Essential Eight AH-ML3.4 Analyse event logs from non-internet-facing servers for cyber threats
What it says
Event logs from non-internet-facing servers are analysed in a timely manner to detect cybersecurity events.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRegularly check server logs not exposed to the internet for signs of hacking.
This control is about regularly checking the logs of servers that aren't connected to the internet to spot any signs of hacking or cyber threats. It's important because even though these servers are not directly exposed to online threats, they could still be at risk from insiders or malware that sneaks in through other means. If we don't study these logs, a cyber attack might go unnoticed until it's too late.
Free. Save your status, tasks and notes.
Why it matters
Failure to analyse event logs on non-internet-facing servers can allow internal compromise to persist unnoticed, causing data loss and disruption.
How to implement
The IT team should schedule regular log analysis tasks.
They can do this by setting a weekly reminder to check logs for unusual activity using existing monitoring tools.
A security officer should identify key indicators of compromise.
They can do this by consulting cyber security resources and guidelines to understand what suspicious patterns to look for in the logs.
System administrators should ensure logs are stored safely.
They should configure systems to store logs in a secure, centralised server where they can't be easily tampered with.
The IT team should implement automated alerts for anomalies.
They can set up rules in their log management system to trigger alerts when specific suspicious activities are detected.
The security officer should review log analysis procedures regularly.
This can be done by scheduling quarterly meetings to review and update log analysis practices based on the latest security threats.
Keep it running
Centralise non-internet-facing server logs in a SIEM, alert on anomalies, and review alerts daily (not weekly) to detect threats promptly.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How are event logs from non-internet-facing servers reviewed for signs of cyber threats?
Look at
Check the log management procedures or schedules detailing regular log analysis.
Good evidence
The procedures/documents show frequent log analysis activities with assigned personnel and defined review schedules.
- Check 2 of 2What an auditor asks for
Ask for
What indicators do you watch for in the server logs?
Look at
Look at the training materials or guidelines specifying key signs of potential compromise.
Good evidence
Documents list clear indicators like multiple failed login attempts or unexpected software installations.
Mappings
Closest match in ASD Information Security Manual: ISM-1907, Timely analysis of non-internet-server logs, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.15.
E8-AH-ML3.4 requires organisations to analyse event logs from non-internet-facing servers in a timely manner to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.15 is broader, requiring logs to be produced, stored, protected and analysed across activities, exceptions and faults for relevant events. E8-AH-ML3.4 maps to the 'analysed' component of Annex A 8.15 for a specific asset scope (non-internet-facing servers) and with an explicit timeliness/detection objective.
This control partially meets A.8.16.
E8-AH-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.16 is broader, requiring monitoring of networks, systems and applications for anomalous behaviour and taking action to evaluate potential incidents. E8-AH-ML3.4 overlaps as a concrete log-analysis activity that supports anomalous behaviour detection, but Annex A 8.16 also covers other monitoring methods beyond log review.
ASD Information Security Manual: 9 mappings
This control is equivalent to ISM-1907.
E8-AH-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1907 states the same requirement for non-internet-facing server event logs and the same outcome (timely detection of cyber security events). The scope, asset type (non-internet-facing servers) and action (timely analysis) align closely between E8-AH-ML3.4 and ISM-1907.
This control partially meets ISM-1228.
E8-AH-ML3.4 requires timely analysis of event logs specifically from non-internet-facing servers to detect cyber security events. ISM-1228 is broader, requiring cyber security events to be analysed in a timely manner to identify incidents, without limiting to a particular log source or asset class. E8-AH-ML3.4 can be seen as a specific implementation path that contributes evidence and detection input into the broader analysis process described by ISM-1228.
This control partially overlaps ISM-1986.
E8-AH-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1986 also requires timely analysis of server logs, but it is scoped to 'critical servers' regardless of whether they are internet-facing or non-internet-facing. They overlap where critical servers are also non-internet-facing, but each control covers scenarios the other does not (non-critical non-internet-facing servers vs internet-facing critical servers).
This control partially overlaps ISM-2125.
ISM-2125 requires independent logging of service provider access and timely analysis to detect anomalous, unexpected or unauthorised activity. E8-AH-ML3.4 relates by requiring timely analysis of event logs from non-internet-facing servers, which may include systems accessed by service providers for administration. ISM-2125 additionally mandates that logging is controlled by the organisation and cannot be altered by the service provider, and it covers service provider access across systems, not only non-internet-facing servers.
This control depends on ISM-0120.
E8-AH-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-0120 ensures cyber security personnel have sufficient data sources and tools to monitor systems for key indicators of compromise, which directly enables effective log review and triage. Without the data access and tooling in ISM-0120, meeting the timeliness and detection intent of E8-AH-ML3.4 is likely impractical or incomplete.
This control depends on ISM-0988.
E8-AH-ML3.4 requires organisations to analyse event logs from non-internet-facing servers in a timely manner to detect cyber security events. ISM-0988 requires an accurate and consistent time source for event logging, which improves correlation, sequencing and incident reconstruction during log analysis. ISM-0988 does not require analysis itself, but it strengthens the reliability and usefulness of the analysis performed to satisfy E8-AH-ML3.4.
This control depends on ISM-1979.
E8-AH-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1979 requires security-relevant events for server applications on non-internet-facing servers to be centrally logged, which improves completeness and accessibility of log data for analysis. In practice, achieving timely, consistent analysis under E8-AH-ML3.4 is often dependent on the central logging capability mandated by ISM-1979, although E8-AH-ML3.4 can be performed with local logs at reduced effectiveness.
This control depends on ISM-2129.
ISM-2129 requires WMI activity, including permanent event subscriptions, to be centrally logged. E8-AH-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cybersecurity events, and WMI logs materially improve detection of common attacker techniques on Windows servers.
- ISM-2132Central logging of certificate enrolment requests, template and AD CS configuration changesDepends on
This control depends on ISM-2132.
ISM-2132 requires that all certificate enrolment requests (successful and unsuccessful) and changes to certificate templates or AD CS configuration are centrally logged. This supports E8-AH-ML3.4 because AD CS typically runs on non-internet-facing servers and centralising these events ensures they are available for timely threat-focused log analysis.
ASD Essentials for enterprise IT: 2 mappings
This control partially overlaps IT.DET-03.1.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-AH-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events, an earlier step that feeds triage.
- IT.DET-04.1Continuously monitor software execution to detect malicious use of legitimate toolsPartially overlaps
This control partially overlaps IT.DET-04.1.
IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-AH-ML3.4 (user application hardening) requires timely analysis of event logs from non-internet-facing servers, a related detection duty.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.