Essential Eight AH-ML2.15 Timely analysis of cyber security events to identify incidents

This control partially overlaps A.5.25.

E8-AH-ML2.15 requires cyber security events to be analysed in a timely manner so they can be identified and treated as incidents. ISO/IEC 27001:2022 Annex A 5.25 aligns by requiring assessment of information security events and an explicit decision on whether they are information security incidents. Annex A 5.25 focuses on the decision/classification process (triage and categorisation), while E8-AH-ML2.15 emphasises timeliness and operational analysis to find incidents from events.

This control partially overlaps A.8.16.

E8-AH-ML2.15 requires cyber security events to be analysed timely to identify incidents. Annex A 8.16 requires monitoring for anomalous behaviour and evaluating potential incidents, which includes relevant triage and analysis activities.

This control depends on A.8.15.

E8-AH-ML2.15 requires timely analysis of cyber security events to identify incidents. ISO/IEC 27001:2022 Annex A 8.15 requires logs to be produced, protected, stored and analysed, which provides the primary evidence stream and telemetry needed to perform that event analysis. Without Annex A 8.15-style logging and log analysis capabilities, E8-AH-ML2.15 cannot be performed consistently across systems because there may be insufficient event data to analyse in the first place.

This control depends on A.8.17.

E8-AH-ML2.15 requires timely analysis of cyber security events to identify incidents. ISO/IEC 27001:2022 Annex A 8.17 supports this by ensuring clock synchronisation so event timestamps across systems are comparable, enabling accurate correlation and rapid triage during incident identification. Annex A 8.17 is a time integrity/consistency control and does not itself require event analysis or incident determination.

This control is equivalent to ISM-1228.

E8-AH-ML2.15 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. ISM-1228 states the same requirement with the same intent and outcome (rapid analysis to determine whether an event is an incident). Implementing ISM-1228 would largely satisfy E8-AH-ML2.15 because both focus on timely event analysis and incident identification.

This control partially meets ISM-1986.

E8-AH-ML2.15 requires timely analysis of cyber security events to identify incidents. ISM-1986 is narrower, focusing on analysis of critical server event logs. E8-AH-ML2.15 is broader as it applies across all sources and decides if an event is an incident.

This control depends on ISM-0109.

ISM-0109 requires event logs from workstations to be analysed in a timely manner to detect cyber security events. Detecting events from workstation logs feeds directly into E8-AH-ML2.15, which requires cyber security events to be analysed in a timely manner to identify cyber security incidents. ISM-0109 is limited to workstation log analysis for event detection, while E8-AH-ML2.15 covers the subsequent triage of events into incidents.

This control depends on ISM-0120.

E8-AH-ML2.15 requires organisations to analyse cyber security events in a timely manner to identify incidents. ISM-0120 ensures cyber security personnel have sufficient data sources and tools to monitor for indicators of compromise, necessary for effective event analysis.

This control depends on ISM-0634.

E8-AH-ML2.15 requires timely analysis of cyber security events to identify incidents. ISM-0634 requires central logging of gateway security-relevant events (including intrusion alerts and permitted/attempted flows), which provides essential input data for event analysis and incident determination at the perimeter. ISM-0634 is focused on collecting and centralising gateway events, while E8-AH-ML2.15 is focused on analysing events quickly to decide whether an incident exists.

This control depends on ISM-1030.

E8-AH-ML2.15 requires organisations to analyse cyber security events in a timely manner to identify incidents. ISM-1030 requires deploying a NIDS/NIPS at gateways and configuring it to generate event logs and alerts, which is a key prerequisite source of cyber security events for timely analysis. ISM-1030 focuses on implementing a specific detection capability at the network perimeter, while E8-AH-ML2.15 is the broader analytical and incident-identification requirement once events are generated.

This control depends on ISM-1526.

ISM-1526 requires ongoing monitoring of systems and associated cyber threats, security risks and controls by system owners. ASD Essential Eight E8-AH-ML2.15 supports this by requiring timely analysis of cyber security events to identify incidents, which is a key operational activity within continuous monitoring. ISM-1526 is broader in scope, while E8-AH-ML2.15 focuses specifically on event analysis for incident identification.

This control depends on ISM-1683.

ISM-1683 requires successful and unsuccessful MFA events to be centrally logged. E8-AH-ML2.15 requires timely analysis of cyber security events to identify incidents, and centrally logging MFA outcomes provides a reliable event source for detecting and triaging authentication attacks. E8-AH-ML2.15 emphasises analysis and incident identification, while ISM-1683 focuses on ensuring the MFA event data is captured centrally in the first place.

This control depends on ISM-1830.

E8-AH-ML2.15 requires timely analysis of cyber security events to identify incidents. ISM-1830 requires central logging of security-relevant events for key Microsoft identity infrastructure (AD DS/CS/FS and Entra Connect), which is a prerequisite data-collection foundation to enable timely event analysis for those platforms. ISM-1830 is limited to specific Microsoft server roles and focuses on log centralisation, while E8-AH-ML2.15 focuses on analysis and incident identification across the environment.

This control depends on ISM-1911.

E8-AH-ML2.15 requires timely analysis of cyber security events to identify incidents. ISM-1911 requires centralised logging of security-relevant software usage, error messages and crashes, which increases visibility and creates a consolidated event dataset that can be analysed to identify incidents. ISM-1911 is about collecting and centralising a particular category of logs, while E8-AH-ML2.15 is about analysing events (from any source) quickly to determine whether they constitute an incident.

This control depends on ISM-2117.

ISM-2117 requires suitable AI models to augment detection of cyber security events and identification of incidents. ASD Essential Eight E8-AH-ML2.15 requires timely analysis of cyber security events to identify incidents, and AI-driven correlation and prioritisation can help analysts perform that analysis faster and more consistently. E8-AH-ML2.15 is a process/timeliness requirement independent of tooling choice, whereas ISM-2117 focuses on adopting AI to improve detection/identification capability.

This control partially overlaps IT.DET-03.1.

IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-AH-ML2.15 requires timely analysis of cyber security events to identify incidents, the same core task, though IT.DET-03.1 also names alerts and thresholds.

This control partially overlaps IT.DET-03.2.

IT.DET-03.2 requires incidents to be identified from indicators across identities, applications, data and infrastructure, not isolated signals; E8-AH-ML2.15 requires timely analysis of cyber security events to identify incidents, the analysis those wider indicators should inform.

This control partially overlaps IT.DET-04.1.

IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-AH-ML2.15 (user application hardening) requires timely analysis of cyber security events to identify incidents, overlapping on event analysis.