Essential Eight AH-ML2.14 Timely analysis of event logs from internet-facing servers

This control partially meets A.8.15.

E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.15 is broader because it requires logs to be produced, stored, protected and analysed across the organisation for relevant events. E8-AH-ML2.14 is a specific subset focusing on one high-risk log source (internet-facing servers) and the analysis aspect in particular.

This control partially meets A.8.16.

E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.16 is broader because it requires monitoring networks, systems and applications for anomalous behaviour and taking actions to evaluate potential incidents, which can include telemetry beyond logs. E8-AH-ML2.14 is one specific monitoring method (log analysis) applied to a specific high-risk system class.

This control partially overlaps A.5.28.

E8-AH-ML2.14 requires timely analysis of internet-facing server event logs to detect cyber security events. ISO/IEC 27001:2022 Annex A 5.28 requires procedures to identify, collect, acquire and preserve evidence related to information security events, which often leverages event logs as evidence. They overlap where analysed server logs become preserved evidence, but 5.28 focuses on evidentiary handling and chain-of-custody rather than ongoing detection monitoring.

This control supports A.5.25.

E8-AH-ML2.14 requires timely analysis of internet-facing server event logs to detect cyber security events. ISO/IEC 27001:2022 Annex A 5.25 requires assessing information security events and deciding whether they should be categorised as incidents, which depends on having timely and accurate event information. E8-AH-ML2.14 supports Annex A 5.25 by producing analysed log evidence that feeds event triage and categorisation.

This control is equivalent to ISM-1906.

E8-AH-ML2.14 requires event logs from internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1906 states the same requirement for the same asset class (internet-facing servers) and the same objective (detect cyber security events) with comparable specificity. Implementing ISM-1906 would largely satisfy E8-AH-ML2.14 and vice versa.

This control partially meets ISM-1228.

E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1228 is broader because it requires cyber security events (from any source) to be analysed in a timely manner to identify incidents, not limited to a particular log source or asset type. E8-AH-ML2.14 is a specific implementation pathway that supports meeting ISM-1228 for the internet-facing server logging stream.

This control partially overlaps ISM-1907.

E8-AH-ML2.14 requires event logs from internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1907 requires timely analysis of event logs from non-internet-facing servers for the same detection purpose, using the same operational concept (review/analysis for event detection). They align on the activity and intent, but differ on asset scope (internet-facing vs internal servers), so neither fully satisfies the other.

This control partially overlaps ISM-1960.

E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1960 requires timely analysis of event logs from internet-facing network devices, applying the same monitoring/analysis practice but to a different technology class. They overlap on the log analysis activity and timeliness expectation, but cover different sources (servers vs network devices).

This control partially overlaps ISM-1961.

ISM-1961 requires timely analysis of event logs from non-internet-facing network devices to detect cyber security events. E8-AH-ML2.14 relates by requiring timely analysis of event logs to detect events, but it applies to internet-facing servers instead of internal network devices. The shared mechanism is log analysis for detection, while the exposure and system type differ (internet-facing servers vs internal network devices).

This control partially overlaps ISM-1963.

E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1963 requires central logging of security-relevant events for internet-facing network devices, which complements detection across the internet perimeter. They share the goal of enabling detection via logs, but differ in both activity (analysis vs centralisation) and asset type (servers vs network devices).

This control partially overlaps ISM-1986.

E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1986 requires timely analysis of event logs from critical servers, which may include internet-facing servers but also includes critical internal servers. The overlap exists where an internet-facing server is also classified as critical; otherwise, the scoping criteria differ (exposure vs criticality).

This control partially overlaps ISM-1987.

E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1987 requires timely analysis of event logs from security products (e.g. EDR, SIEM, IDS), which often ingest or correlate server logs to detect events. The controls align on timely log analysis for detection, but ISM-1987 focuses on security tooling logs rather than server-originated logs specifically.

This control partially overlaps ISM-2125.

ISM-2125 requires independent logging of service provider access and timely analysis to detect anomalous, unexpected or unauthorised activity. E8-AH-ML2.14 relates by requiring timely analysis of logs (specifically for internet-facing servers), which would help detect suspicious service-provider activity if it occurs on those servers. ISM-2125 is broader regarding log independence/tamper resistance and applies to all service provider access (not only internet-facing servers), while E8-AH-ML2.14 is broader in that it is not limited to service providers.

This control supports ISM-0580.

ISM-0580 requires an organisation to develop, implement and maintain an event logging policy to ensure events are recorded and monitored. E8-AH-ML2.14 mandates timely analysis of event logs from internet-facing servers to detect cyber security events, which is an implementation expectation that should be captured as procedures and performance requirements under the policy required by ISM-0580. ISM-0580 is governance across logging generally, while E8-AH-ML2.14 is a detection activity for a defined system class.

This control depends on ISM-1978.

E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1978 requires security-relevant events for server applications on internet-facing servers to be centrally logged, improving completeness and accessibility for review. Centralised logging is not strictly the same as analysis, but it is commonly a prerequisite to analyse logs consistently and promptly across multiple internet-facing servers.

This control depends on ISM-1983.

E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-1983 requires event logs to be forwarded to a centralised logging facility as soon as possible after they occur, which improves timeliness and reliability of subsequent analysis. Where the organisation relies on a central platform (e.g. SIEM) to perform the analysis required by E8-AH-ML2.14, rapid log forwarding is a practical prerequisite.

This control depends on ISM-2051.

E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events. ISM-2051 requires software to generate sufficient event logs to enable detection of cyber security events, which is a prerequisite for meaningful analysis. Without ISM-2051-style log sufficiency on internet-facing servers, E8-AH-ML2.14 cannot be effectively achieved.

This control depends on ISM-2129.

ISM-2129 requires WMI activity, including permanent event subscriptions, to be centrally logged. E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers, and central WMI logging from those servers increases visibility of lateral movement, remote management, and persistence attempts.

This control partially overlaps IT.DET-03.1.

IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-AH-ML2.14 requires timely analysis of event logs from internet-facing servers to detect cyber security events, surfacing the events that triage then assesses.