiated via command line and both aim to centralise execution-related telemetry, but ISM-1623 is PowerShell-specific and focuses on script content rather than generic process creation events across all shells and binaries.
This control supports ISM-0580.
ISM-0580 requires an organisation to develop, implement and maintain an event logging policy to ensure events are recorded and monitored. E8-AH-ML2.12 mandates central logging of command line process creation events, a specific telemetry source that would typically be required and prioritised through the policy established by ISM-0580. ISM-0580 does not specify particular operating system event IDs or telemetry types, while E8-AH-ML2.12 does.
This control supports ISM-0585.
E8-AH-ML2.12 requires central logging of command line process creation events. ISM-0585 requires that logged events capture key fields such as date/time, user or process, filename and equipment involved, which are essential to make command line process creation logs actionable. ISM-0585 strengthens E8-AH-ML2.12 by improving the quality and investigative value of the centrally collected process creation records.
This control supports ISM-1228.
E8-AH-ML2.12 requires centralised logging of command line process creation events so that execution activity is available for monitoring. ISM-1228 requires cyber security events to be analysed in a timely manner to identify incidents, which depends on having relevant logs available. E8-AH-ML2.12 supports ISM-1228 by improving visibility for analysis, but it does not itself require analysis workflows or timeliness.
This control supports ISM-1907.
E8-AH-ML2.12 requires command line process creation events to be centrally logged, creating a reliable log source for server monitoring. ISM-1907 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. E8-AH-ML2.12 supports ISM-1907 by ensuring a key category of server telemetry is centralised and available for that analysis, but ISM-1907 is about analysis timeliness and applies to many log types beyond command line events.
This control supports ISM-1976.
E8-AH-ML2.12 requires centralised logging of command line process creation to detect suspicious execution. ISM-1976 requires central logging of security-relevant events for macOS, which may include process execution telemetry depending on audit configuration and tooling. ISM-1976 supports coverage of E8-AH-ML2.12 on macOS, but is broader and not explicitly limited to command line process creation.
This control supports ISM-1977.
E8-AH-ML2.12 requires command line process creation events to be centrally logged. ISM-1977 requires central logging of security-relevant events for Linux operating systems, which can include process execution/audit events that capture command execution. ISM-1977 supports implementation of E8-AH-ML2.12 on Linux hosts, but does not uniquely target command line process creation events.
This control supports ISM-1986.
E8-AH-ML2.12 requires centralised logging of command line process creation events, which are commonly critical for detecting attacker tradecraft on servers. ISM-1986 requires event logs from critical servers to be analysed in a timely manner to detect cyber security events. E8-AH-ML2.12 supports ISM-1986 by ensuring an important subset of critical server logs is collected centrally, but it does not address the analysis cadence or the broader set of critical server log sources.
This control depends on ISM-1983.
E8-AH-ML2.12 requires centralised logging of command line process creation events, which is most valuable when logs arrive centrally quickly enough for monitoring and response. ISM-1983 requires that event logs are sent to the centralised logging facility as soon as possible after they occur. E8-AH-ML2.12 depends on ISM-1983-like timeliness to make centralisation effective for detection, though E8-AH-ML2.12 does not itself specify transmission latency.
ASD Essentials for enterprise IT: 1 mapping
- IT.DET-01.2Forward high-value security logs and configuration changes to central log storagePartially overlaps
This control partially overlaps IT.DET-01.2.
IT.DET-01.2 requires high-value, security-relevant event logs from infrastructure, operating systems and applications to be forwarded to central log storage; E8-AH-ML2.12 requires command line process creation events to be centrally logged, one specific event type within that.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.