Essential Eight MF-ML3.4 Analyse event logs from non-internet-facing servers timely to detect security events
What it says
Event logs from non-internet-facing servers are analysed in a timely manner to detect cybersecurity events.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishRegularly check event logs from internal servers to catch security issues quickly.
Analysing event logs from internal servers regularly helps us catch signs of cyberattacks early. Without this practice, we might miss warning signs of someone trying to break into our systems, which could lead to data breaches and other serious security issues.
Free. Save your status, tasks and notes.
Why it matters
If logs on non-internet-facing servers aren't reviewed promptly, lateral movement and credential misuse may be missed, delaying detection of internal breaches.
How to implement
IT team should ensure logging is enabled on all non-internet-facing servers to capture security-related events correctly by configuring the servers' logging settings.
System administrators should collect logs from these servers daily and store them in a secure location, using automated scripts or log management tools to gather and centralise the information.
Security officers need to review and analyse the collected logs on a regular basis by using log analysis software to identify any unusual activities or patterns that might indicate a security incident.
The security team should establish a procedure for handling and escalating any suspicious events detected in the logs by setting up alerts or notifications so that appropriate actions are taken swiftly.
Keep it running
Define review cadence and alerts for non-internet-facing server logs; centralise to SIEM, tune rules, and investigate anomalies within agreed timeframes.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How often are the event logs from non-internet-facing servers reviewed?
Look at
Examine the log review policy and schedule.
Good evidence
The logs are reviewed every 24 hours according to our documented policy, which aligns with best practices.
- Check 2 of 2What an auditor asks for
Ask for
What tools are used for log analysis?
Look at
Check the installed software or services used for analysing logs.
Good evidence
We use an automated log analysis tool that provides alerts for potential security events, and it is verified to be functioning correctly.
Mappings
Closest match in ASD Information Security Manual: ISM-1907, Timely analysis of non-internet-server logs, which asks for the same thing.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.15.
E8-MF-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.15 is broader because it covers producing, storing, protecting and analysing logs across activities, exceptions and faults for relevant events, not limited to internal servers. E8-MF-ML3.4 fits within the "analysed" expectation of Annex A 8.15 for a specific log source and scope.
This control partially meets A.8.16.
E8-MF-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISO/IEC 27001:2022 Annex A 8.16 is broader as it requires monitoring networks, systems and applications for anomalous behaviour and taking appropriate actions to evaluate potential incidents. E8-MF-ML3.4 is one concrete monitoring activity that contributes to meeting Annex A 8.16 for internal servers.
ASD Information Security Manual: 10 mappings
This control is equivalent to ISM-1907.
E8-MF-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1907 states the same requirement for the same asset scope (non-internet-facing servers) and the same intent (timely detection of security events). There are no material differences in scope or depth between E8-MF-ML3.4 and ISM-1907.
This control is broader than ISM-1228.
E8-MF-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-1228 is broader because it requires cyber security events from any source to be analysed in a timely manner to identify incidents, not limited to server logs or to non-internet-facing systems. E8-MF-ML3.4 is a specific implementation focus that supports meeting the wider event-to-incident analysis expectation in ISM-1228.
This control partially overlaps ISM-1906.
E8-MF-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-1906 mandates the same type of timely analysis but for internet-facing servers. They overlap on the practice of prompt log review for detection, but their scopes are distinct based on server exposure.
This control partially overlaps ISM-1961.
E8-MF-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1961 is similar in intent and timeliness but applies specifically to non-internet-facing network devices rather than servers. The controls overlap on internal log analysis for detection but differ in asset class and therefore coverage.
This control partially overlaps ISM-1986.
E8-MF-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-1986 requires timely analysis of event logs from critical servers, which may include both internet-facing and non-internet-facing systems depending on classification. They overlap where critical servers are also non-internet-facing, but each control has unique scoping criteria (exposure vs criticality).
This control partially overlaps ISM-1987.
E8-MF-ML3.4 requires event logs from non-internet-facing servers to be analysed in a timely manner to detect cyber security events. ISM-1987 requires timely analysis of event logs from security products (e.g. EDR, SIEM, firewalls), which can provide detections relevant to internal server activity. They overlap on timely analysis for detection but differ in log source: server operating/application logs versus security product logs.
This control depends on ISM-0120.
E8-MF-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-0120 ensures cyber security personnel have sufficient data sources and tools to monitor for key indicators of compromise, which is a practical prerequisite to conducting timely and effective log analysis. E8-MF-ML3.4 specifies the monitoring activity, while ISM-0120 addresses capability enablement (data and tooling).
This control depends on ISM-1830.
E8-MF-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-1830 ensures security-relevant events from AD-related servers are centrally logged, which provides the log availability and aggregation needed to perform consistent analysis at scale. E8-MF-ML3.4 focuses on analysis, while ISM-1830 focuses on log collection/centralisation for a specific server set.
This control depends on ISM-1911.
E8-MF-ML3.4 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events. ISM-1911 requires central logging of security-relevant software usage, errors and crashes, which can be key event sources residing on internal servers and needed for effective analysis. ISM-1911 is about ensuring relevant logs are captured centrally, while E8-MF-ML3.4 is about the monitoring/analysis activity performed on those logs.
This control depends on ISM-1979.
ISM-1979 requires central logging of security-relevant events for server applications on non-internet-facing servers. E8-MF-ML3.4 requires timely analysis of non-internet-facing server event logs to detect cyber security events, which is strengthened by having logs forwarded to a central platform as required by ISM-1979. The candidate emphasises monitoring/analysis outcomes, while ISM-1979 emphasises centralised log capture.
ASD Essentials for enterprise IT: 2 mappings
This control partially overlaps IT.DET-03.1.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-MF-ML3.4 requires timely analysis of non-internet-facing server event logs to detect cyber security events, an input to that triage.
- IT.DET-04.1Continuously monitor software execution to detect malicious use of legitimate toolsPartially overlaps
This control partially overlaps IT.DET-04.1.
IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-MF-ML3.4 (multi-factor authentication) requires timely analysis of event logs from non-internet-facing servers, a related detection duty.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.