Essential Eight AH-ML3.5 Timely analysis of workstation event logs for cyber security
What it says
Event logs from workstations are analysed in a timely manner to detect cybersecurity events.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishQuickly analyse workstation logs to detect security issues.
This control is about making sure we regularly check and analyse the event logs on our computers to spot signs of cyber threats. Think of it like regularly checking your bank statement for any suspicious activity. If we don't do this, cyber criminals might break into our systems and cause harm before we're even aware there's a problem.
Free. Save your status, tasks and notes.
Why it matters
If workstation event logs aren't analysed promptly, malicious activity can go unnoticed, delaying detection and response and increasing the scope of compromise.
How to implement
The IT team should ensure logs from all workstations are being collected centrally.
They can do this by setting up a system that gathers logs from each computer in one place.
The security officer should schedule regular reviews of log data.
This can be done by setting up a calendar reminder to check the logs at least once a day.
System administrators should automate the analysis process.
They can use software tools that scan the logs and alert when something unusual happens.
The IT team should ensure the logging system is set up to prevent unauthorised access or changes to the logs.
They can do this by setting permissions that limit who can view or alter logs.
Security officers should create a plan for what to do if they find something suspicious in the logs, including who to notify and what steps to take next.
Keep it running
Schedule workstation event log reviews and tune alert rules so high-risk events are triaged quickly; document review frequency, escalation steps and retention.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
Who is responsible for reviewing workstation event logs and how often is it done?
Look at
Examine the schedule or rota of log reviews and any automated alerts set up for log analysis.
Good evidence
Evidence shows logs are reviewed daily with automated alerts set for suspicious activity.
- Check 2 of 2What an auditor asks for
Ask for
Can you show how logs are stored and protected from tampering?
Look at
Review the settings or system configurations that control access to logs.
Good evidence
Logs are stored securely with access control settings preventing unauthorised alterations.
Mappings
Closest match in ASD Information Security Manual: ISM-0109, Timely analysis of workstation event logs, which asks for the same thing.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.15.
E8-AH-ML3.5 requires event logs from workstations to be analysed in a timely manner to detect cyber security events. Annex A 8.15 requires organisations to produce, store, protect and analyse logs for activities, exceptions and faults across the environment. E8-AH-ML3.5 maps to the 'analyse' expectation but is narrower because it is workstation-specific and does not cover log generation, storage, or protection requirements.
This control partially meets A.8.16.
E8-AH-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. Annex A 8.16 requires monitoring of networks, systems and applications for anomalies and incident evaluation, including log analysis as a method. E8-AH-ML3.5 is log-analysis focused and specific to workstations, whereas Annex A 8.16 is broader.
This control supports A.5.25.
E8-AH-ML3.5 requires organisations to analyse workstation event logs in a timely manner to detect cyber security events. Annex A 5.25 requires assessment of information security events and categorising them as incidents, relying on credible detection inputs. E8-AH-ML3.5 supports Annex A 5.25 by providing timely, evidence-based event data.
ASD Information Security Manual: 11 mappings
This control is equivalent to ISM-0109.
ISM-0109 requires event logs from workstations to be analysed in a timely manner to detect cyber security events. E8-AH-ML3.5 contains the same requirement word for word as part of Essential Eight Maturity Level Three. Implementing one satisfies the other, although E8-AH-ML3.5 sits within the user application hardening strategy, so the analysis would be expected to cover application-related events.
This control is broader than ISM-1228.
E8-AH-ML3.5 requires analysing workstation event logs in a timely manner to detect cyber security events. ISM-1228 is broader because it requires cyber security events (from any source) to be analysed in a timely manner to determine whether they constitute incidents. E8-AH-ML3.5 is one important input to ISM-1228 (workstation-derived events), but ISM-1228 also covers analysis beyond log review and across more sources.
This control partially overlaps ISM-1906.
E8-AH-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. ISM-1906 similarly requires timely analysis of event logs, but it is scoped to internet-facing servers. They overlap on the core detection practice (timely log analysis), while differing in asset class and typical log sources.
This control partially overlaps ISM-1907.
E8-AH-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. ISM-1907 requires timely analysis of event logs from non-internet-facing servers, using the detection-oriented activity but for a different system category. The overlap is in the requirement to review logs promptly; the difference is the device scope.
This control partially overlaps ISM-1960.
E8-AH-ML3.5 addresses timely analysis of workstation event logs to detect cyber security events. ISM-1960 applies the same type of requirement to internet-facing network devices' event logs. The overlap is in the monitoring practice and timeliness for detection, but the covered assets and log content differ materially (endpoint events versus perimeter/network device events).
This control partially overlaps ISM-1961.
E8-AH-ML3.5 requires event logs from workstations to be analysed in a timely manner to detect cyber security events. ISM-1961 requires the same timely analysis practice for non-internet-facing network devices (e.g. switches/routers/firewalls). They overlap in log-review-for-detection, differing in telemetry types and ownership.
This control partially overlaps ISM-1986.
E8-AH-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. ISM-1986 requires timely analysis of event logs from critical servers, which is the same function applied to a higher criticality asset group. The overlap is the analysis timeliness and detection objective; the difference is asset scope.
This control partially overlaps ISM-1987.
E8-AH-ML3.5 requires event logs from workstations to be analysed in a timely manner to detect cyber security events. ISM-1987 requires timely analysis of event logs from security products, which often ingest workstation telemetry. They overlap in prompt analysis requirement but differ in log focus.
This control depends on ISM-0120.
E8-AH-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. ISM-0120 requires cyber security personnel to have sufficient data sources and tools for monitoring systems, which includes access to endpoint log sources. E8-AH-ML3.5 is dependent on ISM-0120 for appropriate tooling and data access.
This control depends on ISM-0580.
E8-AH-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. ISM-0580 requires an event logging policy to be developed, defining review frequencies, responsibilities, and escalation thresholds necessary for 'timely analysis'. E8-AH-ML3.5 is dependent on ISM-0580 to set operational rules for workstation log analysis.
This control depends on ISM-2051.
E8-AH-ML3.5 requires organisations to analyse workstation event logs in a timely manner. ISM-2051 requires event log generation sufficient for detection, which is necessary for effective workstation log analysis. Without ISM-2051's logging sufficiency, E8-AH-ML3.5 cannot reliably detect events due to missing logs.
ASD Essentials for enterprise IT: 2 mappings
- IT.DET-02.2Deploy detection rules for unauthorised changes, anomalous authentication and suspicious software executionPartially overlaps
This control partially overlaps IT.DET-02.2.
IT.DET-02.2 requires detection logic for unauthorised changes, anomalous authentication activity and suspicious software execution; E8-AH-ML3.5 requires timely analysis of event logs from workstations to detect cyber security events, so the two overlap on detection at workstations.
This control partially overlaps IT.DET-03.1.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-AH-ML3.5 requires timely analysis of workstation event logs to detect cyber security events, the detection step whose results are then triaged.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.