Essential Eight RA-ML2.10 Timely analysis of cyber security events to identify incidents
What it says
Cybersecurity events are analysed in a timely manner to identify cybersecurity incidents.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishQuickly review cyber events to spot security incidents.
This control is about quickly looking at the data from cyber security systems to find signs of a problem. It's like checking security camera footage soon after it's recorded so you can spot any break-ins. Without this, small security issues might grow into big ones before anyone notices.
Free. Save your status, tasks and notes.
Why it matters
Without timely event analysis, incidents may go unnoticed, resulting in delayed responses and increased damage from threats.
How to implement
The IT team should regularly review system alerts to detect any unusual activity.
This can be done by setting up a schedule to check alerts at least daily.
Security officers should establish a process for investigating alerts.
They can do this by creating an incident response plan that outlines the steps to follow when an alert is deemed suspicious.
The system administrator should ensure that logs are centralised in one system for easier access.
They can accomplish this by configuring log management software to collect logs from all critical systems.
The security team should train staff on recognising suspicious activity and responding appropriately.
This training should include practical exercises to help staff understand what to look for and how to report it.
Keep it running
Ensure cyber events are reviewed within defined SLAs and suspect patterns are escalated promptly to prevent incident escalation.
Evidence and audit
- Check 1 of 3What an auditor asks for
Ask for
How quickly are cyber security events reviewed?
Look at
Review process documents and logs for evidence of timely analysis.
Good evidence
Documents show daily reviews of logs and incidents are logged within hours of detection.
- Check 2 of 3What an auditor asks for
Ask for
What process is in place to confirm that investigations occur after alerts?
Look at
Check incident response plans and investigation records.
Good evidence
Investigation logs confirm each alert is reviewed, with details of the response actions taken.
- Check 3 of 3What an auditor asks for
Ask for
Is log data centralised?
Look at
Examine the log collection and management system configuration.
Good evidence
System settings show logs are collected from all critical areas and accessible from a single platform.
Mappings
Closest match in ASD Information Security Manual: ISM-1228, Analyse cyber security events promptly, which asks for the same thing.
ISO/IEC 27001: 3 mappings
This control partially overlaps A.5.25.
E8-RA-ML2.10 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. Annex A 5.25 requires assessment of information security events and a decision on whether they are categorised as incidents, which is the core decision point E8-RA-ML2.10 is aiming to achieve. Annex A 5.25 is more explicit about formal categorisation/decisioning, while E8-RA-ML2.10 emphasises timeliness of analysis to reach that determination.
This control partially overlaps A.8.16.
E8-RA-ML2.10 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. Annex A 8.16 requires monitoring for anomalous behaviour and taking appropriate actions to evaluate potential information security incidents, which includes analysis activities aligned to E8-RA-ML2.10. Annex A 8.16 is broader in explicitly requiring continuous monitoring and response actions, while E8-RA-ML2.10 is specifically about timely analysis to classify events as incidents.
This control depends on A.8.17.
E8-RA-ML2.10 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. Annex A 8.17 requires clock synchronisation so event timestamps are consistent across systems, which improves the quality and speed of analysis performed under E8-RA-ML2.10. Annex A 8.17 does not require any analysis activity itself; it strengthens investigative accuracy and correlation during incident identification.
ASD Information Security Manual: 9 mappings
This control is equivalent to ISM-1228.
ISM-1228 requires timely analysis of cyber security events to determine whether they constitute incidents. E8-RA-ML2.10 matches this requirement directly by mandating timely analysis of cyber security events to identify incidents. Both controls focus on the analysis/triage step between 'event' and 'incident'.
This control partially overlaps ISM-1906.
E8-RA-ML2.10 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. ISM-1906 operationalises this for one high-risk log source by requiring timely analysis of event logs from internet-facing servers to detect cyber security events. The overlap is the timeliness and analytical review to surface incidents, but ISM-1906 is limited to a specific asset class while E8-RA-ML2.10 applies across the organisation's event sources.
This control partially overlaps ISM-1907.
E8-RA-ML2.10 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. ISM-1907 requires timely analysis of event logs from non-internet-facing servers to detect cyber security events, supporting the same detection-to-incident pathway. The overlap is the timeliness and analysis expectation, but ISM-1907 is scoped to a specific server category while E8-RA-ML2.10 is organisation-wide and oriented to incident identification.
This control partially overlaps ISM-1961.
E8-RA-ML2.10 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. ISM-1961 requires timely analysis of event logs from non-internet-facing network devices to detect cyber security events, which feeds incident identification. The overlap is timely analysis, but ISM-1961 is limited to a particular log source category and focuses on event detection rather than the broader incident identification decision-making implied by E8-RA-ML2.10.
This control partially overlaps ISM-1986.
E8-RA-ML2.10 requires cyber security events to be analysed in a timely manner to identify cyber security incidents. ISM-1986 specifies timely analysis of event logs from critical servers to detect cyber security events, directly contributing to incident identification. The overlap is the expectation of prompt log/event review, but ISM-1986 is constrained to critical servers whereas E8-RA-ML2.10 is broader across event sources and incident identification processes.
- ISM-1526System owners continuously monitor security and manage threats, risks and controlsDepends on
This control depends on ISM-1526.
ISM-1526 requires system owners to monitor systems and associated cyber threats and risks on an ongoing basis. ASD Essential Eight E8-RA-ML2.10 supports this by requiring timely analysis of cyber security events to identify incidents, which is a concrete monitoring-and-detection activity. ISM-1526 extends beyond event analysis to include broader security risk and control monitoring responsibilities.
This control depends on ISM-1960.
ISM-1960 supports E8-RA-ML2.10 by ensuring timely review of perimeter events. This aids in the timely analysis of detected events to identify incidents.
This control depends on ISM-1987.
E8-RA-ML2.10 requires timely analysis of cyber security events to determine whether they constitute incidents. ISM-1987 focuses specifically on timely analysis of event logs from security products to detect cyber security events, which feeds the event stream that E8-RA-ML2.10 then triages into incidents. ISM-1987 is log-source specific and detection-oriented, while E8-RA-ML2.10 is broader in covering event-to-incident analysis across sources.
This control depends on ISM-2116.
ISM-2116 requires cyber threat intelligence services to be used to support event detection and incident identification. ASD Essential Eight E8-RA-ML2.10 requires timely analysis of cyber security events to identify incidents, and ISM-2116 supports it by enabling threat-based incident hypotheses (e.g. "possible credential theft", "known ransomware staging behaviour") that guide which event sequences to correlate and which alerts to prioritise. E8-RA-ML2.10 measures the timeliness/discipline of event-to-incident analysis, while ISM-2116 improves the quality of that analysis by injecting external/internal adversary knowledge.
ASD Essentials for enterprise IT: 3 mappings
This control partially overlaps IT.DET-03.1.
IT.DET-03.1 requires timely triage of alerts and events to decide whether cyber security incident thresholds are met; E8-RA-ML2.10 requires cyber security events to be analysed in a timely manner to identify cyber security incidents, the heart of that triage.
- IT.DET-03.2Correlate signals across identities, applications, data and infrastructure to identify incidentsPartially overlaps
This control partially overlaps IT.DET-03.2.
IT.DET-03.2 requires incidents to be identified from indicators across identities, applications, data and infrastructure, not isolated signals; E8-RA-ML2.10 requires timely analysis of cyber security events to identify incidents, and IT.DET-03.2 sets out what it should draw on.
- IT.DET-04.1Continuously monitor software execution to detect malicious use of legitimate toolsPartially overlaps
This control partially overlaps IT.DET-04.1.
IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-RA-ML2.10 (restrict administrative privileges) requires timely analysis of cyber security events to identify incidents, overlapping on event analysis.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.