Essential Eight MF-ML3.5 Timely analysis of workstation event logs for cyber security events
What it says
Event logs from workstations are analysed in a timely manner to detect cybersecurity events.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEnsure workstation event logs are reviewed quickly to spot cyber security issues.
Checking workstation event logs in a timely manner is like keeping an eye on your home security camera footage. If someone tries to break in, you want to know as soon as possible so you can take action right away. Ignoring these logs could mean missing signs of a cyber attack until it's too late.
Free. Save your status, tasks and notes.
Why it matters
Without prompt analysis of workstation event logs, attacks and suspicious activity may be missed, enabling lateral movement and potential data breach.
How to implement
System administrator: Collect event logs from all workstations on a daily basis to ensure you have the most up-to-date information.
IT team: Set up automated alerts for unusual activities in event logs, such as multiple failed login attempts, to quickly identify potential security threats.
Security officer: Review daily summaries of event log activities to spot any anomalies that may require further investigation.
System administrator: Use tools to filter and analyse log data, making it easier to focus on significant security-related events without getting overwhelmed by routine entries.
IT team: Ensure that event logs are stored securely and backed up regularly, so information is not lost and can be reviewed as needed.
Keep it running
Analyse workstation event logs daily; alert on suspicious sign-ins, privilege changes and malware indicators. Automate correlation and triage to speed detection.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
How often are workstation event logs reviewed for cyber security threats?
Look at
Examine the logs of workstation event reviews and summaries.
Good evidence
Event logs are reviewed daily with automated systems in place to alert IT staff of any suspicious activity immediately.
- Check 2 of 2What an auditor asks for
Ask for
What process is in place to respond to detected cyber security events?
Look at
Review the organisation's protocol for responding to alerts generated from event logs.
Good evidence
A detailed response protocol exists, specifying steps to take and the responsible team members for handling detected threats.
Mappings
Closest match in ASD Information Security Manual: ISM-0109, Timely analysis of workstation event logs, which asks for the same thing.
ISO/IEC 27001: 3 mappings
This control partially meets A.8.15.
E8-MF-ML3.5 requires event logs from workstations to be analysed in a timely manner to detect cyber security events. This aligns with Annex A 8.15, which requires organisations to produce, store, protect and analyse logs of relevant events, including faults and exceptions. Annex A 8.15 is broader because it covers the full logging lifecycle and applies across systems, whereas E8-MF-ML3.5 is specifically focused on timely analysis for workstation logs.
This control partially meets A.8.16.
E8-MF-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. This relates to Annex A 8.16 because monitoring systems for anomalous behaviour commonly relies on workstation telemetry and log analysis as an input to identify potential incidents. Annex A 8.16 is broader as it covers monitoring across networks, systems and applications and includes taking actions to evaluate potential incidents, not just analysing workstation logs.
This control supports A.5.25.
E8-MF-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. This supports Annex A 5.25 by providing the evidence (detected events from workstation logs) that the organisation can then assess and decide whether to categorise as an information security incident. Annex A 5.25 is about decision-making and classification, while E8-MF-ML3.5 is about the detection activity that feeds that process.
ASD Information Security Manual: 8 mappings
This control is equivalent to ISM-0109.
ISM-0109 requires event logs from workstations to be analysed in a timely manner to detect cyber security events. E8-MF-ML3.5 contains the same requirement word for word as part of Essential Eight Maturity Level Three. Implementing one satisfies the other, although E8-MF-ML3.5 sits within the multi-factor authentication strategy, so the analysis would be expected to cover authentication-related events.
This control depends on ISM-0120.
E8-MF-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. This is dependent on ISM-0120 because cyber security personnel need access to appropriate data sources and tools (e.g. SIEM, EDR consoles, query tooling) to monitor and analyse workstation log indicators of compromise in a timely manner. ISM-0120 addresses resourcing and tooling access, while E8-MF-ML3.5 specifies the operational outcome of timely workstation log analysis.
This control depends on ISM-0582.
E8-MF-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. This is dependent on ISM-0582 because central logging of Windows security events provides the consolidated, reliable workstation security event data needed to enable efficient analysis at scale. ISM-0582 focuses on collection/centralisation, while E8-MF-ML3.5 focuses on timely analytical review for detection.
This control depends on ISM-1228.
E8-MF-ML3.5 requires workstation event logs to be analysed in a timely manner to detect cyber security events. ISM-1228 focuses on timely analysis of cyber security events to determine whether they constitute incidents, which is an escalation/triage step that commonly consumes workstation log findings. The ISM control is broader in scope (all event sources and incident identification), while E8-MF-ML3.5 is a specific detection activity for the workstation log source.
This control depends on ISM-1405.
E8-MF-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. This is dependent on ISM-1405 because implementing a centralised event logging facility commonly underpins timely log analysis by enabling aggregation, correlation and efficient review workflows. ISM-1405 is about establishing the logging platform capability, whereas E8-MF-ML3.5 is about performing timely analysis of workstation logs.
This control depends on ISM-1976.
ISM-1976 requires macOS security event logs to be centrally collected so they are available for monitoring. E8-MF-ML3.5 requires timely analysis of workstation event logs to detect cyber security events, which depends on having workstation logs accessible and aggregated. ISM-1976 contributes the collection/centralisation foundation, while E8-MF-ML3.5 adds the operational detection/analysis requirement not covered by ISM-1976.
This control depends on ISM-1983.
E8-MF-ML3.5 requires workstation event logs to be analysed in a timely manner to detect cyber security events. ISM-1983 requires event logs to be sent to a centralised logging facility as soon as possible after they occur, which supports near-real-time visibility needed for timely analysis. Where the organisation relies on centralised monitoring/SIEM for analysis, E8-MF-ML3.5 is effectively dependent on ISM-1983 to avoid delay between event occurrence and analyst review.
This control depends on ISM-2051.
E8-MF-ML3.5 requires timely analysis of workstation event logs to detect cyber security events. This is dependent on ISM-2051 because organisations must first ensure software generates sufficient event logs to make meaningful workstation log analysis possible. ISM-2051 addresses log sufficiency/coverage, whereas E8-MF-ML3.5 addresses operational review and timeliness of analysis.
ASD Essentials for enterprise IT: 2 mappings
- IT.DET-02.2Deploy detection rules for unauthorised changes, anomalous authentication and suspicious software executionPartially overlaps
This control partially overlaps IT.DET-02.2.
IT.DET-02.2 requires detection logic for unauthorised changes, anomalous authentication activity and suspicious software execution; E8-MF-ML3.5 requires timely analysis of workstation event logs to detect cyber security events, analysis that such detection logic supports.
This control partially overlaps IT.DET-03.1.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-MF-ML3.5 requires event logs from workstations to be analysed in a timely manner to detect cyber security events, producing workstation events for triage to assess.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.